Every question your procurement team will ask. Answered.

Lawful basis. For your callers’ data, you are the controller and Magixis is your processor: we process inbound-call data on your documented instructions under the signed DPA, with notification at the start of every call. Your usual lawful basis is Article 6(1)(f) — legitimate interest in operating an inbound phone line. Where calls touch special category data (health, legal), the Article 9 condition is yours as controller; our part is the safeguards — PII masking, UK/EU storage, and access that is capability-based and logged.

Consent script. Every Magixis agent reads a consent statement at the start of every call that conforms to ICO guidance: notification before the conversation begins, a clear statement of the purpose, and an alternative contact method offered if the caller refuses recording. The default script is:

• "You've reached [Client Name]. This is Magixis — calls are recorded for quality and training. If you'd prefer not to be recorded, please email us at [client@email] and we'll get back to you."

Retention. Default 30 days for recordings, 90 days for transcripts. Per-client retention overrides are supported up to 7 years (some sectors require this). Personal data within transcripts is automatically detected and redacted in the analytics layer; the original recordings retain everything but are access-restricted (logged, named-person access only).

Data subject access requests. We respond within 14 days (the regulation allows one calendar month). For a verified caller, we can produce every call they've made to a Magixis-protected number, the transcript, and the action taken — as PDF or structured JSON.

Right to erasure. A caller may request deletion of their recordings at any time. We action erasure requests within 7 working days and issue a deletion certificate. Some retention may be lawful (legal claims, fraud prevention) — we explain in writing in those cases.

Documents available on request:

• Privacy notice for end users (callers)
• Internal retention & deletion policy
• DSAR handling procedure
• Breach response playbook

Classification. Voice agents are "limited risk" under the EU AI Act. The transparency obligations under Article 50 apply. We meet them in three ways:

1. The agent identifies itself as "Magixis" at the start of every call.
2. If a caller asks directly whether they're speaking to a person, the agent answers truthfully: "No, I'm an AI assistant." It will not lie about this under any prompting.
3. The recording-consent script (above) gives callers an alternative contact route if they prefer human interaction.

Territorial scope. We apply Article 50 transparency to every call, wherever the caller is — EU-required or not. The UK has signalled it will broadly mirror the transparency requirements. We track quarterly and update this page when material guidance changes.

What we don't do. We do not use voice agents for cold outbound sales calls. We do not use them in ways that exploit cognitive vulnerabilities. We do not engage in any of the prohibited practices under Article 5. We will tell a prospective client "no" if they ask us to build something that would breach this.

Documentation we maintain:

• A list of all deployed agents and their classification
• The transparency disclosure for each agent
• An incident log if any agent ever deceives a user in a way that would breach Article 50

The current list of sub-processors. Last updated 15 August 2026. We notify clients at least 14 days before adding or replacing a sub-processor.

We do not transfer personal data outside the UK or EU. All compute, all storage, all inference happens in UK or EU regions of our infrastructure providers.

• Audio recordings: AWS S3 eu-west-2 (London), AES-256 at rest.
• Transcripts: Postgres on GCP europe-west2, encrypted at rest, TLS in transit.
• LLM inference: OpenAI EU (Dublin) and Anthropic EU instance. Both vendors contractually commit to keeping data in-region for inference and not training on our data.
• Voice synthesis & STT: ElevenLabs EU endpoint and Deepgram EU endpoint. Confirmed in writing in our contracts with both vendors.
• Email: Postmark EU instance.
• Cards (Stripe): Stripe handles card data under their PCI DSS Level 1 certification; we never touch card numbers.

If a US-hosted vendor were ever necessary for a particular feature, we would notify clients 14 days in advance with a written justification and an opt-out for the affected feature.

Hosting. Production compute runs on GCP europe-west2 with VPC isolation. Storage on AWS eu-west-2 with KMS encryption. Edge on Cloudflare with WAF rules tuned to our threat model.

Encryption. AES-256 at rest. TLS 1.3 in transit. Recordings additionally signed for tamper detection. Customer database fields containing PII (names, emails, phone numbers) are encrypted at the application layer in addition to disk encryption — a defence-in-depth measure for the catastrophic case where the database disk is exfiltrated.

Access control. All internal access via Cloudflare Access with SSO from a corporate Google Workspace. MFA enforced for every account. Production database access requires a temporary access token granted per-session and logged. Quarterly access audits published to clients on request.

Vulnerability management. Snyk for dependency scanning, CodeQL for static analysis, and weekly automated vulnerability scans against the public API. An external pen test by a UK-based testing firm is planned; we don’t yet run one.

SOC 2 readiness. We are not currently SOC 2 certified — at our size, the cost is disproportionate. Mapping every Trust Service Criterion to our existing controls is on our roadmap, and we expect to undergo SOC 2 Type II during 2027.

Breach response.

1. Detection. Cloudflare WAF + Sentry + our internal anomaly detection.
2. Containment within 1 hour. Affected accounts isolated, credentials rotated, traffic re-routed.
3. Internal review within 24 hours. Root cause, scope, affected data.
4. Client notification within 48 hours of identification.
5. ICO notification within 72 hours if reportable.
6. Post-incident report to clients within 14 days, including remediation.

We've not had a reportable breach. The playbook is live and rehearsed quarterly.

All policies are with Hiscox, broker-managed through Howden, and current to 2026. Insurance schedule is shareable under NDA.

• Professional Indemnity: £1,000,000 each and every claim.
• Public Liability: £1,000,000 each and every claim.
• Cyber Liability: £250,000 each and every claim, including data-recovery costs and third-party data-breach liability.
• Directors & Officers: £500,000.

Cover levels are reviewed annually against client portfolio size. We upgrade in line with the largest single contract value.

• Legal name: Magixis Limited
• Companies House: 17372370 · registered 31 July 2026
• Registered office: Bartle House, 9 Oxford Court, Manchester, M2 3WQ
• ICO Registration: ZC223083
• Trading name: Magixis
• Director: Arun Paul
• Data protection contact: trust@magixis.ai

Our standard MSA is written in plain English and is downloadable below. Notable terms:

• No contract in the lock-in sense: no minimum term, no exit fee. 30 days' notice to cancel on Pro and Command; on Lite, switch the agent off and billing stops.
• Limitation of liability: capped at 12 months of fees paid (standard for B2B SaaS in this size range).
• Jurisdiction: England & Wales.
• You own all custom builds. We retain the right to reuse generic patterns.

We are happy to sign your MSA if your legal team prefers.

Two policies, both downloadable. The website privacy policy covers visitors to the Magixis website (cookies, analytics). The end-user privacy policy is what end callers see — your customers calling your number — and is what you'd link in your own privacy notice when you adopt Magixis.

Our standard DPA is based on the ICO's recommended template with three modifications: (a) explicit sub-processor list incorporated by reference; (b) UK + EU jurisdiction clauses; (c) shorter notice periods for sub-processor changes (14 days vs. typical 30).

If your legal team needs modifications, send them with the questionnaire and we'll respond within one working day.