Data processing agreement

1. Parties and roles

The customer named on the account is the business (California's word) or controller (UK GDPR's word): it decides why and how customer content is used. DT Global Ventures Ltd is its service provider or processor. For the customer's own account details (name, email, billing, the consent record) we decide the purposes ourselves under the privacy notice, and this agreement does not apply to them. Where the customer is itself a service provider or processor for someone else (for example, an agency acting for its clients), we are a sub-processor and the customer confirms it has the authority to appoint us.

2. What is processed, and why

The details also set out as a table in Annex 1.

• Subject matter: Providing an assistant that the customer reaches by phone and that reads and, on confirmation, writes to the customer's connected inbox, calendar and CRM.
• Duration: The life of the account plus the deletion periods in section 10.
• Nature and purpose (the specific business purposes): Transcribing and understanding the customer's spoken requests; reading connected accounts to answer them; drafting replies, notes, entries and invitations; sending, booking and logging only after the customer's confirmation; calling and texting the customer with briefs, alerts and summaries at times they set and with the consent in the terms; remembering the customer's working context between calls; keeping an audit log; keeping the service secure. Nothing else.
• Types of personal information: Call audio and transcripts; names, email addresses, phone numbers, job titles, organizations, calendar entries, correspondence content, CRM records (contacts, deals, notes, amounts), documents the customer asks about, web research results; the audit log; the assistant's memory of the customer's work.
• Sensitive or special category data: Not sought and not needed. It may appear incidentally in correspondence (for example, a client mentioning a health condition); the customer is responsible for having the right to hold it, and we process it only as part of the correspondence it sits in.
• Whose data it is: The customer's staff who use the service; the customer's clients, prospects, suppliers and contacts; anyone who emails the customer or appears in their calendar or CRM; anyone the assistant calls at the customer's request.

3. Instructions, and the service-provider terms

We process customer content only on the customer's documented instructions. The customer's instructions are: these terms and this agreement; the settings on the customer's account (which accounts are connected, which permissions are granted, the retention periods chosen on Team); the customer's spoken requests on calls; and each confirmation given under the confirmation rule, which is recorded in the audit log with the words that gave it.

Then the commitments California's regulations require of a service provider, written as promises and applied to every customer wherever they are:

• We process customer content only for the specific business purposes in section 2, and never for any other commercial purpose of our own.
• We do not sell customer content and we do not share it for cross-context behavioral advertising.
• We do not retain, use or disclose customer content outside our direct relationship with the customer, or for any purpose other than those business purposes.
• We do not combine customer content with personal information we receive from anyone else, or collect ourselves, except as the law allows for the purposes in section 2 (for example, to keep the service secure).
• We never use customer content to train or improve AI models, ours or any provider's.
• We comply with the privacy laws that apply to us and give customer content the same level of protection those laws require of the customer.
• We tell the customer, without undue delay (promptly, and without waiting for a convenient moment), if we decide we can no longer meet these obligations, and the customer may then take reasonable steps to stop and remedy any unauthorized use, including ending the contract under section 13.
• We tell the customer if we believe an instruction breaks a privacy law that applies to it.
• We pass every obligation in this agreement down to each sub-processor in a written contract (section 6).
• We help the customer answer requests from the people whose data it is (section 8), and we allow the audits in section 11.

4. Confidentiality of our people

Only staff and contractors who need access to provide support or run the service have it, under written confidentiality obligations, and every access to customer content by a person is itself logged. At launch that is the founder and no one else; the sentence stays true as the team grows because the log makes it checkable. Our people work from the United Kingdom; their access is to the US-hosted systems described in section 7.

5. Security measures

Summarized here, listed in Annex 2 and described in full on our security page: encryption in transit on every connection and at rest for every store; connected-account keys stored under a per-account key beneath a separate master key and never available to the AI model; PIN with lockout and step-up by one-time code or call-back for sensitive actions; the confirmation rule enforced by a non-AI component with single-use, time-limited confirmations; least-privilege permissions requested in stages; an append-only audit log; daily scheduled deletion; backups encrypted and purged within 30 days of the live deletion; no customer content used in testing; providers under written contracts with no-retention and no-training terms; a data protection impact assessment completed before customer content is processed and reviewed on material change, summary available on request; a responsible-disclosure process. We may improve these measures but not reduce the level of protection.

6. Sub-processors

The customer gives general written authorization for the sub-processors listed below. We give at least 30 days' notice by email before adding or replacing one. The customer may object in writing within that period on reasonable privacy or security grounds; if we cannot resolve the objection, the customer may end the contract and we refund the unused part of any period paid for. Each sub-processor is bound by a written contract imposing the same obligations as this agreement, including the service-provider terms in section 3, no retention beyond what is needed to provide its service and no training on customer content. We remain responsible to the customer for them.

The list, by category, naming the current provider, what it processes and where. This table is the authoritative list; the one on our security page matches it.

Not sub-processors: Microsoft, Google, HubSpot, Pipedrive and Salesforce (the customer's own systems, connected by the customer under the customer's agreements with them); Stripe (responsible in its own right for payments and sales tax at checkout; never sees customer content); the website analytics provider (processes no customer content and no personal information).

7. Where customer content is processed, and transfers

The service is US-hosted: customer content is hosted and stored in the United States, call audio passes through the telephony provider's US region, and speech recognition, speech synthesis and the AI model are provided from the United States. For a US customer there is no transfer of customer content out of the United States except that our own staff, in the United Kingdom, may access the US-hosted systems for support and operations under section 4. We will not move customer content to any other country without updating this agreement and giving the notice in section 6. We do not state or imply that customer content stays in the United States alone; a provider may route part of its work through another region, and the table in section 6 names who does what. For UK and EEA customers, whose data leaves the United Kingdom or the EEA to reach the United States, the transfer terms are in the annex.

8. Helping the customer

We help the customer meet its own obligations:

• Requests from the people whose data it is. We forward any request we receive to the customer within two business days, and provide the customer with the tools to export, correct and delete without our involvement, so most requests can be answered inside the 45 days the state laws allow.
• Risk and impact assessments and consultations with a regulator. We provide the information in this agreement and on our security page, and answer reasonable further questions in writing.
• Security of processing. The measures in section 5.

9. Security incidents and personal data breaches

We tell the customer without undue delay after becoming aware of a security incident affecting customer content, and in any case within 48 hours of becoming aware, by email to the account's address and, for Team and Enterprise, to the named security contact. The notice includes what we know, the likely consequences, what we have done and what we recommend, and is updated as we learn more. We keep a record of every incident.

The duty to notify affected people or a state attorney general under a state breach-notification law, or the ICO under UK GDPR, is the customer's as the business or controller; we give the customer what it needs to do so, and we do not notify a regulator or an affected person on the customer's behalf unless the customer asks or the law requires it.

10. Retention, return and deletion

The numbers, identical to our security page and the privacy notice: call audio 30 days; transcripts 90 days; drafts 30 days after sent or canceled; the audit log for the life of the account plus 30 days; memory for the life of the account; mail, calendar and CRM content read over the live connection for the call and not copied as a mailbox store. They are also set out in Annex 4.

On the Team plan the customer may set shorter or longer periods for audio and transcripts within the range offered in the admin console; on Enterprise, long-term archiving and legal hold may be agreed in writing.

At the end of the contract, the customer may export transcripts, the audit log and memory in a readable format from the account page; we then delete all customer content on the schedule above (and sooner on request), and from backups within a further 30 days, and confirm deletion in writing on request. When a Team seat is removed, that seat's content is deleted on the same schedule. We keep nothing except what the law requires us to keep (invoices, not content).

11. Audits and information

We make available the information needed to show that we meet this agreement: this agreement, our security page, the DPIA summary, the sub-processor contracts' relevant terms, and, for Enterprise customers, the SOC 2 report under a non-disclosure agreement (see our security page). The customer, or an independent auditor the customer appoints and we do not reasonably object to, may audit our compliance once in any 12 months on 30 days' written notice, during business hours, without disrupting the service, under confidentiality, at the customer's cost, and more often after an incident affecting that customer. Where a recognized third-party report covers the question, we may provide it instead of an on-site audit. (The once-every-12-months right is the one California's regulations require a service-provider contract to grant.)

12. Liability

Each party's liability under this agreement is subject to the liability clause of the terms (section 17). Nothing in this agreement limits liability that cannot be limited by law.

13. Term and changes

This agreement applies from the moment the customer connects a first account and lasts until all customer content is deleted. We may update it to reflect changes in the law, in regulators' guidance, or in the service, with at least 30 days' notice by email; a change that reduces the customer's protection gives the customer the right to end the contract under the terms, section 22. The version number and date at the top identify the applicable version; previous versions are available on request.

14. Governing law

The law of England and Wales; the courts of England and Wales have exclusive jurisdiction, as in the terms, section 25, and subject to the same sentence preserving rights a US customer's state law does not let it give up.

Privacy law means, for a US customer, the California Consumer Privacy Act as amended and its regulations and the comprehensive privacy laws of the other states as they apply to the customer; for a UK customer, the UK GDPR and the Data Protection Act 2018; and, where the customer is established in the European Economic Area, the EU GDPR as well. The agreement is to be read so as to satisfy each of them.

15. Contact

For this agreement, for requests from the people whose data it is, and for incidents and security questions, send us a message and choose "Security or data protection". Postal notices go to the registered office in the company block at the foot of this page.

Annexes 1 to 5

Annex 1: Details of processing

Annex 2: Security measures

• Encryption in transit on every connection and at rest for every store.
• Connected-account keys stored under a per-account key beneath a separate master key, and never available to the AI model.
• A PIN with lockout, and step-up by one-time code or call-back for sensitive actions.
• The confirmation rule, enforced by a non-AI component with single-use, time-limited confirmations.
• Least-privilege permissions, requested in stages.
• An append-only audit log.
• Daily scheduled deletion.
• Backups encrypted, and purged within 30 days of the live deletion.
• No customer content used in testing.
• Providers under written contracts with no-retention and no-training terms.
• A data protection impact assessment completed before customer content is processed and reviewed on material change; summary available on request.
• Every access to customer content by a person is logged.
• A responsible-disclosure process.

Annex 3: Sub-processors

The sub-processor table in section 6.

Annex 4: Retention

Annex 5: Team and Enterprise settings

For Team and Enterprise customers only, completed at set-up: the customer's chosen retention settings and the named security contact.

Annex 6: UK and EEA customers

For a customer established in the United Kingdom (and, where it applies, the European Economic Area), this annex makes the agreement an Article 28 UK GDPR agreement.

• Roles. The customer is the controller; DT Global Ventures Ltd is the processor; sub-processor where the customer is itself a processor; independent controller for account data under the privacy notice.
• Article 28(3) terms. Documented instructions (section 3, including spoken requests and confirmations recorded in the audit log); confidentiality of personnel (section 4); Article 32 security measures (section 5 and Annex 2); sub-processor general authorization with 30 days' notice and the right to object and terminate (section 6); assistance with data subject rights, DPIAs and prior consultation with the ICO (section 8); personal data breach notice without undue delay and within 48 hours (section 9); deletion or return at the end of the services with written confirmation on request (section 10); information and audit rights (section 11). Where the EU GDPR applies, the same sections satisfy Article 28 of the EU GDPR.
• International transfers. The service is US-hosted, so customer content is transferred from the United Kingdom to the United States, to us and to each provider on the sub-processor list. For each transfer to a country without a UK adequacy decision we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, entered into with that provider, together with a transfer risk assessment that we review yearly and on material change; the provider commits not to retain customer content beyond providing its service and not to train on it. For an EEA customer the EU Standard Contractual Clauses apply in the same way. Copies of the executed transfer terms are available on request.
• Data protection law in this annex means the UK GDPR and the Data Protection Act 2018, and, for an EEA customer, the EU GDPR.
• Regulator. The Information Commissioner's Office; our registration details are in the privacy notice.