V2.1
Annex A – Data Processing Schedule (Data Processing Addendum)
This Data Processing Schedule (“DPA”) forms part of the Agreement between Titus Telecom and the Customer (including the Hosted Terms and/or the IoT Cellular Terms, as applicable).
Capitalised terms have the meanings set out in the Agreement unless otherwise defined in this DPA.
1. Roles and scope of processing
1.1 Titus Telecom acts as:
• Data Controller when processing call data records, traffic/billing data, account contact details and service configuration data for service provision, billing, fraud prevention, security and compliance with legal obligations.
(also) when processing IoT SIM usage/traffic metadata, account/billing data, and platform logs needed for service provision, billing, fraud prevention, security and legal obligations.
• Data Processor when processing Customer Personal Data on documented instructions of the Customer (e.g., user profiles, extension configuration, call recordings, voicemail, address book entries, CRM integration data).
(also) when processing Customer Personal Data in IoT services on documented instructions (e.g., SIM profiles linked to named users, device naming, tickets, address book entries uploaded by the Customer).
1.2 Subject matter and duration: Processing Customer Personal Data for the purpose of providing, supporting and securing the Services for the term of the Agreement and until deletion or return in accordance with this DPA.
1.3 Nature and purpose: Provision of hosted VoIP/cloud PBX, call routing, messaging, voicemail, call recording (where ordered), SIP registration, number management, support, diagnostics, security monitoring, service analytics and billing support. SIM provisioning/management, APN configuration, data-usage monitoring, alerting, diagnostics and security monitoring for IoT connectivity.
1.4 Types of Personal Data: identification data (names, usernames), contact details (email, telephone numbers), authentication data, call detail records (metadata), configuration data, recordings/voicemails (if enabled), IP/log data. IMSI/MSISDN and device identifiers where linked to a person, usage/traffic metadata, APN and IP/log data associated with user accounts
1.5 Categories of Data Subjects: Customer’s employees, contractors, agents, and any individual making or receiving calls using the Service. V2.1
2. Customer instructions
Titus Telecom shall process Customer Personal Data only on documented instructions from the Customer, including transfers outside the UK, unless required to do so by UK law. Titus Telecom shall notify the Customer of such legal requirements unless prohibited on grounds of public interest.
3. Security
3.1 Titus Telecom shall implement appropriate technical and organisational measures designed to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction or damage, taking into account:
the nature of the processing,
the risks to the rights and freedoms of natural persons, and
the state of technological development and implementation costs.
3.2 Such measures may include, where appropriate:
industry‑standard encryption for data in transit;
access controls and authentication measures to restrict access to authorised personnel;
role‑based permissions and activity logging;
resilience and backup arrangements proportionate to the Services; and
security policies and staff confidentiality obligations.
3.3 The Customer acknowledges that:
(a) no service provider can guarantee absolute security;
(b) Titus Telecom’s security obligations apply only to systems, networks and environments under its direct control; and
(c) the Customer is solely responsible for the security of its own systems, devices, networks, authentication credentials, and any third‑party services not supplied by Titus Telecom.
3.4 Titus Telecom may update its security measures from time to time, provided that such updates do not reduce the overall level of protection for Customer Personal Data.
4. Personnel and confidentiality
Titus Telecom ensures that all persons authorised to process Customer Personal Data are subject to confidentiality obligations and appropriate training. V2.1
5. Sub‑processors
5.1 The Customer grants general authorisation for Titus Telecom to engage sub‑processors reasonably required for the provision, support and administration of the Services. These may include helpdesk/ticketing systems, billing and rating platforms, CRM systems, SIM‑management or provisioning systems, network monitoring tools, hosting providers and other telecommunications support systems.
5.2 Titus Telecom shall ensure that each sub‑processor is bound by written terms offering no less protection than those contained in this DPA.
5.4 Titus Telecom may update or replace sub‑processors at any time. Where a change materially affects the processing of Customer Personal Data, Titus Telecom will notify the Customer and the Customer may object only on reasonable data‑protection grounds.
6. Assistance to the Customer
Titus Telecom shall, taking into account the nature of the processing and the information available to it, assist the Customer in meeting the Customer’s obligations under the UK GDPR in respect of:
responding to requests from data subjects;
managing personal data breaches;
conducting data protection impact assessments; and
consulting with the Information Commissioner’s Office where required.
Such assistance shall be provided only to the extent reasonably required for compliance and may be subject to reasonable charges where the Customer’s requests are excessive or outside the scope of the Services.
7. Personal data breaches
Titus Telecom shall notify the Customer without undue delay after becoming aware of any personal data breach affecting Customer Personal Data and shall provide information reasonably required to assist the Customer in meeting its reporting obligations.
8. International transfers
Titus Telecom shall not transfer Customer Personal Data outside the UK unless appropriate safeguards are in place in accordance with Chapter V of the UK GDPR, including the UK International Data Transfer Agreement or Addendum as required.
9. Audits and information
Titus Telecom shall make available information necessary to demonstrate compliance with this DPA and shall permit audits on reasonable notice, during business hours, subject to confidentiality and security requirements. Remote audits or third‑party audit reports may be used where appropriate to minimise disruption. V2.1
10. Return and deletion
10.1 Upon termination or expiry of the Services, and at the Customer’s written choice, Titus Telecom shall either (a) return Customer Personal Data processed on behalf of the Customer, or (b) delete such data; in each case deleting any remaining copies unless UK law requires storage.
10.2 If the Customer does not request return within 30 days of termination, Titus Telecom may proceed to securely delete Customer Personal Data, subject to clause 10.3.
10.3 Titus Telecom may retain minimal copies where required to comply with legal, tax or regulatory obligations or to establish, exercise or defend legal claims, in which case processing will be limited to those purposes.
10.4 For clarity, Titus Telecom is not required to return operational data created by Titus Telecom in the operation, administration, security, monitoring, billing or support of the Services (including system logs, audit logs, diagnostic data, platform‑generated identifiers, and internal notes). Such data not containing Customer Personal Data may be retained in accordance with Titus Telecom’s legal and operational requirements.
11. Liability and order of precedence
The liability provisions of the Agreement apply equally to this DPA. In event of conflict between this DPA and the Agreement, this DPA shall prevail in relation to Customer Personal Data processing.
12. Definitions
“Customer Personal Data” means personal data processed by Titus Telecom on behalf of the Customer. “UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018. Other terms such as “controller”, “processor”, “processing”, “sub‑processor” and “personal data breach” have the meanings set out in the UK GDPR.
