TERMS AND CONDITIONS OF USE AND SERVICE LEVEL AGREEMENT (SLA)

VOIZ.ES — B2B2C INTELLIGENT TELEPHONY SYSTEM AND VOICE AGENTS POWERED BY COMMERCIAL PSYCHOLOGY

B2B LEGAL AND CONTRACTUAL NOTICE: These Terms and Conditions of Use and Service Level Agreement (hereinafter, «the Terms» or «the Agreement») constitute a legally binding agreement entered into between the natural or legal person contracting the service (hereinafter, «the Client») and [VOIZ] (hereinafter, «VOIZ.ES» or «the Provider»).

By accepting the commercial proposal, completing payment for the Setup, activating the monthly subscription via the secure payment gateway Stripe Billing, enabling call forwarding to assigned telephony lines, or utilizing the voice agents in any manner, the Client declares that it has read, understood, and accepted in full these Terms, including its Schedule 1 (DPA) and its Schedule 2 (N3 Specification).

1. PURPOSE, SCOPE, AND NATURE OF THE SERVICE

1.1 Purpose of the Agreement

The purpose of these Terms is to govern the provision by VOIZ.ES of the services of technical design, prompt engineering, implementation, operation, cloud hosting, support, supervision, and maintenance of conversational Artificial Intelligence telephony agents (hereinafter, «the Voice Agent» or «the AI Service»), under the Basic, Growth, Pro, or Enterprise subscription plans. Said service is engineered specifically to integrate into the Client's telephony infrastructure for 24/7 inbound call handling, corporate information delivery, inquiry resolution, appointment scheduling, and preliminary commercial lead qualification.

1.2 Scope Matrix by Plan Level

Operational capacities, integration depth, and conversational intelligence levels are structured pursuant to the specific tier contracted in the commercial proposal:

1.3 Service Structure and Phases

The AI Service consists of two strictly segregated operational and contractual phases:

1. Setup Phase (Technological Implementation): Encompasses technical consulting, prompt engineering (System Prompt), structuring and vectorization of the initial knowledge base (RAG), telephony number or SIP trunk allocation, webhook configuration, integration flow design, stress testing, and delivery in a staging environment (Sandbox). This phase carries a one-off, non-recurring fee and is invoiced independently pursuant to the commercial proposal (50% upon signing and 50% upon delivery of the Sandbox environment).
2. Operation Phase (Monthly SaaS Subscription): Encompasses the continuous cloud infrastructure enabling active AI switchboard execution, voice minutes consumption, real-time LLM inference, speech synthesis, technical supervision, maintenance, and support. This phase is formalized exclusively via the acceptance of these Terms and the recurring monthly subscription managed via Stripe Billing.

Completion of the Setup Phase shall not trigger production deployment of the voice agent until the Client activates the monthly subscription in Stripe. The Provider shall not maintain active voice lines if the Client is not in good standing regarding recurring monthly subscription payments.

1.4 Exclusively Technological and Assistive Nature of the Service

The Client expressly acknowledges that VOIZ.ES operates strictly as a software developer, artificial intelligence integrator, and cloud telecommunications infrastructure provider. VOIZ.ES:

• Does not carry out regulated professional activities specific to the Client's industry (including, without limitation: real estate brokerage, legal counsel, medical or clinical diagnosis, or financial, credit, or insurance advising).
• Assumes no obligation regarding commercial or business outcomes. The conversion of incoming calls into effective sales, property reservations, medical bookings, or service contracts depends exclusively on the quality of the Client's offerings, pricing policy, and internal human team execution.

1.5 Functional Scope of the Voice Agent

The Voice Agent operates as an assistive telephone agent for general information delivery, preliminary lead qualification, message taking, and appointment scheduling. Its function is to provide responses based on the authorized knowledge base and channel calls to the Client's human personnel or scheduling system.

The Voice Agent DOES NOT act as a legal representative nor does it conclude binding contracts. In particular:

• It shall not sign or execute contracts, direct monetary transactions, purchase options, definitive reservations, or legal commitments on behalf of the Client.
• It shall not issue closed binding quotations or technical warranties when these require professional assessment, appraisal, diagnosis, or human validation.
• It shall not replace the professional judgment of the Client's commercial managers, legal counsel, or certified practitioners.

Whenever a caller requests a formal contractual transaction or personalized conditions outside authorized database records, the Voice Agent shall escalate the inquiry to the Client's human staff.

2. ONBOARDING CONDITIONS, KICK-OFF, AND INFORMATION DELIVERY

2.1 Reliance on Provided Information

The precision, rigor, and coherence of the Voice Agent's responses depend directly on the quality, accuracy, and currency of the technical and commercial documentation supplied by the Client during the onboarding and training phase.

2.2 Requirements for Setup Phase (Kick-Off)

In order for the Provider to commence technical configuration and agent training, the Client must:

1. Formally accept the commercial proposal and execute the initial 50% Setup payment, submitting the corresponding bank transfer receipt.
2. Deliver to the Provider the corporate dossier, product/service catalog, specifications, official pricing or authorized brackets, FAQs protocol, business hours, escalation routing, and authorized credentials to calendars or designated endpoints.

2.3 Warranty of Accuracy and Absence of Audit

The Client exclusively warrants that all information supplied is truthful, accurate, lawful, and up to date. VOIZ.ES does not perform legal, technical, urban planning, or health-related audits on data submitted by the Client. VOIZ.ES shall not be held liable for third-party claims arising from errors, omissions, misleading advertising, or outdated records present in original documents provided by the Client.

2.4 Knowledge Base Updates

The Client assumes the obligation to communicate any material modification in its pricing, catalog, operating hours, or general terms:

• Communication Channel: Updates shall be notified in writing via authorized support channels or synchronized through configured data sources (Google Sheets, database, or XML/CSV feed).
• Implementation Turnaround: Ordinary information updates communicated by the Client shall be implemented and synchronized into the knowledge base within a maximum period of twenty-four (24) business hours following written confirmation of receipt. Substantial alterations requiring conversational flow restructuring shall be processed as a Change Request (Clause 13).

2.5 Sandbox Testing Protocol and Tacit Approval

Upon completion of initial technical configuration, the Provider shall grant access to a testing line or staging environment (Sandbox). The Client shall have an unextendable period of seven (7) business days to audit agent responses against supplied documentation. The Setup Phase includes a complimentary allowance of thirty (30) testing minutes in the Sandbox environment (maximum 3 minutes per session). Upon expiry of the 7-business-day window or consumption of the testing allowance without written notification of objective technical deficiencies, the Setup shall be deemed tacitly approved, prompting the invoicing of the remaining 50% Setup fee and activation of the monthly Stripe Billing subscription for production release.

3. OPERATIONAL LIMITS, CONCURRENCY, AND OVERAGE FEES

3.1 Telephony Capacity and Subscription Limits

The monthly VOIZ.ES subscription is subject to the contracted operational parameters:

• Monthly Minute Allowance: The contracted plan includes a fixed bucket of inbound call minutes per calendar month (1,000 min in Basic, 2,000 min in Growth, 3,000 min in Pro, or custom bucket in Enterprise).
• Concurrency (Simultaneous Channels): Simultaneous inbound call handling capacity per plan (2 in Basic, 5 in Growth, 10 in Pro, 20+ in Enterprise). The Client may contract additional concurrent channels at a rate of +€29/line/month.
• Call Duration Limit: To ensure system security and prevent anomalous consumption or toll fraud, each call has a default maximum duration of ten (10) minutes. This limit is customizable and can be extended upon the Customer's request if their consultative sales process requires longer interactions.

3.2 Minute Overage Rates and Spend Cap

Should cumulative call consumption exceed the included monthly allowance in any given calendar month:

• Additional minutes consumed shall be billed at a rate of €0.35 / minute (+ VAT).
• Overage consumption shall be settled in arrears or automatically debited from the registered payment method in Stripe Billing upon reaching predefined safety thresholds.
• Maximum Spend Cap: Cumulative monthly overage spend is capped by default at two times (2x) the base monthly subscription fee, unless expressly authorized in writing by the Client. Upon reaching this cap, the system will pause new inbound calls until the next billing cycle or until authorization of a budget extension, protecting the Client from unmonitored cost overruns.

4. AI FRAMEWORK, HALLUCINATIONS, AND COMMERCIAL METHODOLOGY SCOPE

4.1 Probabilistic Nature and Hallucination Disclaimer

The Client acknowledges that the Voice Agent operates via probabilistic Large Language Models (LLMs). Despite mitigation techniques implemented (RAG, temperature clamping, and deterministic Guardrails), AI systems may occasionally generate inaccurate, incomplete, or unverified statements (technically known as «hallucinations»). VOIZ.ES is released from civil or commercial liability for autonomous statements generated by the AI, save for willful misconduct or gross negligence directly attributable to VOIZ.ES in technical configuration.

4.2 Semantic Scope of Commercial Methodologies (SPIN, Cialdini, Sandler, NLP, DISC)

The Client expressly acknowledges and accepts that the deployment of commercial psychology frameworks and methodologies in Pro and Enterprise plans operates under the following technical boundaries:

• Strictly Linguistic and Semantic Nature: Techniques such as SPIN Selling, Sandler principles, Cialdini persuasion drivers, linguistic Rapport, or DISC-adapted communication are executed exclusively upon the transcribed textual representation of the dialogue via natural language processing (NLP).
• Absence of Biometrics and Physiological Emotion Detection: The system DOES NOT perform voice biometric processing, acoustic frequency physiological analysis, facial/emotional recognition, or persistent psychological profiling under the scope of GDPR or Regulation (EU) 2024/1689 (EU AI Act). Agent adaptation is strictly confined to modulating conversational pacing, phrasing length, and communication style (direct vs. analytical) in-session.
• Veracity in Influence Triggers: Principles of social proof, authority, or scarcity shall never rely on fictitious data. The agent shall only communicate availability constraints or deadlines if explicitly present in the Client's database or verified catalog.

4.3 Mandatory Written Confirmation Obligation

The Client assumes the mandatory obligation to verify and formally confirm in writing through its human staff all commercial terms, pricing, payment conditions, or technical specifications with the customer prior to executing any binding contract, reservation, purchase order, or legal agreement. No audio snippet, transcript, or automated call summary shall be construed as a definitive contractual commitment.

4.4 Quantitative Limitation of Liability

Except in cases of willful misconduct (dolo) or gross negligence, the total aggregate civil liability of the Provider toward the Client for any claim arising out of the AI Service shall be quantitatively capped at an amount equal to the net monthly subscription fees actually paid by the Client during the six (6) months immediately preceding the incident giving rise to liability. In no event shall the Provider be liable for lost profits (lucro cesante), reputational damage, or lost commercial opportunities.

4.5 Operational Solvency and Professional Liability

The Provider declares to have the necessary technical, organizational, and financial capacity for the provision of the Service in accordance with industry standards. The Provider's liability to the Customer, arising from the operation of the AI infrastructure, shall be subject to the limits and exclusions set forth in the Limitation of Liability section of these Terms.

5. AVAILABILITY, SLA, AND THIRD-PARTY TELECOMMUNICATIONS NETWORKS

5.1 Structural Dependency on Global Infrastructure

The operation of the AI Service relies structurally upon global infrastructure technology providers operating across the following functional categories:

• Telecommunications and Telephony Operators (PSTN/SIP): Providers responsible for telephone number provisioning, SIP trunking, and public switched telephone network connectivity.
• Real-Time Voice Orchestration and Inference: Platforms providing conversational orchestration, audio streaming pipelines, and low-latency packet routing.
• Foundational Language Models (LLM): Enterprise API model inference providers operating under zero-data-retention or non-training commercial terms.
• Speech-to-Text (STT) and Text-to-Speech (TTS) Engines: Real-time multilingual voice transcription and neural synthetic voice generation engines.
• Vector Databases and Workflows: Relational storage, high-speed vector retrieval (pgvector), and automated workflow orchestrators.
• Billing and Payment Gateways: Secure cloud payment processing and recurring subscription management infrastructure.

The Provider may substitute or update technical providers within said functional categories without this constituting a material alteration of the Agreement, provided equivalent functionality, security, and regulatory compliance standards are maintained. The specific identity and configuration of each vendor constitutes VOIZ.ES trade secrets (Clauses 8 and 12) and shall be made available to the Client upon formal request in the DPA Sub-processor Appendix.

5.2 Third-Party Network Outages Disclaimer

The Provider shall not be held liable for disruptions, latency spikes, carrier drops, or network outages originating directly from public switched telephone networks (PSTN), mobile carriers, global AI provider outages, or power failures outside the direct control of VOIZ.ES.

5.3 Service Level Agreement (SLA) and Best Efforts

The service is rendered under a «best efforts» standard, backed by the following technical availability commitments:

• AI Switchboard Availability: Excluding third-party carrier failures and scheduled maintenance, the Provider commits to a monthly availability of 95% for Basic and Growth Plans, 99.5% for Pro Plan, and 99.9% for Enterprise Plan.
• Exclusive Remedy for SLA Breach: If monthly availability falls below the guaranteed threshold due solely to VOIZ.ES server infrastructure, the Client shall be entitled to a service credit extension calculated as one (1) additional day of service for each full 24 hours of continuous downtime. Maximum cap: 7 credit days per calendar month. Cash refunds shall not be issued.
• Technical Diagnostic Commitment: The Provider shall initiate technical incident diagnosis within a maximum period of twenty-four (24) business hours following notice via official support channels.

6. REGULATORY COMPLIANCE: EU AI ACT AND SECTORAL CONDITIONS

6.1 Transparency Obligations (Art. 50 EU AI Act)

Pursuant to Regulation (EU) 2024/1689 (EU Artificial Intelligence Act), in force in 2026:

• Mandatory AI Disclosure: The Voice Agent is programmatically configured to identify itself in a clear, transparent, and unambiguous manner as an artificial intelligence assistant during its initial greeting upon answering.
• Deployer Responsibility: The Client, as the deployer making the telephony line available to the public, covenants not to request or force the suppression of this mandatory transparency notice.

6.2 Human Escalation Mechanism

Where legal obligations require providing personalized human attention, VOIZ incorporates configurable escalation mechanisms to facilitate human takeover:

• Escalation Mechanism: The Voice Agent includes intent-detection triggers configured to identify a caller's request to speak with a human representative.
• Transfer Workflow: Upon detection, the system transfers the call to the designated human phone line provided by the Client or generates an urgent CRM/email priority alert for prompt callback.
• Exclusive Responsibility of the Client: The Client remains solely responsible for keeping its human support lines operational and answering transferred calls. The Client shall hold VOIZ.ES harmless from any regulatory penalties arising from the absence or unavailability of human personnel on the Client's side.

6.3 Acceptable Use Policy (AUP)

It is strictly prohibited to use the AI Service for: abusive calls, unsolicited spam (telemarketing spam violating telecommunications regulations), fraud, identity spoofing, social engineering, dissemination of deceptive material, or unlawful operations. Any breach entitles VOIZ.ES to immediately suspend service lines as a precautionary measure.

6.4 Anti-Money Laundering (Spanish Law 10/2010 — Conditional Clause)

If the Client qualifies as an obliged entity under Anti-Money Laundering legislation (such as real estate developers, lending institutions, or financial brokers), it acknowledges that the Voice Agent does not perform formal KYC customer identity verification or official AML regulatory reporting. The Client retains sole responsibility for fulfilling its statutory customer due diligence obligations.

7. DATA PROTECTION (GDPR), SECURE ARCHITECTURE, AND CHINESE WALLS

7.1 Legal Roles and Data Processing Agreement (DPA)

• Data Controller: The Client acts as the sole Data Controller regarding personal data (caller names, phone numbers, commercial data) captured during calls.
• Data Processor: VOIZ.ES acts strictly as a Data Processor (Art. 28 GDPR), processing data solely on documented instructions from the Client.
• Binding DPA: The contractual relationship between the parties is governed by the Data Processing Agreement (DPA - Schedule 1), which forms an integral part of these Terms.

7.2 No Physical Audio Recording and Ephemeral Memory

In strict adherence to the data minimization principle (Art. 5.1.c GDPR), physical audio recording is permanently disabled by default across the telephony infrastructure. Voice streams are processed in ephemeral volatile memory (streaming) for real-time transcription. Temporary processing records across intermediate platforms are purged automatically and irreversibly via scheduled API protocols upon call report dispatch.

7.3 Isolation Architecture, Network Security, and Tiered Repositories

VOIZ.ES guarantees that data processing, transmission, and storage for each Client are executed under strict technical isolation and segmentation measures adapted to the contracted tier:

• Basic and Growth Plans (Designated Repositories & Isolated Workflows): Lead data, transcripts, and call summaries are dispatched directly and independently to the Client's designated and controlled endpoints (Google Sheets, email, or calendar integrations), with workflows running under dedicated credentials without persistent storage in shared databases.
• Pro and Enterprise Plans (PostgreSQL with Row Level Security - RLS): In plans featuring real-time CRM synchronization, advanced semantic retrieval (pgvector), or multi-agent auditing, operational records and summaries are stored in PostgreSQL databases logically segregated via tenant-level policies by cliente_id (RLS), preventing cross-tenant access.
• Encrypted Private Network & Port Invisibility (Universal to All Plans): The entire backend processing infrastructure (production VPS) operates behind high-security encrypted VPN tunnels (WireGuard protocol or equivalent) and secure HTTPS / TLS 1.2+ connections, exposing no database or internal ports to the public Internet.
• Underlying Certified Infrastructure: The core data storage and server architecture of VOIZ.ES operates on Tier-1 Cloud providers located within the European Union. For AI inference and real-time voice processing services, the Provider uses top-tier technological sub-processors, ensuring that any international data transfers are conducted under the EU-US Data Privacy Framework (DPF) or Standard Contractual Clauses (SCCs) approved by the European Commission. These providers hold independent security certifications, including ISO/IEC 27001, ISO/IEC 27701, and SOC 2 Type II. The updated list of such technological sub-processors is available upon reasonable request from the Customer.

7.4 Dual-Layer Analysis and Sectoral Anonymization (DPA Clause 6.3 & Recital 26 GDPR)

Data processing within the multi-agent optimization pipeline is governed by two watertight legal layers:

• Legal Layer 1 (Private Client Audit): Conversational quality and sales psychology analysis operate over pre-pseudonymized transcripts (direct identifiers removed). Resulting analytical reports are 100% private and proprietary to the contracting Client, used exclusively to optimize its specific voice agent.
• Legal Layer 2 (Sectoral Market Intelligence — Outside GDPR Scope): Pursuant to Recital 26 of the GDPR and the contractual authorization in Clause 6.3 of the DPA, VOIZ.ES extracts macro trends and common industry objections via irreversible deterministic N3 anonymization (Technical Specification N3 - Schedule 2). Patterns are consolidated only when satisfying k ≥ 20 conversations across at least 3 distinct client entities, containing zero verbatim quotes or identifying attributes, thereby remaining legally dissociated from any personal data.

7.5 Chinese Walls and Non-Cross-Commercial Use Guarantee

The Provider, mindful of the strategic confidentiality of commercial leads captured across client telephone calls and of any distinct brand, commercial division, or affiliated company operating within the Provider's corporate ecosystem:

• Guarantee of Non-Cross-Exploitation: The Provider covenants and warrants that lead data and contact records captured by the Client's Voice Agent shall be utilized solely and exclusively to deliver the AI Service to that specific Client.
• Prohibition of Data Mining and Transfer: The Provider is strictly prohibited from utilizing said leads for commercial prospecting, generic model training outside the Client's environment, or transferring them, directly or indirectly, to any other brand, business partner, or competing entity, regardless of whether they share underlying server infrastructure.
• Organizational Chinese Wall and Governance Safeguards: The Provider shall maintain a strict organizational and technical «Chinese Wall» between VOIZ.ES systems and any external commercial activity. Executive management or technical maintenance functions shall not be deemed a breach of this rule, provided the absolute prohibition of commercial cross-use of lead data is strictly observed.

7.6 Data Retention, Deletion, and Portability

Private transcript logs are retained in a blocked state for a maximum period of twelve (12) months following contract termination solely to address potential contractual liabilities, after which they are permanently deleted, unless a statutory obligation requires prolonged retention. The Client may request lead data export (CSV/JSON) or early deletion at any time pursuant to Art. 20 GDPR.

8. INTELLECTUAL PROPERTY AND TRADE SECRETS (LAYERS A/B/C)

The ownership structure of technological and commercial assets is defined across three distinct layers:

The Client shall not reverse engineer, decompile, extract master prompts, or attempt model recreation via model extraction or distillation techniques.

9. FINANCIAL TERMS, BILLING, AND DEFAULT INTEREST

9.1 Stripe Billing Recurring Subscription

Monthly recurring fees are processed via the secure gateway Stripe Billing. Invoices are charged in advance between days 1 and 5 of each calendar month via corporate credit card or SEPA Direct Debit. Official tax invoices are automatically issued upon each successful charge.

9.2 Payment Default and Late Payment Interest

In the event of a failed or disputed payment transaction:

1. Up to two (2) automated retries will be executed over five (5) business days.
2. Upon default notification, the Client shall have a grace period of five (5) business days to settle arrears.
3. Upon expiry of said period, VOIZ.ES may automatically suspend telephony lines and agent call handling.
4. Overdue balances shall accrue late payment interest at an annual rate of eighteen percent (18%) (statutory legal rate + 8 percentage points pursuant to Spanish Commercial Morosity Act 3/2004 and Directive 2011/7/EU).
5. If payment default exceeds fifteen (15) calendar days, VOIZ.ES may terminate the Agreement with immediate effect and claim all outstanding balances plus associated banking and legal recovery expenses.

10. DURATION, CANCELLATION, AND TERMINATION

10.1 Term and Automatic Renewal

The Agreement is entered into on a monthly basis, renewing automatically for successive periods of one calendar month, without mandatory long-term lock-in commitments.

10.2 Penalty-Free Cancellation (7 Days' Notice)

The Client may cancel its subscription at any time without financial penalties by providing written notice via email or through the Stripe Billing customer portal at least seven (7) calendar days prior to the monthly renewal date. Cancellation takes effect at the end of the paid billing cycle, with no pro-rata refunds for unused days.

10.3 Effects of Termination

Upon termination, VOIZ.ES shall disable the voice agent and release assigned lines within 48 hours. Under no circumstances shall initial Setup fees be refunded, nor shall master prompts, RAG system configurations, or Layer C assets be handed over to the Client.

11. FORCE MAJEURE AND BUSINESS CONTINUITY

Neither party shall be held liable for delays or failure in performance resulting from unforeseeable and unavoidable force majeure events (natural disasters, armed conflicts, nationwide Internet blackouts, widespread ransomware cyberattacks, or systemic national telecom carrier failures). If such circumstances persist for more than sixty (60) calendar days, either party may terminate the Agreement without indemnification liability.

12. CONFIDENTIALITY AND NON-SOLICITATION

Both parties agree to maintain strict confidentiality regarding technical, operational, and commercial information exchanged. Furthermore, during the term of the Agreement and for twelve (12) months following its termination, neither party shall directly or indirectly solicit, hire, or engage employees or key contractors of the other party involved in service delivery. Breach of this clause shall trigger liquidated damages equal to six (6) gross monthly salary payments of the solicited professional.

13. CONTRACTUAL AND SCOPE MODIFICATIONS (CHANGE REQUEST)

The Provider may update these Terms upon thirty (30) days' prior written notice. Any material modification in scope, entry into new business verticals, non-standard conversational flows, or custom integrations requested by the Client post-Setup shall be quoted separately via a formal Change Request procedure prior to execution.

14. CONTRACT ASSIGNMENT AND BUSINESS SUCCESSION

The Provider reserves the right to assign, subrogate, or transfer, in whole or in part, the rights and obligations arising from this Contract to any commercial company (including, but not limited to, a Limited Liability Company / S.L.), newly incorporated or pre-existing, in which the current owner maintains a stake or managerial control.

Such subrogation shall not alter the economic conditions, the SLA, or the privacy guarantees (DPA) agreed upon with the Customer, ensuring the uninterrupted continuity of the AI Service under the new corporate umbrella, subject to formal prior notice to the Customer.

15. APPLICABLE LAW AND JURISDICTION

These Terms are governed by and construed in accordance with common Spanish law. For any dispute arising from the contract, the parties agree to a prior amicable negotiation period of fifteen (15) calendar days. Failing an agreement, both parties, expressly waiving any other jurisdiction, submit to the exclusive jurisdiction of the Courts and Tribunals of the City of Madrid.

SCHEDULE 1 — DATA PROCESSING AGREEMENT (DPA)

PURSUANT TO ARTICLE 28 OF REGULATION (EU) 2016/679 (GDPR) AND SPANISH ORGANIC LAW 3/2018 (LOPDGDD)

This Data Processing Agreement (hereinafter, «the DPA») supplements and forms an integral part of the Terms of Service and Master Agreement entered into between [VOIZ] (hereinafter, «the Data Processor» or «VOIZ.ES») and the contracting client entity (hereinafter, «the Data Controller» or «the Client»).

1. SCOPE AND PURPOSE OF PROCESSING

This DPA governs the terms under which VOIZ.ES processes personal data on behalf of the Data Controller. The purpose of data processing is strictly the provision of conversational Artificial Intelligence telephony services: inbound call reception, real-time audio stream processing, ephemeral text transcription, inquiry qualification, commercial lead dispatch, and appointment scheduling pursuant to the contracted plan.

2. CATEGORIES OF DATA AND DATA SUBJECTS

• Categories of Data Subjects: Customers, prospects, and natural persons placing calls to telephony lines operated or forwarded by the Data Controller.
• Categories of Personal Data Processed: Contact and identification details provided voluntarily by callers (full name, phone number, email address) and commercial inquiry specifics (requirements, preferences, scheduling dates, or indicative budget).
• Exclusion of Special Categories: Systematic processing of special category data (health data, political opinions, religious beliefs, trade union membership, genetic data, or acoustic vocal biometrics) under Article 9 GDPR is strictly prohibited and excluded.

3. OBLIGATIONS OF THE DATA PROCESSOR (VOIZ.ES)

Pursuant to Article 28.3 of the GDPR, VOIZ.ES covenants and warrants:

1. Processing on Documented Instructions: To process personal data exclusively in accordance with documented instructions from the Controller, unless required to do so by European Union or Member State law.
2. Confidentiality Commitment: To ensure that personnel authorized to supervise system infrastructure are subject to formal confidentiality agreements.
3. Security Measures (Art. 32 GDPR): To implement appropriate technical and organizational safeguards ensuring a level of security appropriate to the risk (detailed in Clause 5 of this Schedule).
4. Authorized Sub-processors (Arts. 28.2 & 28.4 GDPR): To manage the technical vendor chain pursuant to Clause 4 of this Schedule.
5. Assistance with Data Subject Rights: To assist the Controller in fulfilling its statutory obligation to respond to requests for exercising data subject rights (access, rectification, erasure, objection, restriction, and data portability).
6. Security Breach Notification (Art. 33 GDPR): To notify the Controller without undue delay, and in any event within a maximum of seventy-two (72) hours, upon becoming aware of any personal data security breach.
7. Data Deletion and Return: Upon contract termination, to delete or return all personal data to the Controller in accordance with Clause 7 of this Schedule.
8. Audits and Demonstrable Compliance: To make available to the Controller necessary information to demonstrate compliance with obligations laid down in Article 28 GDPR.

4. SUB-PROCESSOR REGIME AND TRADE SECRETS

The Controller grants general written authorization for the subcontracting of essential infrastructure technology vendors within the following functional tiers:

• Telecommunications carriers, numbering providers, and SIP/PSTN trunk operators.
• Conversational orchestration platforms and real-time voice streaming pipelines.
• Enterprise LLM inference providers operating under zero-retention / non-training policies.
• Speech-to-Text (STT) and Text-to-Speech (TTS) neural engines.
• Relational and cloud vector databases with encryption at rest.
• Recurring billing and automated invoicing platforms (Stripe Billing).

VOIZ.ES shall execute written agreements with each sub-processor imposing equivalent data protection safeguards. The specific corporate identity of each provider constitutes VOIZ.ES trade secrets protected under Spanish Act 1/2019 and EU Directive 2016/943, and will be made available to the Controller upon reasonable, motivated request under prior non-disclosure commitment.

5. TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES (ART. 32 GDPR)

VOIZ.ES guarantees the implementation of the following security controls across its infrastructure:

• Call Recording Disabled by Default: Physical audio files of calls are not generated or stored. Voice streams are processed in ephemeral volatile memory (streaming) for transcription.
• Isolated Environments and VPS Hardening: Production workflows execute on dedicated virtual servers (VPS), isolated from testing or staging (Sandbox) environments.
• Encrypted Network via VPN Tunnel (WireGuard): Backend storage, databases, and orchestrators do not expose public ports to the Internet, communicating via encrypted private WireGuard VPN tunnels.
• Data Isolation and Segregation: Depending on the contracted plan, data is dispatched directly to Client-owned repositories (Google Sheets/Email) or stored in PostgreSQL databases protected by tenant-level isolation policies by cliente_id (Row Level Security - RLS in Pro and Enterprise), preventing unauthorized cross-company access.
• Encryption in Transit and at Rest: Enforced HTTPS / TLS 1.2+ protocols for all data in transit and AES-256 encryption at rest in database instances.

6. CLAUSE 6.3: CONTRACTUAL INSTRUCTION FOR N3 DETERMINISTIC ANONYMIZATION

Pursuant to Article 28.3(a) and Recital 26 of the GDPR, the Data Controller expressly instructs and authorizes VOIZ.ES to apply an irreversible, deterministic Level 3 (N3) anonymization protocol to call transcripts, pursuant to Technical Specification N3 (Schedule 2).

Through this procedure, all direct and indirect identifiers are permanently suppressed, consolidating solely aggregate statistical market trends (k ≥ 20 conversations across at least 3 distinct corporate clients). Having been irreversibly decoupled from any identifiable natural person, said anonymized patterns cease to constitute personal data and may be legitimately utilized by VOIZ.ES for core model performance benchmarking and industry comparative analytics.

7. POST-TERMINATION DATA DELETION AND RETENTION

Upon termination of the service, private transcript logs shall remain securely blocked for a maximum duration of twelve (12) months solely to address potential legal or contractual liabilities, after which they shall be permanently purged or irreversibly anonymized, unless a statutory legal retention requirement mandates otherwise.

SCHEDULE 2 — TECHNICAL SPECIFICATION: DETERMINISTIC N3 ANONYMIZATION PROTOCOL

IRREVERSIBLE ANONYMIZATION CRITERIA PURSUANT TO RECITAL 26 OF THE GDPR

This document establishes the mathematical criteria, algorithmic transformation rules, and deterministic validation protocols governing the Level 3 (N3) Anonymization process implemented within the VOIZ.ES data pipeline.

1. LEGAL BASIS AND IRREVERSIBILITY PRINCIPLE

The objective of the N3 protocol is to transform conversational text transcripts into purely aggregated statistical information, ensuring that the process is technically irreversible and that no resulting data point can be re-identified using reasonable computational means or disproportionate effort.

Pursuant to Recital 26 of Regulation (EU) 2016/679 (GDPR):

«The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.»

2. TECHNICAL DISTINCTION: PSEUDONYMIZATION (N1) VS. ANONYMIZATION (N3)

3. N3 PROCESSING PIPELINE (DETERMINISTIC, NON-LLM)

N3 anonymization is never delegated to the probabilistic or creative interpretation of a language model. It is executed via a deterministic, closed-source pipeline subject to strict algorithmic verification:

┌─────────────────────────────────────────────────────────────┐
│             Pattern Candidate (Semantic Extraction)         │
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│                 DETERMINISTIC N3 GENERALIZER                │
│  • Profession   ──► Standard ISCO/CNO Category (2 digits)   │
│  • Age          ──► Decennial bracket (e.g., 35-44 years)   │
│  • Location     ──► Macro zone / regional cluster           │
│  • Amount       ──► Sectoral decile bracket                 │
│  • Dates        ──► Consolidated Month & Year               │
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│                 STRICT ALGORITHMIC VALIDATOR                │
│  • Regex PII Filter (Phones, emails, Tax IDs, IBANs, IPs)   │
│  • k-Anonymity Rule: k >= 20 conversations                  │
│  • Diversity Rule: Minimum 3 distinct client entities       │
│  • Prohibition of Verbatim Quotes: Max 3 consecutive words  │
└──────────────────────────────┬──────────────────────────────┘
                               │
                               ▼
┌─────────────────────────────────────────────────────────────┐
│             TABLE: patrones_sector_publicados               │
│  (Zero client_id, zero event logs, zero identifiers)        │
└──────────────────────────────┘

4. MATHEMATICAL PRIVACY METRICS AND DIFFERENTIAL PRIVACY

In order for any market pattern to be consolidated and published into the sectoral intelligence base, it must concurrently meet the following mathematical thresholds:

• k-Anonymity (k ≥ 20): No sectoral pattern may be established on isolated occurrences. It must be detected and validated across a minimum of twenty (20) independent conversations.
• Source Diversity (≥ 3 Entities): The pattern must originate from interactions across at least three (3) distinct client companies to avoid reflecting idiosyncratic workflows of a single entity.
• Suppression of Verbatim Phrasing: Direct transcription quotes exceeding three (3) consecutive words are strictly discarded. Patterns are expressed exclusively via abstract, generalized descriptions.
• Zero Traceability: The sectoral patterns table stores no client identifiers (cliente_id), call identifiers (call_id), originating brand names, or granular timestamps.

5. STRUCTURE OF PUBLISHED ANONYMOUS DATA

The final output of the N3 process generates strictly statistical, non-personal JSON objects, as illustrated below:

{
  "patron_id": "uuid-v4",
  "sector": "real_estate",
  "categoria": "FREQUENT_OBJECTION",
  "descripcion_generalizada": "In coastal new development residential units, a material proportion of prospects inquires about sun orientation and energy efficiency before evaluating unit pricing.",
  "rango_porcentual": "35-45%",
  "conversaciones_agregadas": 47,
  "clientes_distintos_agregados": 4,
  "confianza_estadistica": "HIGH",
  "version_protocolo_anonimizacion": "N3-2026-V1"
}

6. TRADE SECRETS AND INTELLECTUAL PROPERTY

The consolidated database of anonymous industry patterns generated through the N3 protocol forms part of Layer C (VOIZ.ES Proprietary Technology) and constitutes protected trade secrets under Spanish Act 1/2019 and EU Directive 2016/943. No individual client holds proprietary claims over aggregate macro intelligence generated by the platform.