Data Processing Agreement

Schedule 1 to the Terms of Service · Version v1.0 · Last updated 29 October 2026

1. Parties and scope

1.1 This Data Processing Agreement ("DPA") is between the Customer (the "Controller") and YNT Advisory Ltd, trading as ansame, company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS] (the "Processor"). It forms part of the Agreement described in the Terms of Service and applies whenever the Processor processes Customer Personal Data on the Controller's behalf.

1.2 Words defined in the Terms have the same meaning here. "Customer Personal Data" means personal data in Customer Data, including Caller Data. "controller", "processor", "data subject", "personal data breach", "processing" and "special category data" have the meanings given in the UK GDPR. "Sub-processor" means a third party engaged by the Processor to process Customer Personal Data.

1.3 The details of the processing (subject matter, duration, nature, purpose, types of data and categories of data subjects) are set out in Annex 1.

2. Controller's obligations

2.1 The Controller is responsible for: (a) having a lawful basis, and where needed a condition for special category data, for the processing; (b) giving data subjects the information required by Articles 13 and 14 UK GDPR, including that calls are answered by AI and transcribed and, where the Controller has switched call recording on, recorded with the Caller's agreement; (c) the accuracy and lawfulness of the instructions and content it provides; and (d) responding to data subject requests, with the Processor's help under clause 7.

2.2 The Controller's instructions are: the Agreement, this DPA, the settings the Controller chooses in the Service (including Integrations it connects, webhooks and API keys it creates, and recipients it adds), and any further written instructions agreed by the parties.

3. Processing on instructions

3.1 The Processor will process Customer Personal Data only on the Controller's documented instructions, including about transfers outside the UK, unless required to do otherwise by UK law; in that case it will tell the Controller before processing, unless the law forbids this on important grounds of public interest.

3.2 The Processor will tell the Controller immediately if, in its opinion, an instruction breaks Data Protection Laws. It may suspend that processing until the instruction is confirmed or changed.

3.3 The Processor will not sell Customer Personal Data, use it for its own purposes (other than creating anonymised aggregate statistics as allowed by the Terms), or use it to train AI models.

3.4 Call recording. The Controller's choice of the call-recording setting is an instruction. With it off (the default), the Processor instructs its voice provider not to record call audio. With it on, the Processor (a) has Sophie ask each Caller at the start of the call whether the call may be recorded; (b) keeps the recording only if the Caller agrees; (c) where the Caller declines, does not clearly agree or ends the call before answering, deletes any audio captured from the voice provider's systems straight after the call and does not store it or make it available to the Controller; (d) records the Caller's answer against the call; and (e) deletes kept recordings 12 months after the call. Deletion from the voice provider is retried automatically if it fails.

4. Confidentiality

The Processor will ensure that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality and accesses it only as needed to provide, support and secure the Service.

5. Security

5.1 Taking into account the state of the art, the costs, and the nature, scope, context and purposes of the processing and the risks to data subjects, the Processor will implement appropriate technical and organisational measures to protect Customer Personal Data as required by Article 32 UK GDPR, including those in Annex 2.

5.2 The Processor may update those measures as long as the overall level of protection is not reduced.

6. Sub-processors

6.1 The Controller gives general written authorisation for the Processor to engage the Sub-processors listed in Annex 3.

6.2 The Processor will give the Controller at least 14 days' notice by email (or in the dashboard) before adding or replacing a Sub-processor. The Controller may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith; if it cannot be resolved, the Controller may end the affected part of the Service without penalty and receive a refund of any fees paid in advance for the period after termination.

6.3 The Processor will impose on each Sub-processor, by written contract, data protection obligations that give at least the same protection as this DPA (in particular sufficient guarantees of appropriate security measures), and remains liable to the Controller for each Sub-processor's performance of its obligations.

6.4 Where the Controller connects an Integration (such as Calendly, Google Calendar or Microsoft Outlook) or a webhook of its own, the provider of that Integration is engaged by the Controller, not by the Processor, and is not a Sub-processor.

7. Helping with data subject rights

7.1 Taking into account the nature of the processing, the Processor will help the Controller by appropriate technical and organisational measures, as far as possible, to respond to requests from data subjects to exercise their rights. On request, the Processor will find, export, correct or delete the records of a particular caller.

7.2 If the Processor receives a request directly from a data subject about Customer Personal Data, it will pass it to the Controller without undue delay and will not respond itself except to acknowledge it and redirect it, unless the Controller instructs otherwise.

8. Other assistance

Taking into account the nature of the processing and the information available to it, the Processor will help the Controller to meet its obligations under Articles 32 to 36 UK GDPR (security, breach notification, data protection impact assessments and prior consultation with the ICO). The Processor may charge reasonable costs for assistance beyond what is normally provided as part of the Service.

9. Personal data breaches

9.1 The Processor will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 The notice will describe, as far as then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information may be provided in stages.

9.3 The Processor will take reasonable steps to contain and remedy the breach and will co-operate with the Controller. Notifying the ICO and data subjects is the Controller's decision and responsibility, unless the law requires otherwise.

10. Deletion and return

10.1 When the Agreement ends, the Processor will, at the Controller's choice, return Customer Personal Data to the Controller (by export in a commonly used format, requested within 30 days of termination) and/or delete it, and will delete existing copies within 90 days, unless UK law requires it to keep them. Data in backups will be overwritten in the normal backup cycle and kept secure until then.

10.2 During the Agreement the Controller can delete bookings and quotes in the Service, and can ask the Processor to delete any other records (such as call records) at any time.

11. Records, information and audits

11.1 The Processor will keep a record of its processing activities as required by Article 30(2) UK GDPR.

11.2 The Processor will make available to the Controller all information reasonably necessary to demonstrate compliance with Article 28 UK GDPR, and will allow for and contribute to audits, including inspections, by the Controller or an auditor it appoints. Audits must be on at least 30 days' notice, during business hours, no more than once in any 12-month period (unless following a personal data breach or required by a regulator), at the Controller's cost, and subject to confidentiality. The Processor may first answer by written responses to reasonable questionnaires and by sharing its Sub-processors' certifications and reports (such as SOC 2 or ISO 27001).

12. International transfers

12.1 The Controller authorises the Processor and its Sub-processors to transfer Customer Personal Data outside the UK as needed to provide the Service, as described in Annex 3.

12.2 The Processor will ensure that every such transfer complies with Chapter V UK GDPR, by relying on UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or the ICO's International Data Transfer Agreement or International Data Transfer Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where required.

13. Liability and term

13.1 Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where the law does not allow it to be limited.

13.2 This DPA lasts as long as the Processor processes Customer Personal Data for the Controller. If it conflicts with the Terms, this DPA prevails for anything about personal data.

13.3 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1: Details of the processing

Subject matter

Providing the ansame AI receptionist service: answering and handling phone calls for the Controller, and the related dashboards, summaries, bookings, quotes, notifications, webhooks and API.

Duration

The term of the Agreement plus the period until deletion under clause 10.

Nature of processing

Receiving and connecting calls; real-time speech recognition, AI language processing and speech synthesis; transcribing calls; recording calls only where the Controller has switched call recording on and the Caller has agreed at the start of the call (otherwise deleting any audio captured); generating summaries, urgency flags, bookings and draft quotes; storing records; sending emails, webhooks and calendar entries; providing access in the dashboard and API; deletion.

Purpose

To answer the Controller's calls, take messages, book appointments, prepare draft quotes, tell the Controller about calls and urgent matters, and let the Controller manage its records.

Categories of data subjects

Callers (the Controller's customers, prospective customers, patients, residents and their relatives, suppliers and other members of the public), people mentioned in calls, and the Controller's staff whose details are given to Sophie (for example to pass on messages).

Types of personal data

Phone numbers; names; contact details (email, postal address); call audio recordings (only where call recording is on and the Caller agreed); the Caller's answer to the recording question; transcripts; summaries; reasons for calling and messages; appointment and booking details; job, property or service details; quote details; call metadata (date, time, duration, outcome).

Special category data

Not required by the Service, but callers may volunteer it, in particular health and care information when calling clinics, care homes or similar businesses. The Controller is responsible for having an Article 9 condition and appropriate safeguards. The measures in Annex 2 apply to all data, including this.

Frequency

Continuous, whenever the Controller's calls are handled by the Service.

Retention

For the term of the Agreement unless the Controller deletes records sooner or agrees a shorter retention period with the Processor; then deleted under clause 10. Call recordings: kept only where the Caller agreed, and deleted automatically 12 months after the call (or sooner as above). Where the Caller did not agree, no recording is kept: any audio captured is deleted from the voice provider straight after the call and is never stored by the Processor or made available to the Controller.

Annex 2: Technical and organisational security measures

• Encryption: all traffic to the Service uses HTTPS/TLS; data is stored with providers that encrypt it at rest.
• Access control: individual logins for every user; passwords stored only as salted PBKDF2 hashes; session tokens and API keys stored only as hashes; secure, HttpOnly session cookies; one-time, time-limited setup links.
• Separation: every record is tied to one business, and each business can access only its own records; this separation is covered by automated tests.
• Abuse protection: rate limits on logins, setup links, enquiries and the website reader; a spam trap on the public form.
• Integrity: webhooks are signed (HMAC) so receivers can verify them.
• Staff access: limited to people who need it to provide and support the Service, bound by confidentiality.
• Suppliers: Sub-processors are reputable providers with recognised security programmes and contractual data protection terms.
• Resilience: the Service runs on a distributed cloud platform; providers keep backups.
• Incident response: breaches are investigated, contained and notified under clause 9.
• Data minimisation: Sophie is instructed not to collect payment card details or passwords, and the Service only asks callers for what is needed to handle the call.

Annex 3: Authorised Sub-processors

Integrations the Controller chooses to connect (Calendly, Google, Microsoft, its own webhooks) are not Sub-processors (clause 6.4).

Back to the Terms of Service · Privacy Policy · Questions: hello@ansame.uk