Data processing agreement

1. Roles

You are the controller. We are the processor. When Taiwa translates a call, the voice of the person on the other end is personal data that you control. You decide the purpose; we act on your instruction. We do not use it for anything other than providing Taiwa.

Separately, we are a controller for your own account data — your agents' email addresses, your settings, your usage. That processing is described at taiwa.cx/legal/privacy and is not governed by this DPA.

2. Subject matter and duration

Subject matter: real-time machine translation of live voice calls. Duration: the term of your agreement. Nature and purpose: capturing call audio in your agent's browser, transmitting it to our translation provider, and returning translated speech to the call.

3. Types of personal data

The voice of the person on the call, and whatever they say in it. Because it's speech, its content is determined by the caller. It may incidentally contain any category of personal data the caller chooses to speak aloud, including special category data. We never receive a stored copy, never retain it, and it is not held by us in any form — it transits between the caller's browser session and the translation provider.

4. Categories of data subject

The people your agents speak to on calls where translation is enabled. Also your agents, whose speech is translated on the outbound leg.

5. What we do not process

We do not store call audio. It streams from your agent's browser to our translation provider and back; it does not traverse our servers and we never hold a copy. We do not store transcripts. They exist in your agent's browser for the duration of the session and are never transmitted to us. We do not hold your customer records.

6. Your instructions

We process your customers' personal data only to provide translation, and only as instructed by your use of the service. We will not process it for any other purpose. If we believe an instruction infringes data protection law, we will tell you.

7. Sub-processors

We use two for every account, and a third during the free trial: Amazon Web Services (hosting; account and usage data, no call audio), Cloudflare (website and API edge; IP addresses in transit), and DeepL SE (translation; processes call audio on Taiwa's own account, which is the free trial only). You consent to them by entering the agreement, and we will notify you of any addition or replacement, with a right to object. Where you hold your own agreement with a translation supplier — DeepL SE, OpenAI or Google — that supplier processes your call audio under that contract rather than as our sub-processor: Taiwa holds your key and mints sessions against it, and the audio goes from your agent's device to the supplier without passing through us.

8. Security

Call audio is transmitted over encrypted connections. Access to account data is authenticated and scoped to a single tenant, derived server-side. Secrets are stored encrypted and referenced rather than exposed. Our full technical and organisational measures form part of the signed agreement and state only what we operate.

9. Personnel

Anyone with access to personal data processed under this DPA is bound by confidentiality.

10. International transfers

Account data is processed in the United Kingdom (AWS London). Call audio is processed by the translation supplier you chose, in the region your agreement with that supplier provides for; DeepL SE processes in Germany. Transfers of personal data from the EEA to the United Kingdom do not require additional safeguards: the European Commission's adequacy decision for the UK was renewed on 19 December 2025 and applies until 27 December 2031.

11. Assisting you

We will assist you, so far as we reasonably can, with responding to data-subject requests, data protection impact assessments, consultation with a supervisory authority, and security of processing. Because we hold no call audio and no transcripts, a data-subject request about the content of a call has no data with us to satisfy it, and we will help you evidence that.

12. Personal data breach

We will notify you without undue delay after becoming aware of a breach affecting your data, with the information you need to meet your own obligations.

13. Deletion and return

On termination we will delete the personal data we hold, except where we're required to retain it — invoicing records, kept for the period in the privacy policy. Because we hold no call audio and no transcripts, there is nothing of your customers' to return.

14. Audit

We will make available the information needed to demonstrate compliance with Article 28, and allow for audits by you or an auditor you mandate, on reasonable notice.

15. Contact

[email protected] · Kanso CX Ltd, 66 Paul Street, London EC2A 4NA.