Vitel Global Data Processing Addendum

Effective Date: September 16, 2026
Last Updated: September 16, 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between Vitel Global Communications LLC (“Vitel Global,” “Processor,” “Service Provider,” “Contractor,” or “Vitel,” as applicable) and the customer identified in the applicable order form or agreement (“Customer,” “Controller,” or “Business,” as applicable) for the provision of Vitel Global services (the “Agreement”).

This DPA applies only to the extent Vitel Global processes Customer Personal Data on behalf of Customer in connection with the Services. If there is a conflict between this DPA and the Agreement concerning the processing of Customer Personal Data, this DPA controls.

1. Definitions

“Applicable Data Protection Law” means any privacy, data protection, or data security law applicable to the processing of Customer Personal Data under the Agreement, including, where applicable, the GDPR, UK GDPR, Swiss data protection law, and U.S. state privacy laws.

“Customer Personal Data” means Personal Data contained in Customer Content that Vitel Global processes on behalf of Customer to provide the Services, excluding personal data for which Vitel Global acts independently as a controller/business for its own purposes.

“Data Subject,” “Personal Data,” “Processing,” “Processor,” “Controller,” and similar terms have the meanings assigned by Applicable Data Protection Law.

“GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as incorporated into the laws of the United Kingdom.

“Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Vitel Global, excluding unsuccessful attempts or events that do not compromise Customer Personal Data.

“Subprocessor” means a third party engaged by Vitel Global to process Customer Personal Data on behalf of Customer in connection with the Services.

2. Roles and Scope of Processing

Customer determines the purposes and means of processing Customer Personal Data through the Services and acts as Controller/Business or otherwise in the role assigned by Applicable Data Protection Law. Vitel Global processes Customer Personal Data on Customer’s documented instructions and acts as Processor/Service Provider/Contractor, except where Applicable Data Protection Law requires Vitel Global to process the data for another purpose.

Customer’s documented instructions consist of the Agreement, this DPA, applicable order forms, product configuration chosen by Customer, and lawful instructions submitted through agreed support or administrative channels. Vitel Global will notify Customer if, in Vitel Global’s reasonable opinion, an instruction violates Applicable Data Protection Law, unless law prohibits such notice.

3. Customer Responsibilities

Customer represents that it has provided required privacy notices, has a valid legal basis for processing, has obtained required consents, and is authorized to disclose Customer Personal Data to Vitel Global. Customer is responsible for the accuracy, quality, and legality of Customer Personal Data and for its use of the Services, including recording, transcription, monitoring, AI, retention, and access settings.

4. Confidentiality

Vitel Global will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations and receive access only as necessary for their assigned functions.

5. Security Measures

Vitel Global will maintain reasonable and appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the state of the art, implementation costs, nature and scope of processing, and risks to individuals. The measures applicable to the Services are summarized in Annex II and may be updated provided the overall level of protection is not materially reduced.

6. Subprocessors

Customer provides general written authorization for Vitel Global to engage Subprocessors. Vitel Global will maintain a current Subprocessor Disclosure identifying Subprocessors that process Customer Personal Data, their processing function, and relevant location information.

Vitel Global will impose data protection obligations on each Subprocessor that are no less protective in material respects than the obligations applicable to Vitel Global under this DPA, to the extent relevant to the Subprocessor’s services. Vitel Global remains responsible for the performance of its Subprocessors to the extent required by Applicable Data Protection Law and the Agreement.

7. Data Subject Requests

Taking into account the nature of processing, Vitel Global will provide reasonable assistance to Customer through appropriate technical and organizational measures, insofar as possible, for Customer to respond to requests from Data Subjects exercising rights under Applicable Data Protection Law. If Vitel Global receives a request relating to Customer Personal Data for which Customer is responsible, Vitel Global may direct the requester to Customer unless prohibited by law.

8. Regulatory Assistance; Assessments

Taking into account the nature of processing and information available to Vitel Global, Vitel Global will provide reasonable assistance to Customer with security obligations, data protection impact assessments, prior consultations, and similar obligations required by Applicable Data Protection Law, subject to reasonable confidentiality and cost arrangements for assistance beyond standard documentation.

9. Security Incidents

Vitel Global will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data and will provide information reasonably available to Vitel Global to assist Customer in meeting applicable notification obligations. Notification of a Security Incident is not an admission of fault or liability.

Vitel Global will take reasonable steps to contain, investigate, mitigate, and remediate a Security Incident within its control and will provide updates as material information becomes reasonably available.

10. Return and Deletion

Upon termination or expiration of the Services, Vitel Global will delete or return Customer Personal Data in accordance with the Agreement, product functionality, Customer instructions, applicable retention schedules, backup cycles, and legal requirements. Vitel Global may retain information where required by law, provided retained Customer Personal Data remains protected and is not processed for other purposes except as legally required.

11. Audits and Information

Vitel Global will make available information reasonably necessary to demonstrate compliance with this DPA, which may include third-party audit reports, certifications, security summaries, questionnaires, or similar materials where available. Customer will use such materials before requesting an onsite audit.

Where Applicable Data Protection Law requires an audit and available documentation is insufficient, the parties will agree on reasonable scope, timing, confidentiality, security, and cost terms. Audits must not unreasonably interfere with Vitel Global operations, expose information relating to other customers, or compromise security.

12. International Transfers

Where Customer Personal Data is transferred internationally and Applicable Data Protection Law requires a transfer mechanism, the parties will use a lawful mechanism appropriate to the transfer. For transfers subject to the GDPR that require Standard Contractual Clauses, the then-applicable European Commission controller-to-processor or processor-to-processor modules, as relevant, are incorporated by reference to the extent legally required, with the information in this DPA and its Annexes supplying the applicable annex details.

For transfers subject to the UK GDPR or Swiss law, the parties will apply the legally recognized addendum, adaptation, or transfer mechanism required by the applicable jurisdiction. If a recognized mechanism is replaced or invalidated, the parties will cooperate in good faith to implement a valid replacement.

13. Government Requests

Unless prohibited by law, Vitel Global will direct a governmental request for Customer Personal Data to Customer where appropriate or notify Customer of the request. Vitel Global will review requests for legal validity and will disclose only information it is legally required to disclose. Nothing in this DPA requires Vitel Global to challenge a lawful request where such challenge would be unreasonable or prohibited.

14. U.S. State Privacy Terms

To the extent Vitel Global processes Customer Personal Data as a “service provider,” “contractor,” “processor,” or equivalent regulated role under applicable U.S. state privacy law, Vitel Global will: process the data only for the limited and specified purposes described in the Agreement; not sell or share the data for cross-context behavioral advertising except as directed by Customer and permitted by law; not retain, use, or disclose the data outside the direct business relationship except as permitted by law; provide the same level of privacy protection required by applicable law; permit reasonable steps by Customer to verify compliance; and notify Customer if Vitel Global determines it can no longer meet its applicable obligations.

Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data as permitted by Applicable Data Protection Law and the Agreement.

15. Liability

The liability provisions of the Agreement apply to this DPA, except to the extent Applicable Data Protection Law requires otherwise. Nothing in this DPA limits rights of Data Subjects or regulators that cannot lawfully be limited by contract.

16. Precedence and Term

This DPA remains in effect for as long as Vitel Global processes Customer Personal Data on behalf of Customer. In the event of conflict between this DPA and incorporated transfer clauses, the transfer clauses control to the extent of the conflict for the relevant transfer.

Annex I — Details of Processing

Annex II — Technical and Organizational Measures

The following categories describe the controls Vitel Global should maintain where applicable to the relevant Service. Before publication, Vitel Global Security must verify that each category accurately reflects implemented controls and supporting evidence.

• Information security governance, documented policies, risk management, and assigned security responsibilities.
• Logical access controls, least-privilege principles, authentication, privileged-access management, and periodic access review.
• Encryption of data in transit using industry-standard protocols and encryption of stored data where appropriate to the Service and architecture.
• Network, infrastructure, endpoint, and cloud security controls designed to reduce unauthorized access and malicious activity.
• Secure software development practices, code review, vulnerability management, patching, dependency management, and change control.
• Logging, monitoring, alerting, threat detection, incident response, and post-incident remediation processes.
• Business continuity, backups, disaster recovery, availability planning, and resilience measures appropriate to the Service.
• Personnel confidentiality, security awareness, and role-appropriate training.
• Vendor and Subprocessor due diligence, contractual safeguards, and ongoing risk management.
• Data minimization, retention, deletion, and access-control processes appropriate to the product and Customer configuration.
• Physical security controls for facilities and infrastructure where Vitel Global has relevant responsibility.
• Periodic security testing, vulnerability assessment, penetration testing, independent assurance, or certifications where maintained by Vitel Global.

Annex III — Authorized Subprocessors

The current list should be published separately in the Vitel Global Subprocessor Disclosure and incorporated into this DPA by reference. No vendor should be listed until Vitel Global has verified the legal entity, service function, data processed, processing location, and transfer mechanism.

Annex IV — Contact

Data protection inquiries: support@vitelglobal.com; postal contact: Vitel Global Communications LLC, Attn: Privacy/Legal, 295 Durham Avenue, Suite D, South Plainfield, NJ 07080, United States.