Legal

Data processing terms

Last updated 7 August 2026

Read this before publishing. This is a working draft, written to match exactly howRevvox actually handles data — not a generic template. It has not been reviewed by a lawyer. Telephone-consumer, privacy and consumer-protection rules differ by state and change often. Have qualified counsel review it, fill in every TO CONFIRM marker, and remove this notice before the page goes live.

1. When this applies

These terms apply whenever Revvox handles personal information on your behalf — which is most of what the product does. They form part of our terms of service. Where they conflict with the main terms on a data-protection question, these terms win.

2. Who is who

For the information about the people your ads generate — the leads we call — you are the controller and we are the processor. You decide those people are contacted and what is asked; we carry it out on your instruction.

If you are an agency acting for a client, you confirm you have your client’s authority to give us those instructions, and that your client understands an automated caller will be phoning their leads.

For information about your own staff and account, we are the controller — see our privacy policy.

3. What we process, and why

Subject matter	Contacting, qualifying and booking the leads your advertising generates, and reporting outcomes back to the advertising platforms you connect
Duration	For as long as your account is open, plus the retention periods in our privacy policy
Nature and purpose	Placing telephone calls, recording and transcribing calls, extracting answers, scoring them against your rules, storing the result, and sending conversion reports
Types of personal information	Name, telephone number, email address, postal area, the answers given on the call, call audio and transcript, and the permission record attached to the lead
Categories of people	Members of the public who submitted an enquiry to you or your client
Special category data	Not requested and not required. If your questions could elicit it — health, finances, or similar — tell us before you go live so it can be handled properly.

4. Acting on your instructions

We process personal information only on your documented instructions, which includes your configuration of the product. If we believe an instruction breaks the law, we will tell you rather than carry it out. We will not sell it or share it for advertising purposes.

5. Our people

Everyone at Revvox who can reach customer data is bound by confidentiality, and access is limited to those who need it to do their job. Access is logged.

6. Security

We maintain measures appropriate to the risk, including:

Encryption of data in transit and at rest
Encryption of the access tokens for your connected ad accounts
Role-based access, so salespeople see leads and calls but never billing or connection keys
An audit record of logins, exports and setting changes
Separation of each customer’s data, with no pooling between accounts
Backups, and a documented process for restoring them

TO CONFIRM: we hold no third-party security certification yet. State that plainly here rather than implying one, and update this section when that changes.

7. Sub-processors

You give general authorisation for us to use sub-processors. The current list is in section 8 of our privacy policy. We impose data-protection obligations on each of them no weaker than these, and we remain responsible to you for what they do.

We will give you TO CONFIRM days’ notice before adding or replacing one. If you reasonably object on data-protection grounds, you may terminate the affected part of the service without penalty.

8. Helping you meet your obligations

We will help you, at your cost where the effort is significant, with:

Requests from people to see, correct, delete or export their information
Data-protection impact assessments and prior consultations
Producing the permission and blocked-call evidence a regulator or a court might ask for — this exports as a file rather than requiring you to ask us to compile it

9. If something goes wrong

If personal information we hold for you is breached, we will tell you without undue delay and in any event within TO CONFIRM: 72 hours is the usual commitment of becoming aware, with what we know, what we are doing, and what you may need to do. We will not make a public statement identifying you without talking to you first, unless the law requires it.

10. Return and deletion

On termination you can export everything. After the export window in our terms, we delete it, except where the law requires us to keep something — and permission and do-not-call records, which we keep for longer on purpose because deleting them would destroy the evidence that a call was allowed.

11. Audits

We will make available the information needed to show we are meeting these terms, and will allow an audit by you or an auditor you appoint, no more than once a year unless a regulator requires otherwise, on reasonable notice and without disrupting other customers.

12. International transfers

Our systems run in TO CONFIRM: region. Where personal information is transferred to another country, we put the safeguards required by law in place for that transfer. TO CONFIRM with counsel: which transfer mechanism applies to your setup.