Convenience translation. Only the German version is legally binding.
Version of 03.10.2026. Applies to Business customers of Philoxa and is agreed by signing up as Business or booking a Business plan. On request we also send it signed: info@philoxa.com.
The processor is ELEFUN! Inh. Gülnur Hilâl Mert, Lindenstraße 8, 74232 Abstatt, Deutschland. The controller is the Business customer. The processor answers calls for the controller, answers questions based on the information stored by the controller, takes messages, callback and appointment requests and forwards them to the controller. The agreement applies for the term of the Business contract.
Data subjects are callers, customers and prospects of the controller. Processed are name, phone number, request, call content and summary, appointment requests and voice messages. Special categories under Art. 9 GDPR are not collected deliberately; if a caller mentions such data on their own, it is treated like all other data.
The processor processes the data only on documented instructions of the controller. Instructions result from the contract, the settings in the app and messages to info@philoxa.com. If the processor considers an instruction unlawful, it informs the controller without delay.
All persons with access to the data are bound to confidentiality.
The processor takes the technical and organisational measures under Art. 32 GDPR described in the annex and adapts them to the state of the art without lowering the level of protection.
The controller approves the following sub-processors: Hostinger International Ltd. (server in Frankfurt am Main), Anthropic PBC (AI language model, USA, standard contractual clauses), ElevenLabs Inc. (voice processing and telephony, USA, standard contractual clauses), Twilio Ireland Ltd. and Twilio Inc. (telephony and SMS, Ireland and USA, EU-US Data Privacy Framework). Notifications via Telegram or WhatsApp are only sent if the controller chooses that channel. New or changed sub-processors are announced at least 14 days in advance by email or in the app; the controller may object for an important data protection reason and in that case terminate the contract. Sub-processors are bound by equivalent obligations.
The processor assists the controller with requests from data subjects (access, rectification, erasure) and with its obligations under Art. 32 to 36 GDPR, as far as possible and reasonable.
The processor reports personal data breaches without undue delay, where possible within 24 hours of becoming aware, with the information available under Art. 33(3) GDPR.
After the end of the contract the processor deletes the data within 30 days unless there is a statutory retention obligation; before that the controller can export it in the app. Call transcripts at the voice provider are deleted after 30 days, audio of voice messages after conversion to text, backups after 14 days.
The processor provides the information needed to demonstrate compliance and allows audits by the controller or an auditor mandated by it after reasonable notice.
Liability is governed by Art. 82 GDPR, otherwise the terms and conditions apply. In case of conflict, this agreement takes precedence over the terms on data protection matters.