Data Processing Addendum
Last updated 23 October 2026
This addendum forms part of the Terms of Service between Anqor Studios L.L.C-FZ ("Marvo", the Processor) and the customer ("Customer", the Controller). It applies where Marvo processes personal data on the Customer's behalf while providing the service. A signed copy is available on request: hello@marvo.cc.
1. Scope and roles
The Customer decides why and how personal data is processed and is the controller; Marvo processes it only on the Customer's documented instructions, which are these terms, the order form, and the Customer's use and configuration of the service. Each party will comply with the data protection law that applies to it, which is set out in the country schedule and may include, for example, the UAE Federal Decree-Law No. 45 of 2021 on personal data protection, Nigeria's Data Protection Act 2023 and, where it applies, the GDPR. Marvo will tell the Customer if it believes an instruction breaks the law.
2. Details of the processing
| Subject matter | Placing and answering calls, transcription, booking, messaging and reporting for the Customer's leads and callers |
|---|---|
| Duration | The term of the agreement, plus the return or deletion period in section 9 |
| People concerned | The Customer's leads, prospects, customers and callers, and its staff who use the service |
| Personal data | Names, phone numbers, email addresses, company names, call audio and recordings where enabled, transcripts, summaries and outcome labels, appointment details, consent and opt-out records, and any other fields the Customer loads |
| Special categories | None intended. The Customer must not instruct the service to collect them |
3. Marvo's obligations
- Process personal data only for the purposes above and on the Customer's instructions.
- Make sure the people who work with the data are bound to confidentiality.
- Apply the security measures in section 5.
- Help the Customer answer requests from people exercising their rights, and carry out the Customer's instructions to correct, export or delete data. Where a person contacts Marvo directly, Marvo will pass the request to the Customer.
- Help the Customer with impact assessments and consultations with authorities, where reasonably needed.
- Not sell the data or use it for its own marketing.
4. Subprocessors
The Customer authorises Marvo to use providers in the categories below. They may run data centres outside the Customer's country. Marvo has a contract with each that requires protection of personal data, and remains responsible for them. Marvo will tell the Customer at least 14 days before adding or replacing one that handles personal data, and the Customer may object on reasonable data protection grounds; if the matter cannot be solved, the Customer may end the affected service.
| Category | What it does |
|---|---|
| Voice call orchestration | Runs the live call: connects telephony, speech recognition, the language model and the voice |
| Language model | Writes the assistant's replies from the approved script and offer |
| Speech recognition and voice | Turns the caller's speech into text and the assistant's text into speech |
| Telephony carriers and SMS | Carry the call and text messages to the person's phone, in the country called |
| Call summaries and labels | Summarises each call and labels the outcome |
| Calendar, meeting links and email | Books appointments, sends invitations, confirmations and alerts |
| Hosting | Runs the Customer's installation and this website's booking functions |
The named list of providers is given to every Customer with the signed addendum and on request at any time. Which providers apply depends on the country and features the Customer uses.
5. Security measures
- Encrypted connections between the Customer, Marvo and its providers.
- Integration keys stored encrypted; access to the service is by individual access key.
- Safeguards on calling: country locks, calling hours, do-not-call lists, daily limits, an emergency stop and a test mode.
- Rate limits and signed email confirmation on public forms.
- An audit log of important changes, and access to production systems limited to people who need it.
These measures may be improved over time but will not be reduced in a way that lowers the overall level of protection.
6. Personal data breaches
Marvo will tell the Customer without undue delay, and within 72 hours, after becoming aware of a breach affecting the Customer's personal data, with the information it has to help the Customer meet its own notification duties.
7. Hosting and data location
Where the order form names a hosting region, the Customer's installation, including its leads, call records and settings, is stored on a server in that region. Call audio and text are processed live by the providers in section 4, which may be located elsewhere, so a hosting region does not mean that every step of a call is processed there. Marvo will describe the providers' locations on request.
8. International transfers
The Customer authorises transfers needed to provide the service to the providers in section 4. Where the law of the Customer's country requires safeguards for such transfers, Marvo will put them in place with those providers.
9. Return and deletion
At the Customer's choice, Marvo will return the Customer's personal data or delete it within 30 days after the agreement ends or on written request, unless the law requires it to be kept. Backups are removed on their normal cycle.
10. Information and audits
Marvo will give the Customer the information it reasonably needs to check compliance with this addendum, and will allow one audit a year on 30 days' notice, during business hours, at the Customer's cost and under confidentiality, without access to other customers' data.
11. Liability and order of precedence
Each party's liability under this addendum is subject to the limits in the Terms of Service. If this addendum and the Terms of Service conflict about personal data, this addendum applies.