Legal
Subprocessor Schedule
Last updated: 27 August 2026
13 sections
This Subprocessor Schedule (the “Schedule”) forms part of the Faira Data Processing Agreement (“DPA”) between FAIRA PLATFORMS LTD (“Faira”) and the applicable Customer.
It identifies the third-party subprocessors that Faira may use to process Personal Data on behalf of its customers. Faira may update this Schedule in accordance with the change and objection provisions in the DPA.
| Subprocessor | Service / function | Personal Data potentially processed | Processing / hosting location |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud hosting, databases, storage and infrastructure | Customer records, communications, transcripts, workflow data, technical data and other Personal Data processed by the Faira platform | UK: UK region; EU: EU region; US: US region; Africa: US region |
| OpenAI | AI model infrastructure, including language and speech-related processing where applicable | Prompts, conversation content, transcripts, audio or other data submitted to AI functionality | Depends on Faira and OpenAI configuration and supported API data-residency options; US and/or EU processing may apply |
| Vapi | Voice AI orchestration and voice-agent infrastructure | Telephone numbers, call audio, transcripts, prompts, responses, call metadata and workflow information | Vapi processing locations applicable to the services and configuration used by Faira |
| Twilio | Telecommunications, telephone numbers, voice, call routing and communications infrastructure | Telephone numbers, call metadata, call audio and related communications data | UK, US and Europe; processing may also involve Twilio group infrastructure outside the primary service region |
| Africa’s Talking | Telecommunications and voice infrastructure | Telephone numbers, call metadata, call audio and related communications data | Nigeria and Kenya |
| Meta Platforms / Meta services | WhatsApp, Instagram, Facebook/Messenger and associated APIs | Messages, profile information, identifiers, attachments, communications metadata and other Meta Platform Data made available through authorised integrations | Meta’s applicable infrastructure and processing locations |
| Other infrastructure providers | Services necessary to operate, secure, monitor or support Faira | Limited technical, operational or Personal Data as necessary for the relevant service | As specified in the applicable provider’s terms and documentation |
Provider
Amazon Web Services, Inc.
Function
AWS provides Faira’s underlying cloud infrastructure, including:
- application hosting
- databases
- object storage
- networking
- backups
- infrastructure security
- related cloud services
Data processed
Depending on the Faira service used, AWS may process:
- customer account information
- customer records
- contact information
- communications
- voice transcripts
- workflow information
- integration information
- technical information
- logs
- other Personal Data processed through the Faira platform
Regional architecture
Faira’s intended AWS architecture is:
| Customer region | Primary AWS processing |
|---|---|
| United Kingdom | United Kingdom |
| European Union | European Union |
| United States | United States |
| Africa | United States |
Faira’s regional architecture does not mean that every ancillary service, operational log, support process or third-party integration necessarily remains within the same region.
Provider
OpenAI. OpenAI’s published documentation identifies OpenAI OpCo, LLC, OpenAI, LLC, OpenAI Ireland Ltd. and OpenAI UK Ltd. among its relevant entities, depending on the service and jurisdiction.
Function
Faira may use OpenAI services for AI functionality including:
- natural-language processing
- conversation understanding
- response generation
- classification
- summarisation
- speech-related processing
- other AI functionality
Data processed
Depending on the Faira feature, this may include:
- prompts
- conversation content
- transcripts
- customer-provided information
- AI outputs
- other information submitted to the applicable OpenAI API
Processing location
OpenAI currently provides data-residency options for eligible API customers, including US and European processing options, with additional regional at-rest residency options.
The applicable processing location will depend on:
- the OpenAI service used
- Faira’s configuration
- the applicable data-residency option
- the relevant OpenAI contractual arrangement
The existence of OpenAI UK Ltd. as a contracting entity does not mean that UK data is processed only, or always, within the United Kingdom. UK data may be processed in the United States, Europe or another supported location in accordance with the factors above.
OpenAI’s published DPA provides mechanisms for UK and EEA data transfers, including the UK Addendum and EU Standard Contractual Clauses where applicable.
Provider
Vapi
Function
Faira may use Vapi for:
- voice-agent orchestration
- real-time voice interaction
- call handling
- speech processing
- AI model orchestration
- related voice-agent functionality
Data processed
Depending on the Faira configuration, Vapi may process:
- telephone numbers
- call metadata
- audio
- transcripts
- prompts
- AI responses
- conversation history
- workflow information
- technical information
Processing location
Vapi processing locations applicable to the services and configuration used by Faira.
Provider
Twilio. The contracting Twilio entity depends on the customer’s jurisdiction. Twilio’s current terms identify Twilio Ireland Limited for customers domiciled or registered in the UK, EEA and certain other jurisdictions, while Twilio Inc. is used for many customers outside those jurisdictions.
Function
Faira may use Twilio for:
- telephone numbers
- voice calls
- call routing
- telecommunications
- messaging
- call metadata
- related communications infrastructure
Data processed
Depending on the service:
- telephone numbers
- caller and callee information
- call metadata
- audio
- communications content
- account information
- technical information
Processing location
Faira intends to use Twilio for the United Kingdom, the United States and Europe.
Twilio’s own documentation makes clear that its group infrastructure can involve US processing, while supported Regional Twilio products can store or process Customer Content in selected regions. Twilio also states that certain account and usage data continues to be processed in the US.
Provider
Africa’s Talking
Function
Faira may use Africa’s Talking for telecommunications and voice services in Nigeria and Kenya.
Data processed
Depending on the service:
- telephone numbers
- caller and recipient information
- call metadata
- voice and audio
- communications information
- technical information
Processing location
Nigeria and Kenya, subject to the infrastructure and services actually used by Faira.
Provider
Meta Platforms
Services
Faira may integrate with:
- WhatsApp Business Platform
- Facebook Pages
- Messenger
- associated Meta APIs and platform services
Function
Meta services enable Faira customers to:
- receive customer messages
- send permitted responses
- manage conversations
- connect business accounts
- receive messaging events
- automate supported customer communications
Data processed
Depending on the integration:
- name
- telephone number
- Meta user identifier
- profile information
- message content
- attachments
- timestamps
- conversation information
- page and account information
- other information made available through the relevant Meta API
Important role distinction
Meta may process information under its own terms and privacy framework.
Accordingly, Faira does not represent that Meta acts solely as Faira’s subprocessor for every aspect of Meta Platform Data. Where Meta independently determines the purposes and means of processing, Meta may act as an independent controller.
Faira’s role is limited to the processing and functionality performed by Faira in connection with the integration.
Faira may appoint additional subprocessors where necessary to:
- provide the services
- maintain infrastructure
- improve reliability
- provide security
- provide customer support
- introduce new functionality
- comply with legal or regulatory requirements
Faira will maintain an up-to-date version of this Schedule. Where required by the DPA, Faira will notify customers of material changes.
Where the DPA provides a right to object to a new subprocessor, Customer may object on reasonable data protection grounds.
An objection must:
- identify the relevant subprocessor
- explain the reasonable data protection concern
- be submitted within the applicable notice period
Faira will consider the objection in good faith. Where technically and commercially feasible, Faira may:
- offer an alternative configuration
- provide an alternative service
- implement additional safeguards
- take other reasonable steps to address the concern
If the parties cannot resolve the objection, the consequences will be handled in accordance with the DPA and Agreement.
Some Faira subprocessors may process Personal Data outside the United Kingdom or European Economic Area.
Where this constitutes a restricted international transfer, Faira will use an appropriate legal transfer mechanism. Depending on the circumstances, this may include:
- an adequacy decision
- UK International Data Transfer Agreement
- UK Addendum to the EU Standard Contractual Clauses
- EU Standard Contractual Clauses
- another lawful transfer mechanism
Faira will maintain appropriate transfer documentation where required.
Faira requires subprocessors to maintain appropriate technical and organisational security measures appropriate to the services they provide. Faira’s own security controls are described in its Security & Compliance documentation.
Where appropriate, Faira evaluates providers before onboarding them and may review:
- security documentation
- data protection terms
- subprocessors
- processing locations
- security certifications
- technical controls
- incident processes
- international transfer mechanisms
Technology providers may change their:
- legal entities
- infrastructure
- processing locations
- subprocessors
- security controls
- APIs
- contractual terms
Faira will update this Schedule where a change materially affects the Processing of Customer Personal Data and where notification is required by the DPA or Applicable Data Protection Law.
Questions concerning Faira’s subprocessors should be sent to compliance@getfaira.com.
FAIRA PLATFORMS LTD
Company number: 17059377