Data Processing Agreement

1. Subject Matter

This Data Processing Agreement (“DPA”) governs the processing of personal data of the Customer’s contacts, leads, and clients by the Provider on behalf of the Customer, in connection with the provision of the Virtual Employees service.

2. Duration

This DPA is effective for the duration of the Customer’s Subscription and until deletion completes under clause 6.8 — a 30-day export window, then at least 14 days’ written notice before deletion. It said “30 days thereafter”, which ended the DPA two weeks before the data it governs is actually erased.

3. Nature and Purpose of Processing

The Provider processes personal data to:

• Generate AI-assisted message responses and reply drafts on behalf of the Customer
• Handle scheduling, calendar management, and appointment booking
• Log and manage conversation history for context continuity
• Route and classify inbound messages
• Assist with lead follow-up and CRM-adjacent tasks as configured by the Customer

Processing is automated. The Customer remains solely responsible for the decisions made using AI-generated output.

4. Types of Personal Data Processed

• Names and contact details (email, phone, social media handles)
• Message content and conversation history
• Scheduling preferences and appointment information
• Business context shared by the data subject in conversation
• The Customer’s own staff: names, shift rotas, clock-in, break and worked-time records, corrections made to those records and who made them, and the hashed PIN used at the tablet

Special-category data is not permitted without prior written agreement with the Provider — the same condition stated in Terms §4 and AUP §2.4. The Customer must also have obtained explicit consent from the data subjects. Processing health, biometric, political, racial/ethnic, religious, sexual orientation, trade union, or criminal record data requires a separate addendum.

Exception — booking allergy information. Allergy and dietary information that a data subject volunteers through the Service’s booking features may be processed without a separate addendum, on these conditions: the data subject supplies it themselves for the purpose of being served safely (the Customer remains responsible for its lawful basis under Article 9(2) UK GDPR); it is used for no other purpose; it is erased or redacted alongside the rest of the subject’s data on erasure requests; and it is never used for profiling or marketing.

Exception — treatment enquiries volunteered by the data subject. Where the Customer operates a clinic, salon or similar service, health information that a data subject volunteers in the course of enquiring about, or booking, a treatment (for example a skin concern, a contraindication, or a medication they are taking) may be processed without a separate addendum, on these conditions: the data subject supplies it themselves, unprompted by any request for a medical history; it is used only to answer the enquiry, route it to the right person, and deliver the service; it is never used for profiling, marketing, or automated decision-making producing legal or similarly significant effects; it is erased or redacted alongside the rest of the subject’s data on an erasure request; and the Customer remains the controller, responsible for its lawful basis under Article 9(2) UK GDPR (ordinarily explicit consent). The Service does not provide medical advice and does not promote prescription-only medicines.

5. Categories of Data Subjects

• The Customer’s leads and prospects
• The Customer’s existing clients and customers
• Any individual who initiates contact with the Customer’s Virtual Employees
• The Customer’s own staff, where the Customer uses the rota, tablet sign-in and hours features

Children’s data (under 13) is prohibited. The Customer must ensure Virtual Employees are not accessible to children.

6. Obligations of the Processor

6.1 Documented instructions

The Provider shall process personal data only on documented instructions from the Controller. The Customer’s configuration of Virtual Employees (system prompts, integrations, FAQ content) constitutes documented instructions. The Provider will notify the Customer if it believes any instruction infringes UK GDPR.

6.2 Confidentiality

All Provider personnel with access to Customer personal data are bound by confidentiality obligations (contractual or statutory).

6.3 Security

The Provider implements appropriate technical and organisational measures per Article 32 UK GDPR, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, and regular security reviews. See our Security Statement at /legal/security for details.

6.4 Sub-processors

The Customer provides general written authorisation for the Provider to use sub-processors. The current sub-processor list is at /legal/sub-processors. The Provider will give 30 days’ notice of any new sub-processor. If the Customer objects, they may terminate with written notice during the 30-day period.

6.5 Data subject rights

The Provider will assist the Customer in responding to data subject rights requests (access, rectification, erasure, restriction, portability, objection) through the tools available at /dashboard/privacy/requests. The Provider cannot respond directly to data subjects on the Customer’s behalf without the Customer’s authorisation.

6.6 Security and DPIA assistance

The Provider will assist the Customer in fulfilling obligations under Articles 32–36 UK GDPR (security, breach notification, DPIAs) by providing relevant documentation on request.

6.7 Breach notification

The Provider will notify the Customer without undue delay (and no later than 48 hours after becoming aware) of any personal data breach affecting the Customer’s data, providing sufficient information to enable the Customer to meet their 72-hour ICO notification obligation.

6.8 Deletion or return

On termination of the Subscription, the Customer has 30 days to export their data using the dashboard export tool. After the export window the Provider gives at least 14 days’ written notice, and then deletes all Customer personal data — 44 days after cancellation in total, which is what the Privacy Policy’s retention table publishes and what the retention job does. Records retention required by law is excepted (invoice records retained 6 years for HMRC).

6.9 Audit

The Provider will make available to the Customer all information necessary to demonstrate compliance with this DPA and will permit reasonable audits by the Customer or an appointed auditor. In practice, audits are conducted by questionnaire. Where the Provider holds a current SOC 2 or ISO 27001 attestation, providing that report satisfies the audit obligation for the matters it covers.

7. International Transfers

Where personal data is transferred outside the UK (primarily to US-based sub-processors), the Provider relies on Standard Contractual Clauses with the UK Addendum as the lawful transfer mechanism. These flow down to sub-processors via their respective DPAs listed at /legal/sub-processors.

8. Sub-processor List

Current sub-processors are listed at /legal/sub-processors. The Provider will update this list and notify the Customer 30 days before adding any new sub-processor.

9. Liability

The Provider’s liability under this DPA is subject to the same cap as under the Terms of Service (the greater of fees paid in the prior 12 months or £1,000). Each party is liable to the other and to data subjects only for the damage caused by the breach of its own obligations under this DPA.

10. Governing Law

This DPA is governed by the laws of England and Wales.

11. Effective Date and Acceptance

This DPA is effective from the date the Customer creates an account. Acceptance is captured electronically at the time of account creation. The Provider maintains records of all acceptances including timestamp, IP address, and document version.