LAST UPDATED 5 NOVEMBER 2026
Data processing agreement
This agreement applies whenever OAW Solutions Limited ("we", the processor) handles personal data on behalf of a business customer ("you", the controller) through Lorelo by Vallamo. It forms part of our terms of service and meets Article 28 of the UK and EU GDPR. Where there is a conflict, this agreement prevails for data protection matters.
1. Roles and instructions
You are the controller and we are the processor of personal data about your callers, message senders and customers ("customer data"). We process it only on your documented instructions, which are these terms and your use and configuration of the service, unless the law requires otherwise (we will tell you unless prohibited). We will tell you if an instruction appears to breach data protection law. We act as a "service provider" under US state privacy laws and will not sell or share customer data or use it outside providing the service.
2. Details of processing
| Item | Detail |
|---|---|
| Subject matter and purpose | Answering calls and messages for you, taking messages and bookings, passing matters to your staff, and the account functions that support this |
| Duration | Your subscription, plus the export and deletion period in section 8 |
| Types of personal data | Names, telephone numbers, social account identifiers, message and call content (as written transcripts and AI summaries; no audio is kept), booking details, and anything callers choose to say, which may include sensitive information |
| People affected | Your callers, message senders, customers and prospects; your staff whose details you provide |
| Retention in the service | The period you set (90 days by default, up to two years) |
3. Our obligations
- Make sure everyone who processes customer data is bound by confidentiality.
- Keep the security measures in section 5.
- Help you answer requests from individuals exercising their rights, including through the data download and deletion functions in the dashboard.
- Help you meet your security, breach-notification, impact-assessment and prior-consultation duties, taking account of the information we have.
- Tell you without undue delay, and in any event within 48 hours, after we become aware of a personal data breach affecting customer data, with the information we have to help you meet your own notification duties.
- Give you the information needed to show we comply, and allow audits by you or your auditor on reasonable notice, no more than once a year unless a regulator requires it or after a breach, subject to confidentiality and to protecting other customers. We may meet this by providing current independent reports or answers to a reasonable questionnaire.
4. Sub-processors
You give us general authority to use the sub-processors on our sub-processors page. We bind each to data protection terms no less protective than these, and remain responsible for their performance. We will give you at least 30 days' notice of any addition or replacement, by email or on that page, and you may object on reasonable data-protection grounds within that time. If we cannot resolve the objection, you may cancel the affected service and receive a refund of prepaid fees for the unused period.
5. Security measures
- Encryption of data in transit; encryption of stored third-party credentials.
- Separation of each business's data at database level (row-level security), tested.
- Access to production limited to those who need it, with sign-in protections; signed, short-lived credentials between our own systems.
- Request validation and rate limits; logging of important events without passwords, tokens or message text.
- No storage of call audio; stored call and message content is removed after your chosen retention period.
- Regular backups with restricted access, and a documented process for restoring and deleting data.
- Review of providers' security and data-protection terms before use.
6. International transfers
You authorise transfers of customer data to the countries of our sub-processors, including the United States. Where the destination lacks an adequacy decision we use the UK International Data Transfer Addendum and EU Standard Contractual Clauses (and the Swiss addendum), or the provider's certification under the UK-US or EU-US data bridge, with supplementary measures where needed.
7. Individuals' requests and authorities
If an individual or authority contacts us about customer data, we will refer them to you where lawful and will not respond except on your instructions or as the law requires.
8. Return and deletion
While your account is open you can download and delete customer data. When your subscription ends or you close your account, we will, at your choice, return and then delete customer data within 30 days (after the 7-day change-of-mind period), except where the law requires us to keep it. Backups are overwritten within about 35 days.
9. Liability and law
Each party's liability under this agreement is subject to the limits in the Liability clause of our terms. This agreement is governed by the law of England and Wales. Contact for data protection matters: support@vallamo.com.