Welcome to your Trust Centre

At a glance: compliance, privacy and security

• AccountabilityComplyVox is your in-house data protection support, providing you with up-to-date policies, procedures and registers, and executive or board reports ready to view.
• TransparencyYou are always told at the start of a conversation that you are talking to AI, along with the purpose of the conversation and what it will produce.
• MinimisationYour AI assistant asks only for the information a task needs: for example, the names of the vendors and apps you use, to compile your Record of Processing Activities (ROPA).
• Your data is stored in the EUAll client data is stored in Ireland. Voice AI processing is carried out in the EEA and the UK (covered by an EU adequacy decision), with full transparency about who we work with and why.
• AI classification under the EU AI Act: limited risk, with transparency obligationsComplyVox is an advisory, document-generation tool with no automated decision-making, profiling or biometric identification.
• Human oversightAI-generated findings never have the final say. Each one is held as “pending”, with the information you need to check it, until you confirm it.
• Retention and deletionYour compliance file is deleted automatically 2 months after your contract ends, to allow you to transfer your documentation. Call transcripts are kept for no longer than 6 months.
• SecurityAll data is encrypted at rest and in transit. Two-factor authentication protects sign-in.
• Restricted accessYou decide who in your organisation is approved to use it, to keep your business information accurate and secure. There is no marketing or analytics tracking within the system.

Here you will find a summary of our due diligence throughout product development, along with our mutual compliance requirements and agreements.

• Data processing agreement (DPA), to download
• Privacy notice
• Cookie policy
• Sub-processor list
• Data security and controls
• Artificial intelligence transparency statement
• Privacy by design and default
• Data protection impact assessment summary
• Sustainability statement
• Terms and conditions of service

Data processing agreement (DPA)

As required by the EU and UK GDPR, this Data Processing Agreement (DPA) is a mutual agreement between ComplyVox, as the data processor, and you, the client, as the data controller. We, in turn, have signed DPAs with our suppliers (sub-processors), listed below. This agreement forms part of our overall business agreement and does not replace our contract or terms of business.

Processor details

Sub-processors

Terms

• Written instruction. ComplyVox will process personal data only on the client’s documented instructions, which are set out in this DPA, the Terms and the client’s use and configuration of the Platform. This includes instructions on transfers of personal data outside the EEA, unless ComplyVox is required to act otherwise by law, in which case it will tell the client before processing unless the law prohibits this. ComplyVox will tell the client immediately if, in its opinion, an instruction infringes data protection law.
• Compliance. ComplyVox complies with the GDPR, the ePrivacy rules and the AI Act, and ensures that anyone involved in processing personal data is subject to a duty of confidentiality and has experience in data protection matters.
• Privacy rights. The client has full control of the data and can exercise privacy rights for anyone whose data is in its care. Any request outside self-service, such as access or deletion, will be supported and actioned without delay and within 30 days.
• Data breaches and investigations. ComplyVox will notify the client with immediate effect of any personal data breach or incident that may infringe data protection law, and will support the client to investigate and mitigate it. The client is responsible for investigating, for assessing the privacy risk, for deciding whether to notify its supervisory authority within 72 hours, and for deciding whether to notify the individuals affected. ComplyVox will co-operate with the relevant supervisory authority in any investigation.
• Suppliers and transfers. ComplyVox will give the client at least 30 days’ prior written notice of any intended addition or replacement of a sub-processor, by email and by updating the sub-processor list. The client may object on reasonable data protection grounds within that period. The parties will work together in good faith to resolve the objection and, if it cannot be resolved, the client may terminate the affected Services on written notice. We understand that all sub-processors are subject to the same data protection obligations as the processor. If a sub-processor fails to comply with data protection law or the relevant data processing agreement, the processor remains directly liable to the client. Client personal data is stored in the EU (Ireland). Voice AI processing is carried out in the EEA and, by ElevenLabs, in the UK, which is covered by an EU adequacy decision. Any other transfer outside the EEA will only take place with a valid Chapter V GDPR transfer mechanism and with prior notice to the client.
• Audit. ComplyVox will make available to the client all information necessary to demonstrate compliance with this DPA and Article 28 GDPR, and will allow for and contribute to audits, including inspections, carried out by the client or an auditor the client appoints. Audits will be on reasonable written notice, during normal business hours, and generally no more than once a year, unless required by a supervisory authority or following a personal data breach. ComplyVox will first refer the client to the Trust Centre documentation.
• Return or deletion at the end of the Services. When the Services end, the client may choose whether ComplyVox returns all client personal data to the client or deletes it, and ComplyVox will then delete all existing copies unless the law requires it to keep them. The client should tell ComplyVox its choice within the 2-month period after the contract ends; if it does not, the data will be deleted automatically at the end of that period.
• Retention and deletion. Your compliance file is deleted automatically 2 months after your contract ends, to allow for transfer of your documentation. Call transcripts are kept for no longer than 6 months.
• Obligations and security. Where practical, ComplyVox will assist the client in meeting its accountability obligations, including access to our Trust Centre to review our documentation, to demonstrate transparency and compliance with the regulation. ComplyVox will always use best endeavours to safeguard all personal data from unauthorised or unlawful processing, including (but not limited to) accidental loss, destruction or damage, and will ensure the security of processing by implementing appropriate technical and organisational measures.
• Onboarding. The client is responsible for engaging with the onboarding process set out by ComplyVox.
• Due diligence. The client retains responsibility for carrying out its own due diligence on processors and sub-processors, before and during the contract. ComplyVox provides full transparency for that due diligence in our Trust Centre.

Signatures

Privacy notice

We respect your privacy. ComplyVox is a GDPR compliance platform that uses a guided voice AI interface to help people who have been given responsibility for data protection. It supports your business to build and maintain its data protection compliance framework. This notice explains how we handle the personal data of people who visit our website, register their interest or use ComplyVox directly. It does not cover the personal data our business clients enter while using the platform: that is covered by a separate data processing agreement, which every client can download from this Trust Centre.

Contact us

We are ComplyVox Ltd, registered in Ireland, company number 823614, with our registered office at The Hatch Lab, Gorey, Co. Wexford, Y25 A8H2. Email info@complyvox.eu.

For any privacy or compliance question or request, contact our Data Protection Officer at dpo@complyvox.eu.

If you believe we are not processing your personal data in accordance with the law, you have the right to complain to your country’s supervisory authority. In Ireland, this is the Data Protection Commission. In the UK, it is the Information Commissioner’s Office.

Your data

If you join our waitlist or register your interest, we collect your email address only. If you register for ComplyVox, we collect basic contact and account details, such as your name, work email, phone number and job role, to set up your account and to provide you with customer service.

If you use the voice AI interface, what you say or type is processed to generate a text transcript and to populate your compliance records. Conversation audio and text is processed transiently by our AI providers under a contractual zero-retention commitment. See our AI transparency statement.

We keep your compliance data for as long as you have an active contract with us, and for 2 months after it ends to allow for account recovery or handover if you ask for it. After that it is deleted automatically.

How long we keep your data. Waitlist email addresses are kept until you unsubscribe or withdraw your consent, or for 12 months after we launch, whichever is sooner. Account and contact details are kept for the length of your contract plus 2 months. Call transcripts are kept for no longer than 6 months; conversation audio is not retained by us or our voice AI providers. Invoicing and accounting records are kept for 6 years, as required by Irish tax law.

We ask that you do not share sensitive personal data (for example health, financial or other special category data) with us through the voice interface, the website or otherwise, unless it is strictly necessary for the compliance record you are creating and you have a lawful basis to share it. We will never pass your details to a third party for their own marketing purposes.

Why we use your data

We only use your personal data where we have a lawful basis under Article 6 of the GDPR. Our lawful bases are as follows.

• Waitlist and registering your interest: your consent (Article 6(1)(a)). You can withdraw your consent at any time by contacting dpo@complyvox.eu, without affecting what we did before you withdrew it.
• Setting up and running your account, customer service and the voice AI interface: our legitimate interests (Article 6(1)(f)) in providing the service to your employer or organisation and supporting you as its user. If you contract with us directly, we rely on performance of that contract (Article 6(1)(b)). You have the right to object to processing based on our legitimate interests at any time.
• Keeping accounting and tax records: our legal obligations (Article 6(1)(c)).

Artificial intelligence

ComplyVox uses an AI voice assistant to guide you through building your compliance records. In line with the EU AI Act, we tell you clearly when you are interacting with an AI system rather than a person. Every output generated by AI, for example a policy document or a risk summary, is marked as “pending” until you review and confirm it. That confirmation step is your human oversight. ComplyVox is a tool to help you build and manage your compliance records: it does not provide legal advice, and using it does not replace the judgement of a qualified Data Protection Officer (DPO) or legal adviser.

Third-party providers

To provide the service, we use the following providers. Please refer to their own privacy notices for details of their processing, access and storage.

Your data is stored in the EU (Ireland). Our voice AI providers process data in the EEA and, in the case of ElevenLabs, in the UK. The UK is covered by an EU adequacy decision, so your data remains protected to an equivalent standard. We have chosen our providers deliberately to keep your data within the EEA or a country the European Commission recognises as providing adequate protection.

We have a LinkedIn page. Please refer to LinkedIn’s own privacy policy.

Your privacy rights

Under data protection law you have the right to:

• access the personal data we hold about you and receive a copy, together with information on how and why we use it
• rectification: have inaccurate or incomplete data corrected
• erasure: ask us to delete your data in certain circumstances (we may need to keep some data to meet legal obligations)
• restriction: ask us to limit how we use your data in certain circumstances
• portability: receive data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another organisation, where processing is based on consent or contract
• object to processing based on our legitimate interests, and to direct marketing at any time
• withdraw consent at any time where we rely on it, without affecting earlier processing
• not be subject to solely automated decisions that significantly affect you (we do not currently carry out such processing)

We will acknowledge and act on your request without undue delay. If, for legal or contractual reasons, we cannot comply with a request, we will explain why.

Cookies

We do not use marketing cookies or behavioural analytics tracking on ComplyVox. See our cookie policy.

Last reviewed and updated: September 2026

Cookie policy

This website, complyvox.eu, does not set cookies and does not store anything on your device. There are no analytics, advertising or social media trackers on it, so there is nothing to accept or decline and no cookie banner.

What your browser connects to

When you open a page, your browser requests it from our web host, as it would for any website. Our home page also loads three open-source code libraries (React, React DOM and Babel) from unpkg.com, a public content delivery network, which receives your IP address with that request.

If this changes

We will update this policy before anything new is stored on your device, and ask for your consent first wherever the law requires it. Questions about this policy can go to dpo@complyvox.eu.

Last reviewed: October 2026

Sub-processor list

All client data is stored within the EU (Ireland). Voice AI processing is carried out in the EEA and the UK, which is covered by an EU adequacy decision. All sub-processors are contracted under data processing agreements. We will tell you in advance of any change to our sub-processors, in line with our data processing agreement with you.

Last reviewed: October 2026

Security and controls

Privacy and security are central to how we work with you and your organisation. Whether it is personal or business information you share with us under contract, or business-sensitive information you share during the audit stage, we hold it to the same standard of security controls.

• All data is encrypted at rest and in transit.
• Sign-in uses two-factor authentication.
• AI-assisted research is never applied to your records automatically. Findings are held as “pending”, with source citations, until you actively confirm them.
• You assign access within your organisation when your contract is set up, so your data stays accurate and secure. Only the people you have authorised can view or update it, and you can review and change that at any time.
• New features are signed off by our DPO before release and rolled out in phases, with stringent testing at each stage.

AI transparency statement

What AI we use, and why

ComplyVox uses voice AI to make it faster and easier for you to record and manage your organisation’s data protection information. When you speak with your assistant, your voice is processed by three specialist AI models: one converts your speech to text, one interprets your question and prepares a response, and the last converts that response back to speech.

Where processing happens

Voice AI processing is carried out by two third-party AI providers: Mistral (hosted in the EEA) and ElevenLabs (hosted in the UK and EU). Processing is transient: your conversation data is used only to generate a response and is then immediately and permanently erased on their side, under a contractual zero-retention commitment. Nothing is used for training and nothing is stored. If a transcript is kept, it is stored only in our own EU-based environment (Supabase, Ireland), and only for as long as you choose.

You are always told you are talking to AI

In line with our obligations under the EU AI Act, you are told clearly at the start of any interaction that you are speaking with an AI assistant, not a person.

A person always has the final say

Our AI is designed to assist, not decide. Where your assistant researches information on your behalf, its findings are never applied automatically to your Record of Processing Activities (ROPA). Each is held as “pending”, with a source reference, until someone at your organisation actively reviews and confirms it.

Our risk assessment

We do not consider ComplyVox an AI system used for automated decision-making, employment screening, credit assessment, biometric identification, or any other use classified as “high-risk” under the EU AI Act. It is an advisory and document-generation tool: it helps gather and organise your compliance information, with a person confirming every substantive output.

Last reviewed: October 2026

Privacy by design and default

We built ComplyVox the way we would want a compliance tool to be built: your data is stored in the EU, is encrypted throughout, and you stay in control of it at every step.

Where your data lives

• All client data is stored on Supabase, hosted in Ireland. It never leaves this environment for long-term storage.
• Voice AI processing is handled by specialist third-party providers hosted in the EEA and the UK (covered by an EU adequacy decision), under a contractual zero-retention commitment. Your conversation is processed to generate a response and is then immediately and permanently erased on their side. Nothing is stored there: the record lives only in your own EU-based Supabase environment until it is deleted.
• Data storage and the layer connecting the components are hosted within the EU. Voice AI processing takes place in the EEA and the UK, which is covered by an EU adequacy decision.

How it is protected

• All data is encrypted at rest and in transit.
• AI-assisted research is never applied to your records automatically. Findings are held as “pending”, with source citations, until you actively confirm them.
• Access to your organisation’s data is defined and restricted. You decide who can view or update your policies and other documentation.
• New features are signed off by our DPO before release and rolled out in phases, with stringent testing at each stage.

You stay in control

• View, update or remove your own data at any time, directly in the app.
• Your data is kept only for as long as you are an active client. When you leave, you have 2 months to access or export your data, after which it is deleted automatically and securely.
• Call transcripts can be set to a shorter retention period than the rest of your data, on request.
• We do not run marketing or analytics tracking in the system, so there is nothing extra to consent to.
• Any request outside self-service (access, correction, deletion) is actioned without delay and within 30 days.
• We collect only what is needed to deliver and manage your compliance record: mainly business information, plus limited contact details. We never collect business-sensitive information you have not chosen to share for that purpose.

Data protection impact assessment summary

What this covers

While planning, designing and developing ComplyVox, we carried out our own Data Protection Impact Assessment (DPIA). It remains a live document as the product and our service expand, and it is signed off by our DPO at every stage.

If you would like to see the full assessment to support your own DPIA, it is available on request from dpo@complyvox.eu.

Screening

ComplyVox does not process special category data, does not process at scale, and makes no automated decisions with legal or similarly significant effect, so a DPIA is not mandatory under the GDPR. We completed one voluntarily, to track our own due diligence on the safe use of voice AI.

How data is processed

Full detail of what each provider does with your data is in our sub-processor list, and how our AI works is set out in our AI transparency statement.

Key risks and how we reduce them

• Voice AI processing: reduced by EEA and UK hosting (the UK is covered by an EU adequacy decision) and a contractual zero-retention commitment from our AI provider.
• Inaccurate AI output: reduced by the “pending” human confirmation step described in privacy by design and default.
• Sub-processor breach: reduced by due diligence on every partner’s infrastructure, and by encryption at rest and in transit. See security and controls.
• Over-retention: reduced by automated, time-bound deletion: 2 months after the contract ends, and 6 months for call transcripts.

Our rating

Overall residual risk: low. This assessment is reviewed annually by our DPO, and immediately on any material change: a new sub-processor, a change to our AI provider, or a new feature that changes what data we collect. The full working assessment, including our risk register and open actions, is available to clients on request.

Last reviewed: October 2026

Sustainability statement

This is a voluntary statement, prepared in the spirit of the EU’s Voluntary SME Standard (VSME), as ComplyVox falls below the scope of mandatory EU sustainability reporting. We publish it because we believe good practice should not wait for a legal threshold, and we want to be transparent about our environmental and ethical footprint.

Our service and philosophy

We view data protection as a human right, and we believe respect for privacy builds trust and loyalty for you and your business. As a team of DPOs, technologists and legal professionals, we take a human-centred approach to the GDPR, ePrivacy and the AI Act. ComplyVox uses plain language rather than legal jargon or threats of penalties.

Our profile and environment

ComplyVox is a lean, remote-first team based in Ireland. We have no fleet, no manufacturing and no physical product footprint: ComplyVox is delivered entirely as cloud-based software. Where we do have influence, we commit to:

• hosting with providers in the EEA and the UK that hold recognised environmental and security certifications
• operating remote-first, avoiding office energy use and reducing commuting emissions
• defaulting to digital-only records and communications, avoiding unnecessary printing and physical storage
• reviewing our cloud and AI providers’ own sustainability commitments when we select them

Our people and business conduct

We commit to fair, transparent employment practices. We will offer equal opportunity regardless of background, with reasonable, flexible working arrangements consistent with our remote-first model. We will revisit and expand this section as we grow.

We operate a zero-tolerance policy on bribery and corruption. Client and personal data are handled strictly in accordance with our privacy notice and data processing agreements. Intellectual property is held by the company, not by individual founders, to ensure continuity and accountability regardless of changes in personnel.

Looking ahead

We will review this statement annually, or sooner if our size, structure or operations change materially, including if we approach the thresholds that would bring mandatory reporting into scope. Questions about this statement can go to our Data Protection Officer at dpo@complyvox.eu.

Terms and conditions of service

ComplyVox Limited. AI-assisted data protection compliance services for business clients. Version 1.4, August 2026.

Important notice: please read before using the services

COMPLYVOX IS AN AI-ASSISTED COMPLIANCE TOOL. IT IS DESIGNED TO HELP YOU GATHER INFORMATION, ORGANISE YOUR DATA PROTECTION RECORDS, AND GENERATE DRAFT DOCUMENTATION. IT IS NOT A LAW FIRM, DOES NOT PROVIDE LEGAL ADVICE, AND DOES NOT MAKE AUTONOMOUS DECISIONS ON YOUR BEHALF. EVERY SUBSTANTIVE OUTPUT THE PLATFORM GENERATES IS HELD AS “PENDING” UNTIL A PERSON AT YOUR ORGANISATION ACTIVELY REVIEWS AND CONFIRMS IT. YOU REMAIN THE DATA CONTROLLER AND ARE SOLELY RESPONSIBLE FOR YOUR ORGANISATION'S COMPLIANCE WITH THE GDPR AND ALL OTHER APPLICABLE LAWS. FULL DETAIL IS SET OUT IN CLAUSES 7 AND 8 BELOW, WHICH YOU SHOULD READ CAREFULLY BEFORE RELYING ON ANY OUTPUT OF THE SERVICES.

These Terms and Conditions of Service (“Terms” or this “Agreement”) are entered into between ComplyVox Limited (“ComplyVox”, “we”, “us”, or “our”) and the business client identified in the applicable Proposal or Order Form (the “Client”, “you”, or “your”). This Agreement applies only to business-to-business engagements; ComplyVox does not offer the Services to consumers. By signing a Proposal, accepting an Order Form, accessing or using the ComplyVox platform, the Client agrees to be bound by this Agreement.

1. Definitions and interpretation

1.1 “Agreement” means these Terms, together with any Proposal, Order Form, the Data Processing Agreement (“DPA”), and the Trust Centre documentation referenced in this Agreement, each of which is incorporated by reference and forms part of the Agreement between the parties.

1.2 “ComplyVox”, “we”, “us”, or “our” means ComplyVox Limited, a company incorporated in Ireland company number 823614, with its registered office at The Hatch Lab, Gorey, Co. Wexford, Ireland, Y25 A8H2.

1.3 “Client”, “you”, or “your” means the business, organisation, or other legal entity identified in the Proposal or Order Form, which, for the purposes of applicable Data Protection Legislation, acts as the Data Controller.

1.4 “Services” means the AI-assisted data protection audit, compliance framework generation, document population, and related support services provided by ComplyVox via the Platform, as further described in Clause 2.

1.5 “Platform” means the ComplyVox software, including its voice AI interface, through which the Services are delivered.

1.6 “AI System” means the artificial intelligence components (including speech-to-text, natural language processing, and text-to-speech models) used within the Platform, whether operated directly by ComplyVox or by a Sub-Processor.

1.7 “Client Data” means all data, materials, and information (including any Personal Data) submitted, uploaded, spoken, or otherwise provided by or on behalf of the Client through the Platform.

1.8 “Data Protection Legislation” means the General Data Protection Regulation (EU) 2016/679, the Irish Data Protection Act 2018, the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), and, where applicable to the Client, the UK GDPR and the UK Data Protection Act 2018, in each case as amended, re-enacted, or replaced from time to time, together with any other data protection or privacy law applicable to the processing in question.

1.9 “DPA” means the Data Processing Agreement made available to the Client for execution (including by eSignature) via the Trust Centre, governing the processing of Personal Data under this Agreement.

1.10 “Trust Centre” means the compliance and transparency documentation published or made available by ComplyVox from time to time, comprising (among other things) the Privacy Notice, Cookie Policy, Sub-Processor List, Artificial Intelligence Transparency Statement, and Privacy by Design & Default statement.

1.11 “Proposal” or “Order Form” means the document(s) agreed between the parties setting out the scope of the Services and the fees payable.

1.12 “Personal Data”, “Data Controller”, “Data Processor”, and “Personal Data Breach” have the meanings given to them in the GDPR.

1.13 Any reference to a statute or statutory provision includes that statute or provision as amended, extended, or re-enacted from time to time.

2. The services

2.1 ComplyVox provides an AI-based compliance tool designed to assist the Client in gathering, researching, and collating business-related information and a systems inventory, in order to help the Client build and maintain a GDPR compliance framework, including GDPR policy documents, a Record of Processing Activities (“ROPA”), Data Protection Impact Assessments (“DPIA”), and other related outputs.

2.2 The Services are delivered primarily through a guided voice AI interface, supplemented by written outputs generated by the Platform.

2.3 ComplyVox will perform the Services using reasonable skill, care, and diligence, consistent with good industry practice.

2.4 The Services are an assistive tool only. They do not, and are not intended to, replace the exercise of independent professional judgement by the Client, a qualified Data Protection Officer, or a legal adviser. Clauses 7 (Artificial Intelligence) and 8 (No Legal Advice) set out important limitations which the Client should read carefully and which apply to every output of the Services.

2.5 ComplyVox may modify, update, or improve the Platform and the Services from time to time, provided that any such change does not materially reduce the overall functionality of the Services during the Client's then-current contract term.

2.6 Onboarding. The Client shall engage promptly and in good faith with the onboarding process specified by ComplyVox, including by providing accurate and complete information about its business, suppliers, customers, and data processing activities. The Client acknowledges that the accuracy, completeness, and usefulness of any output depends directly on the accuracy and completeness of the information the Client provides, including keeping the Platform updated when suppliers, customers, systems, or processing activities change.

3. Client obligations

3.1 The Client shall: (a) provide ComplyVox with all information reasonably required to perform the Services; (b) ensure such information is accurate, complete, and kept up to date, including by promptly notifying ComplyVox, via the Platform, of any material change such as a change of supplier, customer, processing activity, or business structure; (c) obtain and maintain all consents, notices, licences, and permissions necessary for the Client's own lawful processing of Personal Data; and (d) not submit special category data, criminal offence data, or business-sensitive information to the Platform other than as reasonably necessary for the compliance record being created and where the Client has a lawful basis for doing so.

3.2 The Client acknowledges that it remains, at all times, the Data Controller in respect of any Personal Data processed in connection with the Services and is solely responsible for determining the purposes and means of that processing, for the accuracy, legality, and adequacy of any decision taken on the basis of a Platform output.

3.3 The Client shall carry out its own due diligence on ComplyVox and, where relevant, on ComplyVox's sub-processors, both before entering into and during the term of this Agreement and shall review the Trust Centre documentation made available to it.

3.4 The Client is responsible for ensuring that its personnel who access or use the Platform are authorised to do so, are aware of this Agreement, and comply with it.

4. Fees

4.1 The fees for the Services, and how and when they are paid, are as set out in the applicable Proposal or Order Form.

4.8 Errors and omissions excepted (E&OE).

5. Term, suspension and termination

5.1 This Agreement commences on the earlier of the start date set out in the applicable Proposal or Order Form and the date the Client first accesses the Platform, and continues for the term set out in that Proposal or Order Form, unless terminated earlier in accordance with this Clause 5.

5.2 The Client may terminate this Agreement for convenience at any time on 30 days' written notice. Any refund of fees already paid is as set out in the applicable Proposal or Order Form.

5.3 The client may terminate this Agreement with immediate effect by written notice if the other party: (a) commits a material breach of this Agreement which, if capable of remedy, is not remedied within 30 days of written notice requiring it to do so; or (b) becomes insolvent, enters examinership, receivership, or liquidation, or undergoes an equivalent process in any jurisdiction.

5.4 Non-payment. ComplyVox may suspend the Client's access to the Platform, and/or terminate this Agreement by written notice, if fees due under the applicable Proposal or Order Form are not paid when due. ComplyVox may also suspend the Client's access where continued provision of the Services would breach applicable law, or where ComplyVox reasonably believes the Platform is being used in a manner that poses a security, legal, or reputational risk to ComplyVox, its other clients, or any third party.

5.5 On termination or expiry of this Agreement: (a) all fees accrued but unpaid become immediately due; (b) the Client's licence to access and use the Platform ends; and (c) Client Data will be retained, exported, and deleted in accordance with Clause 6 and the DPA.

5.6 Clauses which by their nature are intended to survive termination or expiry of this Agreement, including Clauses 6, 7, 8, 9, 10, 12, 13, and 21, shall continue in force notwithstanding termination.

6. Data protection

6.1 Where ComplyVox processes Personal Data on the Client's behalf in the course of providing the Services, it does so as a Data Processor, and the Client is the Data Controller, in each case within the meaning of the GDPR.

6.2 The parties' respective data protection obligations, including ComplyVox's obligations as processor, are set out in the DPA, which is incorporated by reference into and forms part of this Agreement. In the event of any conflict between this Agreement and the DPA in relation to data protection matters, the DPA prevails.

6.3 ComplyVox does not expect to process Personal Data other than basic business contact details of the Client's personnel (such as name, role, department, and contact details) and any Personal Data the Client chooses to include within its own compliance records. ComplyVox will never specifically request special category data from the Client.

6.4 Details of ComplyVox's sub-processors, hosting locations, data retention periods, and technical and organisational security measures are set out in the Trust Centre (including the Sub-Processor List and the Privacy by Design & Default statement), as updated from time to time. ComplyVox will notify the Client in advance of any material change to its sub-processors in accordance with the DPA.

6.5 ComplyVox will notify the Client without undue delay on becoming aware of a Personal Data Breach affecting Client Data and will provide reasonable co-operation and assistance to the Client in investigating and mitigating the breach. As Data Controller, the Client remains responsible for assessing whether the breach must be notified to its supervisory authority (including, where relevant, within the 72-hour period referred to in Article 33 GDPR) and to any affected individuals, and for making any such notification.

6.6 Client Data is retained for the duration of the Client's contract with ComplyVox and, following termination or expiry, for a further period of two (2) months to allow the Client to export its data, after which it will be automatically and securely deleted. Call and meeting transcripts are deleted on the cycle set out in the Trust Centre.

6.7 The Client has full control over its Client Data and may exercise applicable privacy rights (access, correction, deletion, or portability) via the Platform on a self-service basis. Any data protection rights request that cannot be handled on a self-service basis will be actioned by ComplyVox without undue delay and, in any event, within 30 days.

7. Artificial intelligence: important notice and disclaimer

THE CLIENT ACKNOWLEDGES AND ACCEPTS THE MATTERS SET OUT IN THIS CLAUSE 7 AS AN ESSENTIAL PART OF THIS AGREEMENT, AND CONFIRMS IT HAS DRAWN THESE MATTERS TO THE ATTENTION OF ANY PERSONNEL WHO WILL USE THE PLATFORM.

7.1 How AI is used. The Platform uses artificial intelligence, including a voice assistant that converts speech to text, interprets and researches the Client's input, and generates draft outputs (such as policy documents, etc.).

7.2 AI is a tool, not a decision-maker. The Platform is an assistive, research, and document-generation tool. It does not make autonomous decisions on the Client's behalf, and no AI-generated output is automatically applied to, or forms part of, the Client's compliance framework, policies, or Records of Processing Activities. Every substantive AI-generated output is held in a “Pending” state, together with a source reference where applicable, until a designated, authorised individual within the Client's organisation actively reviews and confirms it. The Client is solely responsible for that review, and for the decision to adopt, amend, or reject any AI-generated output.

7.3 No automated decision-making. The Platform is not designed or intended for automated decision making (including profiling) that produces legal effects concerning, or otherwise significantly affects, any individual, and must not be used by the Client for such a purpose. ComplyVox does not consider the AI System to be “high-risk” under the EU AI Act, on the basis that it is an advisory and document-generation tool with mandatory human review of substantive outputs; the Client should nonetheless satisfy itself of the correct classification for its own specific use case.

7.4 AI transparency. In line with ComplyVox's obligations under the EU AI Act, the Client's personnel will be clearly informed, at the outset of any interaction, that they are engaging with an AI system rather than a human.

7.5 No guarantee of accuracy. AI-generated content may be incomplete, out of date, or inaccurate, and may occasionally misinterpret information or generate plausible-sounding but incorrect content. ComplyVox does not warrant that any AI-generated output is accurate, complete, error-free, or fit for any particular purpose. The Client must independently review and verify, and should where appropriate seek professional advice on, any AI-generated output before relying on or acting upon it.

7.6 Output similarity. Because the Platform draws on common regulatory frameworks and templates, outputs generated for the Client may be similar to outputs generated for other clients facing comparable circumstances. This does not affect the Client's rights in respect of its own populated compliance records under Clause 9.

7.7 Prohibited uses. The Client shall not use, and shall not permit any third party to use, the Platform for biometric identification or categorisation of individuals, employment screening or decisioning, credit scoring, law enforcement purposes, or any other purpose that would cause the Platform to be classified as “high-risk” or “prohibited” under the EU AI Act or any equivalent legislation.

7.8 AI sub-processing. Voice AI processing may be carried out by a third-party AI sub-processor identified in the Trust Centre, on a transient, contractual zero-retention basis, meaning conversational audio and text are processed only to generate a response and are not retained by that sub-processor. ComplyVox remains responsible to the Client for the acts and omissions of its sub-processors, as set out in the DPA.

8. No legal advice

8.1 ComplyVox is not a law firm. The Services, the Platform, and every output generated using the Platform (including any policy document, risk assessment, DPIA, or compliance framework) do not constitute, and must not be relied upon as, legal advice, regulatory advice, or a substitute for the advice of a qualified solicitor, barrister, or other legal professional.

8.2 Nothing in this Agreement, the Platform, or any output of the Services creates a solicitor-client relationship, an advisory relationship, or any equivalent professional relationship between the Client and ComplyVox, and no such relationship is intended or should be inferred.

8.3 The Services are intended to assist the Client's own internal personnel, or the Client's independently retained Data Protection Officer or legal adviser, in preparing and maintaining compliance documentation. They do not replace, and must not be treated as replacing, the judgement of a qualified Data Protection Officer or legal adviser, in particular in relation to novel, high-risk, cross-border, or legally contentious processing activities.

8.4 The Client remains solely responsible for its own compliance with the GDPR, all applicable Data Protection Legislation, and all other laws and regulations applicable to its business, and for all decisions made and actions taken, or not taken, on the basis of any output of the Services. Where the Client requires legal advice or a qualified Data Protection Officer, ComplyVox can make such services available directly or refer the Client to a suitably qualified adviser.

8.5 To the fullest extent permitted by law, ComplyVox excludes all liability arising from the Client's use of, or reliance on, any output of the Services as a substitute for independent legal or professional advice.

9. Intellectual property

9.1 As between the parties, ComplyVox and its licensors own all right, title, and interest in and to the Platform, the AI System, and all related software, documentation, templates, and know-how, including all improvements and developments to any of the foregoing.

9.2 Subject to payment in full of all fees due, ComplyVox grants the Client a non-exclusive, non-transferable licence to access and use the Platform, and to use and reproduce the compliance documents populated for the Client, solely for the Client's own internal business purposes during, and where relevant after, the term of this Agreement.

9.3 The Client retains ownership of the Client Data it submits to the Platform. The Client grants ComplyVox a licence to use Client Data solely to the extent necessary to provide the Services, in accordance with the DPA.

9.4 Nothing in this Agreement transfers ownership of any underlying template, methodology, or AI model used by ComplyVox to generate outputs, notwithstanding that the resulting populated document is licensed to the Client for its own use under Clause 9.2.

10. Confidentiality

10.1 Confidentiality is key to the success of the parties' relationship. Each party shall keep confidential all non-public information disclosed to it by the other party in connection with this Agreement (“Confidential Information”) and shall not disclose it to any third party except: (a) to its own employees, officers, professional advisers, or sub-contractors/sub-processors who need to know it for the purposes of this Agreement and who are bound by equivalent confidentiality obligations; (b) as required by law, regulation, or a competent authority; or (c) with the prior written consent of the disclosing party.

10.2 This Clause 10 shall survive termination or expiry of this Agreement for a period of three (3) years, save that in respect of trade secrets it shall continue for so long as the relevant information remains a trade secret.

11. Warranties and disclaimers

11.1 ComplyVox warrants that it will perform the Services using reasonable skill, care, and diligence consistent with good industry practice.

11.2 Except as expressly set out in this Agreement, the Services, the Platform, and all outputs are provided “as is” and “as available”, and, to the fullest extent permitted by law, ComplyVox disclaims all other warranties, whether express or implied, including any implied warranty of satisfactory quality, fitness for a particular purpose, accuracy, completeness, or non-infringement.

11.3 ComplyVox does not warrant that the Services or the Platform will be uninterrupted, error-free, or entirely secure, or that use of the Services will, on its own, ensure the Client's compliance with the GDPR or any other law. Data protection compliance is a continuous exercise that depends on matters outside ComplyVox's control, including changes in law, regulatory guidance, technology, and the Client's own business.

11.4 Data management, cybersecurity, and data protection are complex areas that change continuously in response to new threats, legislation, technologies, and working practices. By entering into this Agreement, the Client accepts that it remains solely responsible for its own data security and data protection. While the Services are intended to be as comprehensive as reasonably possible, ComplyVox does not represent or warrant that they will identify every vulnerability or compliance gap in the Client's business, and ComplyVox bears no responsibility for cybersecurity or data protection compliance issues that arise after completion of the relevant engagement, save where caused by ComplyVox's own breach of this Agreement.

12. Limitation of liability

12.1 Nothing in this Agreement limits or excludes either party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) gross negligence or wilful misconduct; or (d) any other liability which cannot lawfully be limited or excluded.

12.2 Subject to Clause 12.1, ComplyVox’s total aggregate liability arising out of or in connection with this Agreement, whether in contract, tort (including negligence), breach of statutory duty, or otherwise, shall not exceed the total fees paid by the Client to ComplyVox in the twelve (12) months immediately preceding the event giving rise to the claim (or, if this Agreement has been in force for less than twelve (12) months, the fees paid to date).

12.3 Subject to Clause 12.1, neither party shall be liable to the other for any indirect or consequential loss, or for any loss of profit, revenue, business, contracts, anticipated savings, or goodwill, arising out of or in connection with this Agreement.

12.4 The parties acknowledge that the limitations in this Clause 12 reflect a fair allocation of risk having regard to the fees charged for the Services, and that ComplyVox would not enter into this Agreement on any other basis.

12.5 Queries and remedies. ComplyVox would appreciate notification of any query or complaint within 14 days of the issue being identified, so that it can be discussed and, where possible and appropriate, rectified. Where a fault is notified and, if appropriate, ComplyVox is unable to rectify it, ComplyVox's liability in respect of that specific fault shall, subject to Clause 12.2, be limited to reimbursement of the fees paid for the specific element of the Services affected.

13. Indemnity

13.1 The Client shall indemnify and hold ComplyVox harmless against all claims, losses, liabilities, and reasonable costs (including legal fees) arising from: (a) the Client's breach of Clause 3 (Client Obligations); (b) the Client's use of any output of the Services in a manner inconsistent with Clause 7 or Clause 8; or (c) the Client's processing of Personal Data in breach of Data Protection Legislation, save, in each case, to the extent caused by ComplyVox's own breach of this Agreement or the DPA.

14. Sub-contracting and sub-processors

14.1 All Services will be carried out by ComplyVox Limited. ComplyVox may engage sub-contractors or sub-processors to assist in providing the Services, including the AI, hosting, and infrastructure providers identified in the Trust Centre's Sub-Processor List.

14.2 ComplyVox will notify the Client of any external engagement for specific expertise prior to engagement, and will notify the Client in advance of any material change to its sub-processors in accordance with the DPA. The Client may object on reasonable data protection grounds in accordance with the process set out in the DPA.

14.3 ComplyVox remains responsible for the performance of its sub-contractors' and sub-processors' obligations to the same extent as if performed by ComplyVox itself.

15. Force majeure

15.1 Neither party shall be liable for any failure or delay in performance caused by circumstances beyond its reasonable control, including (a) acts of God, fire, flood, storm, earthquake, or other natural disaster; (b) war, invasion, act of foreign enemies, hostilities, terrorism, civil war, rebellion, or insurrection; (c) pandemic, epidemic, or other public health emergency, and any related government-imposed lockdown, quarantine, travel restriction, or other public health measure; (d) civil commotion, riot, or civil unrest; (e) strikes, lockouts, or other industrial action, whether affecting the affected party's own workforce or that of a third party; (f) failure or interruption of electricity, telecommunications, internet, hosting, or other utility or infrastructure services; and (g) any failure, outage, insolvency, or default of a Sub-Processor or other third-party supplier, to the extent itself caused by a Force Majeure Event affecting that Sub-Processor or supplier, provided that the affected party notifies the other promptly and uses reasonable efforts to mitigate the effect.

16. Changes to these terms

16.1 ComplyVox may update these Terms from time to time to reflect changes in law, regulation, or the Services. Where a change is material, ComplyVox will give the Client at least 30 days' written notice (which may be given via the Platform or by email) before the change takes effect. Continued use of the Services after that date constitutes acceptance of the updated Terms. If the Client does not agree to a material change, it may terminate this Agreement on written notice given before the change takes effect, without penalty. Any refund of fees already paid is as set out in the applicable Proposal or Order Form.

17. Assignment

17.1 The Client shall not assign, transfer, or sub-contract any of its rights or obligations under this Agreement without ComplyVox's prior written consent. ComplyVox may assign this Agreement in connection with a merger, acquisition, corporate reorganisation, or sale of all or substantially all of its assets, on written notice to the Client.

18. Notices

18.1 Notices under this Agreement must be in writing and sent by email or pre-paid post to the addresses specified in the Proposal or, in ComplyVox's case, to dpo@complyvox.eu or info@complyvox.eu, and shall be deemed received on the next business day after sending.

19. Entire agreement

19.1 This Agreement, comprising these Terms, the applicable Proposal or Order Form, the DPA, and the Trust Centre documentation referenced in this Agreement, constitutes the entire agreement between the parties in relation to its subject matter and supersedes all prior discussions, representations, and agreements, whether written or oral. Each party acknowledges that it has not relied on any representation not set out in this Agreement.

20. Severability and waiver

20.1 If any provision of this Agreement is found to be invalid or unenforceable, the remainder of the Agreement shall continue in full force and effect. No failure or delay by either party in exercising any right under this Agreement shall constitute a waiver of that right.

21. No partnership

21.1 Nothing in this Agreement, and no action taken by either party in connection with it, shall be construed as creating a partnership, joint venture, agency, trust, or employment relationship between the parties. Neither party is authorised to act as agent for, or to bind, the other party in any way, and neither party shall represent itself as having any such authority. Each party shall remain an independent contractor in its dealings with the other under this Agreement

22. Third party rights

This Agreement does not create any right enforceable by any person who is not a party to it. For the avoidance of doubt, and without prejudice to the general position under Irish law that only a party to a contract may enforce it, no term of this Agreement is intended to confer a benefit on, or be enforceable by, a third party under the UK Contracts (Rights of Third Parties) Act 1999 or any equivalent legislation in any other jurisdiction.

23. Counterparts and electronic execution

This Agreement may be executed in any number of counterparts, each of which when executed is an original and all of which together evidence the same agreement. This Agreement may be executed and delivered by electronic signature, including via the eSignature facility made available through the Trust Centre, and an electronically signed counterpart shall be as valid and binding as one signed in ink. Each party consents to the use of electronic signatures for the purposes of this Agreement.

24. Governing law and jurisdiction

24.1 This Agreement, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter, shall be governed by, and construed in accordance with, the laws of Ireland.

24.2 The parties irrevocably agree that the courts of Ireland shall have exclusive jurisdiction to settle any such dispute or claim.

Acceptance

The parties' authorised representatives confirm that they have read, understood, and agree to be bound by these Terms and Conditions of Service, including the important notices in Clauses 7 and 8 above.