Data processing agreement

This agreement is part of the agreement between Cohavo (“we”, “the processor”) and the business that uses Cohavo (“you”, “the controller”), set out in our Terms of service.

1. Scope

1.1 It applies whenever we process personal data on your behalf to provide Cohavo (“your personal data”).

1.2 It doesn’t apply to personal data we handle as a controller ourselves, such as your users’ sign-in records, your contacts with us, billing, keeping our service secure, and the details we need to register your phone numbers with our carrier and move numbers to or from us, which UK numbering rules make our own duty. Our Privacy notice covers those.

1.3 If this agreement conflicts with the rest of our agreement about personal data, this one wins.

1.4 “Data protection law” means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended (including by the Data (Use and Access) Act 2025). Words like controller, processor, personal data breach and processing mean what the UK GDPR says.

2. What we process

The subject, length, nature and purpose of the processing, the types of personal data and the people concerned are in Annex 1.

3. Your responsibilities

3.1 You’re responsible for having a lawful basis for what you ask us to do, for telling people what they need to know (for example callers about recording and AI, and staff about monitoring), for your own data protection impact assessments, and for the lawfulness of the data you give us.

3.2 How you set up Cohavo (recording, how long data is kept, AI features, voice agents, connected services) is part of your instructions to us.

4. Acting only on your instructions

4.1 We process your personal data only on your documented instructions, including about transfers outside the UK, unless UK law requires otherwise. If it does, we’ll tell you first unless the law forbids it.

4.2 Our agreement, this DPA, how you set up Cohavo and anything else we agree in writing are your instructions.

4.3 We’ll tell you straight away if we think an instruction breaks data protection law.

4.4 We don’t use your personal data for our own purposes, we don’t sell it, and we don’t use it to train AI models. Each AI supplier’s own setting on training is stated on our Subprocessors page.

5. Confidentiality

Everyone we allow to process your personal data is bound to keep it confidential, and only accesses it to provide Cohavo, to give support you ask for, or to keep the service secure.

6. Security

6.1 We take appropriate technical and organisational measures to keep your personal data secure, taking into account the risks, the state of the art and the cost. Annex 2 describes them.

6.2 We may change them, as long as the overall level of security doesn’t go down.

7. Subprocessors

7.1 You give us general permission to use the subprocessors listed on our Subprocessors page.

7.2 Before we add or replace a subprocessor, we’ll email the owners of your Cohavo account and update the page at least 30 days in advance. If we have to replace one urgently to keep Cohavo running or secure, we’ll tell you as soon as we can.

7.3 You can object on reasonable data protection grounds within those 30 days. We’ll discuss it in good faith; if we can’t resolve it, you can end the affected part of Cohavo without any extra charge, before the change takes effect.

7.4 Each subprocessor is bound by a written contract with data protection terms that protect your data at least as well as this agreement, except Deepgram (clause 11.3). We stay responsible to you for what they do.

8. Helping with people’s rights

8.1 We’ll help you, as far as we reasonably can, to answer people who use their data protection rights (access, correction, deletion, restriction, portability, objection, and rights about automated decisions).

8.2 Admins can find, export and delete many records in Cohavo themselves. Where that isn’t enough, ask us and we’ll help within 5 business days.

8.3 If someone contacts us directly about your personal data, we’ll pass the request to you without undue delay and won’t answer it ourselves, other than to say we’ve passed it on, unless you ask us to.

8.4 We’ll also help you deal with data protection complaints about Cohavo.

9. Security incidents, breaches and assessments

9.1 We’ll help you meet your obligations on security, breach notification, data protection impact assessments and consulting the regulator (UK GDPR Articles 32 to 36), taking into account what we do and the information we have.

9.2 If we become aware of a personal data breach affecting your personal data, we’ll tell you without undue delay, and we aim to do so within 24 hours, so you can meet your own 72-hour deadline. We’ll tell you, as far as we know them, what happened, the kinds and rough numbers of people and records affected, the likely consequences, what we’ve done or plan to do, and who to contact. We may send this in stages.

9.3 We’ll take reasonable steps to contain and investigate the breach, and work with you. We won’t tell the regulator or the people affected on your behalf unless you agree or the law requires it. Where the law places a duty on us directly, we’ll meet it and tell you.

9.4 We’ll give you reasonable information to support your impact assessments for recording, transcription, AI and monitoring (see Recording and AI).

10. When the agreement ends

10.1 When our agreement ends, we’ll give you a copy of your personal data if you ask (see the Terms, section 15) and then delete it. We delete your server and storage within 30 days after the end, unless you tell us otherwise. Our backups of it expire within the following 30 days and stay protected and unused until then.

10.2 This doesn’t apply where UK law requires us to keep the data; then we protect it and use it only for that purpose.

10.3 On request, we’ll confirm the deletion in writing.

11. Transfers outside the UK

11.1 We don’t transfer your personal data outside the UK, or let a subprocessor do so, unless:

• the destination is covered by UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for US companies certified under it; or
• an appropriate safeguard under UK GDPR Article 46 is in place, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
• an exception under data protection law applies.

11.2 Our Subprocessors page shows where each subprocessor processes data and the safeguard it relies on.

11.3 One exception today: Deepgram (call transcription and live transcripts) has no data processing agreement with us, and its only safeguard is the EU Standard Contractual Clauses in its privacy policy, which don’t cover UK data on their own. If that matters to you, ask us to transcribe your calls with OpenAI or ElevenLabs instead (see Recording and AI).

12. Information and audits

12.1 We’ll give you the information you need to show that we meet Article 28, and allow for and contribute to audits, including inspections, by you or an auditor you choose.

12.2 To keep this proportionate, we’ll first answer reasonable written security questionnaires and share relevant evidence. An audit needs at least 30 days’ notice, takes place no more than once a year (unless after a breach or at a regulator’s request), during business hours, under confidentiality, at your cost, and without access to other customers’ data.

12.3 For our subprocessors, we’ll normally rely on their own reports and certifications (see our Security page).

13. Liability

Each of us is liable under this agreement within the limits in our Terms of service (section 13). Nothing limits either of our liability to the people whose data it is under UK GDPR Article 82, or to a regulator.

14. How long this lasts

This agreement lasts as long as we process your personal data.

Annex 1: what we process

Subject	Providing Cohavo: Phone, Desk, Chat, AI and Insights, as in your order.
How long	The length of our agreement, plus the time to return and delete data (clause 10).
What we do with it	Host, store, route and carry calls and messages; record calls (when set up); transcribe, summarise and analyse them (on the Pro plan, for calls taken by people with a Pro licence); show, report, back up, restore, export and delete.
Why	To provide Cohavo to you on your instructions, including support and keeping it secure.
Whose data	Your staff and users; your customers, callers, correspondents and website chat visitors; and other people mentioned in calls and messages.
What data	Names, phone numbers, email addresses and other contact details; customer records (names, job titles, companies, phone numbers, email and postal addresses, web links and notes); call details (numbers, times, durations, queue, who answered); call audio and recordings, voicemail messages included; transcripts, summaries, follow-ups and AI suggestions; AI reports on teams and people; email and ticket content and attachments; chat conversations, pictures and PDFs sent in them, and visitor details (pages visited, how they found you, browser and device, language and time zone); users’ accounts, status and activity; voice-agent conversations; content of alerts sent to Microsoft Teams.
Sensitive data	Not intended, but it may come up in calls and messages (for example a caller mentions their health). You decide whether you may lawfully keep it, and set recording and retention to suit.
How long it’s kept	As you set it in Company › Data & privacy. By default, recordings (voicemail messages included), transcripts, AI call notes and voice-agent conversations are deleted after 180 days, call history after 1 year and the audit log after 2 years; Desk tickets and emails are kept until you set a period (1 to 7 years), except tickets marked as spam or deleted, which are removed for good after 30 days; chats, with any pictures and PDFs sent in them, for 12 months. Customer records are kept until you delete them, except one made only from website chats, which goes with its chats. Nightly backups are kept for 30 days.
Where	Stored on your own server and storage bucket in London (DigitalOcean). Some subprocessors process data outside the UK: see clause 11 and our Subprocessors page.

Annex 2: security measures

These are the measures in place today. We’ll keep this list up to date.

Separation. Each customer has its own virtual server and its own storage bucket, with a storage key that reaches only that bucket. No customer’s server can reach another’s data.

Hosting. DigitalOcean’s London data centre. Cloud firewalls let in only the ports Cohavo needs. Administrative (SSH) access to servers only with a key and only from our office’s fixed internet address.

Signing in. Everyone who signs in with a password must also use a two-step code from an authenticator app, with backup codes. Passwords are stored only as salted one-way hashes. Sign-in with Microsoft or Google, if you switch it on, uses their checks instead. Repeated failed sign-ins are slowed and blocked automatically. Sessions expire after 7 days without use, or when the user signs out.

Permissions. Roles (owner, admin, team lead, agent) limit who can see recordings, listen in, change settings and export data. Changes to settings are recorded in an audit log.

Encryption in transit. Web and app traffic uses TLS 1.2 or later. Browser calls are encrypted (DTLS-SRTP). Calls on apps and desk phones set to use TLS are encrypted (TLS and SRTP); admins can require this for the apps.

Encryption at rest. We encrypt AI provider keys, two-step code secrets, sign-in secrets and Microsoft 365 connection tokens with keys held only on your server.

Recordings. Stored privately in your bucket and played only through your server, after it checks the user’s permission. Agents can pause a recording during a call (for example while a caller reads out card details); pauses are logged.

Our access. Access to customer servers is limited to the people who run Cohavo, with our private key and only from our office’s fixed internet address, and only to give support you ask for, fix incidents or keep the service secure.

Our console. The console we use to run every server is on its own server, open only to our office’s internet address, with passkeys and authenticator codes.

Monitoring. Our console checks every server and raises an alert if it goes offline, a service fails, a disk fills up, a nightly backup is missed, the phone line drops or a certificate is about to expire. Outgoing calls are checked against a list of allowed destinations, and spending is checked every hour.

Backups. Your database is backed up every night to your storage bucket and each backup is kept for 30 days.

AI. AI suppliers receive only what each feature needs. Website chat masks card numbers before saving messages, and email addresses and phone numbers before the AI assistant reads them.

Changes and testing. Every change to Cohavo runs through automated tests before it’s built. Test data is made up.

Annex 3: subprocessors

The current list, with what each does, where and under what safeguard, is on our Subprocessors page.