Data processing agreement

Last updated: 8 October 2026

This data processing agreement forms part of the KiwiPhone app terms between Rebase Ventures Limited and the business customer. Accepting those terms includes accepting this agreement. The person accepting for a business confirms that they have authority to bind it. This version is dated 8 October 2026.

Scope and responsibilities

This agreement covers personal information that Rebase processes on the customer's behalf through KiwiPhone, called customer data below. It forms part of the service contract once accepted. If its data-protection terms conflict with the service contract, this agreement takes priority. Mandatory transfer clauses take priority over both.

The customer decides the purposes for handling its caller and customer information and is the controller where UK GDPR applies. Rebase acts as its processor. If the customer acts for another controller, it confirms that it has authority to appoint Rebase and pass on lawful instructions.

Each party must meet its duties under the data-protection laws that apply to its activities, including UK GDPR and the Data Protection Act 2018, applicable Canadian federal and provincial privacy laws, and New Zealand's Privacy Act 2020.

Rebase separately controls information needed for its own account administration, security, support, billing and legal duties. The app privacy notice describes that use.

Documented instructions

Rebase will process customer data only on the customer's documented instructions, including the accepted service contract, this agreement and settings or requests that the customer submits through the service. Instructions include the transfers needed to supply the agreed features under the safeguards described below.

If a law requires other processing, Rebase will tell the customer before processing unless that law prohibits notice. Rebase will promptly tell the customer if it considers an instruction to infringe applicable data-protection law and will suspend that instruction while the parties resolve it.

The customer must establish a lawful basis and provide the information and choices required for its callers. It must use the service within its stated scope, keep business notes accurate and give any instructions needed to correct or delete information. Sensitive information requires any additional legal condition that applies.

Confidentiality and security

Rebase will limit access to people who need it for the service and ensure they have confidentiality duties. It will maintain technical and organisational measures appropriate to the risks, including the measures in the security schedule below.

Rebase will review those measures as the risks or service change. A change must maintain an appropriate level of protection. The customer must protect its account and device, manage notification previews and report suspected misuse promptly.

Subprocessors

The customer gives general written authorisation for the relevant providers on the subprocessors page to process customer data. Rebase will bind each subprocessor to data-protection obligations that provide the protection required by applicable law and this agreement. Rebase remains responsible to the customer for the subprocessor's performance of those obligations.

Where applicable data-protection law requires it, Rebase will give written notice of an intended addition or replacement of a subprocessor, with a reasonable period to object before the change takes effect. The notice will state the deadline and how to object on data-protection grounds. The parties will work to resolve the concern. If they cannot do so, the customer can end the affected service before that subprocessor starts, with a refund of unused prepaid fees for that service where payable by Rebase. Apple-managed refunds follow Apple's process and mandatory law.

International transfers

Rebase will make restricted transfers only under a valid mechanism and complete the assessments required by applicable law. For UK transfers, this can include adequacy regulations, the UK International Data Transfer Agreement, or applicable EU standard contractual clauses with the UK Addendum. Any required annexes must identify the parties, processing and safeguards.

Rebase will assist with Canadian accountability requirements and applicable provincial assessments. For New Zealand information, it will distinguish processing by an agent from overseas disclosure and apply the safeguards required for the relevant role. The parties will document additional terms if an existing provider agreement does not cover a required protection.

Requests from individuals

Rebase will promptly pass relevant requests about customer data to the customer and help it respond, taking account of the processing and tools available. Assistance covers access, correction, deletion, restriction, objections and portability where those rights apply.

Rebase will respond on the customer's behalf only on its instructions or where the law requires a response. Identity checks and protection of other people's information apply to disclosures. The customer remains responsible for its response deadline.

Breaches and assistance

Rebase will notify the customer without undue delay after becoming aware of a personal data breach affecting customer data. It will provide the information then available about the breach, affected information, likely consequences and steps taken. Further details will follow as the investigation progresses.

Rebase will help the customer meet applicable security, breach-reporting, privacy-assessment and regulator-consultation duties, taking account of the information available to Rebase. Each party retains its own legal reporting duties.

Return and deletion

At the end of processing, Rebase will, at the customer's choice, return or delete customer data and delete existing copies, unless applicable law requires retention. The customer can request a return before account closure. Rebase will explain the available export process.

Data retained for a legal requirement will be restricted to that purpose and deleted when the requirement ends. Backups will remain protected and expire under the applicable backup schedule. Restoring a backup must also restore the relevant deletion instructions. Rebase will require appropriate cleanup from its subprocessors and provide completion information on request.

Evidence and audits

Rebase will provide information needed to demonstrate compliance with this agreement and allow and contribute to audits, including inspections by the customer or its appointed auditor. The parties will agree practical arrangements that protect other customers and service security. These arrangements must preserve audit rights required by law, including urgent checks following a breach or regulator request.

Processing schedule

The purpose is to provide business telephone calls, KiwiPhone’s AI Receptionist and records that help the customer follow up enquiries. Processing includes receiving and transmitting call audio, creating text, generating summaries and AI-call tasks, linking customer records, sending alerts and handling support or deletion requests.

The people concerned include the account owner, callers, people mentioned during calls and individuals whose details appear on the business website. Data can include contact details, business information, call metadata, conversation content, notes and task text. Incidental sensitive information can be included by a caller; the AI Receptionist excludes clinical or legal triage and emergency workflows.

Processing is ongoing while the customer uses the service. KiwiPhone retains transcripts and summaries for the account's lifetime, subject to lawful earlier instructions and individual rights. The return and deletion terms apply when processing ends. The customer must review whether keeping its records continues to serve its lawful purpose.

Security schedule

Service access uses authenticated requests and account ownership checks. Administrative access is restricted. Connections to supported provider endpoints use encrypted transport, and database connections use certificate and hostname checks. Telecommunications networks carry calls under their own technical protections.

Operational safeguards include limited diagnostic fields, separate credentials, protection against overlapping owner calls and checks before uncertain provider work is repeated. Account closure coordinates service shutdown and provider cleanup. Rebase will maintain procedures for access review, incidents and rights requests, and review the effectiveness of its controls.

Acceptance and contact

The customer is the business identified by the account and its service records. This agreement takes effect with the customer's acceptance of the app terms. Rebase's contact details appear below. A customer that needs a separately signed copy can request one at hi@kiwiphone.app.

KiwiPhone is operated by Rebase Ventures Limited, a company registered in England and Wales, number 12607001. Our registered office is 2 Upperton Gardens, Eastbourne, East Sussex, BN21 2AH, United Kingdom.

Damien Tanner, CEO, is responsible for privacy. Contact him at hi@kiwiphone.app or write to our registered office, marked “KiwiPhone privacy”.