Data Processing Addendum
Last updated: 17 July 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the Customer ("Controller") and Vyxr Labs FZE ("Processor") for Swan Power Dialer (the "Service"). It applies to the extent the Processor processes Personal Data on the Controller's behalf and where data protection laws such as the EU/UK GDPR apply. Capitalised terms not defined here have the meaning given in applicable data protection law.
1. Roles
The Controller determines the purposes and means of processing the contact data it uses in the Service. The Processor processes such Personal Data only on the Controller's documented instructions (including as set out in the Terms and this DPA) to provide the Service.
2. Subject-matter and details of processing
| Subject-matter | Providing the Swan Power Dialer service within the Controller's GoHighLevel account. |
|---|---|
| Nature & purpose | Applying tags, saving notes, and updating custom fields on contacts when a rep records a call disposition; authenticating users; producing minimised usage analytics. |
| Duration | For as long as the app is installed, plus the retention periods in the Privacy Policy. |
| Categories of data subjects | The Controller's contacts/leads and the Controller's own users (reps). |
| Categories of Personal Data | Contact identifiers (name, phone, email), tags, and custom-field values processed in transit; user name/email/role; sub-account identifiers. As stated in the Privacy Policy, the Processor does not retain contact note text or custom-field values at rest. |
3. Processor obligations
The Processor will:
- process Personal Data only on the Controller's documented instructions, unless required by law (in which case it will inform the Controller unless legally prohibited);
- ensure persons authorised to process Personal Data are bound by confidentiality;
- implement appropriate technical and organisational security measures (Section 5);
- taking into account the nature of processing, assist the Controller with responding to data-subject requests and with its obligations regarding security, breach notification and, where applicable, data protection impact assessments;
- notify the Controller without undue delay after becoming aware of a Personal Data breach affecting the Controller's data;
- at the Controller's choice, delete or return the Controller's Personal Data at the end of the provision of the Service, and delete existing copies unless retention is required by law.
4. Sub-processors
The Controller authorises the Processor to engage sub-processors to provide the Service. Current sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Railway | Application hosting and encrypted database | United States |
| HighLevel (GoHighLevel / LeadConnector) | Underlying platform and billing | United States |
The Processor will impose data-protection obligations on sub-processors substantially similar to those in this DPA and remains responsible for their performance. The Processor will give notice (e.g. by updating this page) of intended changes to sub-processors, and the Controller may object on reasonable data-protection grounds.
5. Security measures
- encryption of data in transit (TLS) and of access tokens at rest (AES-256-GCM);
- strict tenant isolation so a token or session for one sub-account cannot access another;
- data minimisation — contact note text and field values are not retained at rest;
- access controls, signed and verified webhooks, rate limiting, and logging;
- regular review of the above.
6. International transfers
The Processor operates from the UAE and uses sub-processors in the United States. Where transfers of Personal Data from the EEA/UK are subject to transfer requirements, the parties agree that appropriate safeguards (such as the European Commission's Standard Contractual Clauses, and the UK Addendum where relevant) apply and are incorporated by reference, with Vyxr Labs FZE as "data importer".
7. Audit
The Processor will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including by responding to reasonable written information requests, subject to confidentiality and no more than once per year absent a specific concern or legal requirement.
8. Controller responsibilities
The Controller warrants that it has a lawful basis and all necessary consents and rights for the Personal Data it processes through the Service, that its instructions comply with applicable law, and that it is responsible for the legality of its communications and contact of data subjects (see Terms, Section 5).
9. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms.
10. Term and contact
This DPA continues while the Processor processes Personal Data on the Controller's behalf. Data-protection queries: support@vyxrlabs.com, Vyxr Labs FZE, Sharjah Publishing City Free Zone, Sharjah, UAE.