List of Sub-processors
In accordance with Article 28 of the GDPR, we publish the complete list of sub-processors that D.O.D.O. OFFICE OUTLET S.R.L. uses to provide you with the AI voice agent service. All sub-processors process data exclusively on the basis of our documented instructions and, where applicable, have signed data processing agreements (DPA) with us.
Active sub-processors
| Provider | Service | Data categories | Location | Transfer mechanism |
|---|---|---|---|---|
| ElevenLabs, Inc. [exact registered name and address — to be confirmed] | Voice AI (speech-to-text, Scribe model + text-to-speech); voice processing in transit. Vocalyy does not use ElevenLabs storage for call recordings — these are stored exclusively on the Vocalyy platform. ElevenLabs' own retention of content processed through their API is governed by the ElevenLabs DPA (section 9.2) | Voice/audio, transcription in transit | USA (State of New York) | SCC (incorporated in the ElevenLabs DPA) |
| Telnyx LLC | Telephony / call routing | Phone number, audio in transit, call metadata | USA (with option for EU data residency) [to be reconfirmed] | DPF [to be reconfirmed] |
| OpenAI, L.L.C. | Language model (GPT-4o family) that generates the agent's conversational responses; generation of embeddings for the agent's knowledge-base search | Transcript content, conversation content (in transit/processing) | USA | DPF or SCC |
| Deepgram, Inc. | Speech-to-text, alternative provider, enabled per agent in place of ElevenLabs | Voice/audio, transcript in transit | USA | SCC |
| Anthropic PBC | AI-assisted drafting of support-ticket replies (not part of the call flow) | Content of support messages submitted by the client | USA | DPF |
| Supabase Inc. | PostgreSQL database + authentication + storage (incl. call audio recordings, kept for 30 days) | Account data, operational data, audio recordings | EU (Frankfurt, Germany) | In the EU — no transfer |
| Render Services, Inc. | Backend hosting | Operational/application data | USA | DPF [to be reconfirmed if still in use] |
| Resend | Transactional email | Email addresses, notification content | USA | SCC-DPF [to be reconfirmed if still in use] |
| Cal.com Inc. | Booking lookup — optional sub-processor, activated only if and when the client connects their own account. The access key is relayed, never stored by Vocalyy. | Contact and booking data | EU / USA | SCC |
| Stripe Payments Europe Ltd. | Payment processing | Billing/payment data | EU (Ireland) [to be reconfirmed if still in use] | In the EU — no transfer |
| Google LLC | Google Workspace Calendar and Sheets (OAuth integration) — optional sub-processor, activated only if and when the client connects their own Google account | Calendar/scheduling data | USA [to be reconfirmed if still in use] | DPF [to be reconfirmed if still in use] |
ElevenLabs official documents: their Data Processing Agreement · their compliance portal, where their own sub-processor list is published. The international transfer to ElevenLabs relies on the Standard Contractual Clauses incorporated in their DPA.
The only item still outstanding in the table above is ElevenLabs’ exact registered name and address; these are not stated in their DPA or Terms, and their compliance portal requires JavaScript. They will be filled in from the provider’s billing documents. All other information in the table is confirmed.
Sub-processors under evaluation
These are providers we are evaluating for future integration. They do not process personal data at this time.
- Microsoft Azure — for EU data residency for clients who request it (planned)
- HubSpot — CRM integration (at client's request)
- Twilio — telephony alternative (under evaluation as a backup)
How we manage international transfers
For each sub-processor located outside the European Economic Area (EEA), we use one of the following legal mechanisms:
- EU-US Data Privacy Framework (DPF) — for certified US sub-processors
- Standard Contractual Clauses (SCC) — approved by the European Commission, for the others
- Transfer Impact Assessments (TIA) — for higher-risk cases
The exact mechanism applicable to each sub-processor is indicated in the table above.
Notification of changes
We will notify all our clients at least 30 days before adding a new sub-processor. Clients have the right to object and to terminate the contract without penalties if they do not agree with a significant change.
Notification is provided through:
- Email to each client's primary contact
- Update on this page
- Notification in the dashboard
How you can object
If you are a Vocalyy B2B client and you object to the addition of a new sub-processor, write to us at dpo@vocalyy.ro within 30 days of the notification. We will find an alternative solution or, if that is not possible, you will be able to terminate the contract without penalties.
Contact
For questions about sub-processors or data processing:
- Privacy contact channel: dpo@vocalyy.ro
- General contact: agent@vocalyy.ro
This page is part of our transparency policy. See also: Privacy Policy · Terms and Conditions · Retention Policy · AI System Information · Data Processing Agreement (DPA)