Define the responsibilities behind customer data.

1. Parties, roles and scope

The customer determines the purposes and means of processing the customer-service data it provides and remains responsible for lawful instructions, notices and permissions. Ideas2Goal Technologies Pvt Ltd processes that data for the agreed Voz360 service, subject to the applicable contract and documented instructions. Website enquiries handled for our own business purposes are covered separately by the Privacy Policy.

2. Instructions and permitted processing

Processing should be limited to delivering, maintaining, supporting and securing the agreed service and performing the customer's documented instructions, except where applicable law requires otherwise. The parties should establish a procedure for new instructions, requests outside the contracted scope and any instruction believed to conflict with applicable data protection law.

3. Confidentiality and personnel

People authorized to process customer data should be subject to appropriate confidentiality obligations and access limited to their responsibilities. The processing schedule should define support access, privileged administration and any customer approval requirements. Each party is responsible for the personnel and access decisions within its agreed scope.

4. Technical and organizational measures

The control schedule should identify the infrastructure and code-level measures applicable to the deployment, including encryption, authentication, MFA scope, RBAC, audit logging, secure development, testing and vulnerability handling. Hosting-provider safeguards and application controls have different scopes. Certificates or reports, where available, must identify the entity, system and period they actually cover.

5. Subprocessors and AI providers

The applicable DPA should identify authorized subprocessors or an authorization procedure, required contractual protections and how material changes are notified or reviewed. Confirm the providers involved in hosting, messaging, voice, email, transcription and AI for the deployment. Model-provider retention, processing locations and any training restrictions require explicit review; they are not established by the name of a product feature.

6. Assistance with individual rights

The parties should define how requests for access, correction, deletion, restriction, portability, objections, consent withdrawal or other applicable rights are recognized and routed. Where the customer controls the records, it normally decides the response. The processor assists within the service scope and applicable obligations rather than independently changing customer instructions.

7. Personal-data incidents

The DPA should set out notification and cooperation duties for a personal-data breach affecting the scoped processing, including notification without undue delay where required by applicable law. The parties should agree the contact channel, information to be provided as it becomes available and responsibilities for investigation, containment, customer decisions and any required regulator or individual communications.

8. International transfers

Identify the actual processing countries, remote-access arrangements and onward transfers for the deployment. Where restrictions apply, the parties must agree and implement the relevant lawful mechanism and supplementary measures as needed. An office address, a cloud-provider name or a marketing statement does not by itself establish a transfer safeguard or a data-residency promise.

9. Information, assessment and audit cooperation

The applicable terms should describe the information reasonably available to demonstrate performance of the DPA and the process for security questions, impact-assessment assistance and agreed audits. Scope, confidentiality, protection of other customers and operational constraints should be addressed. Independent reports may be subject to access conditions and must be reviewed for their actual scope.

10. Return, deletion and retained records

At the end of the service, return or deletion should follow the customer's instructions and the applicable agreement, subject to legal retention requirements. The schedule should address backups, recordings, logs and provider-held copies, including any deletion cycle or limits. Do not assume immediate removal from every backup or a fixed retention period unless it is included in the agreed scope.

11. Processing schedule to agree

The signed schedule should make the intended processing concrete. Include the subject matter, duration, nature and purposes, the categories of people and data, approved connections, security measures and contact responsibilities.

• People: the customer's service contacts, authorized agents, supervisors and administrators, as applicable to the deployment.
• Data: contact identifiers, conversations, calls/recordings, voicemail, transcripts, forms, CSAT and related handling information within the agreed service.
• AI scope: prompts, context and outputs used for authorized assistance, routing, transcription and quality workflows, with provider terms reviewed.
• Duration and location: the agreed service term, retention/deletion arrangements, authorized providers and processing/transfer locations.

12. Request the applicable addendum

Contact the team using Security & compliance and share your contracting entity, intended services and processing requirements. Request the DPA, subprocessor information, technical measures and any assurance evidence applicable to that scope. Do not send customer records or credentials with the initial request.