1. Roles
You (the client) are the controller of the personal data of your customers and enquirers (“Client Data”). We are your processor. This agreement meets the requirements of Article 28 of the UK GDPR.
2. What we process
Purpose: running the services in our terms, such as capturing enquiries into the client portal, instant AI replies, missed-call text back, follow-ups, meeting booking, review requests (sent the day after, a week after and two weeks after a job, and stopped when the customer replies), newsletters, tracking which enquiries came from ads, and reporting. Data: names, phone numbers, emails, postcodes and addresses, job details, messages, and call and booking times. People: your customers, enquirers and newsletter contacts. Duration: for as long as we provide the services, then as set out in section 9.
3. Your instructions
We only process Client Data on your documented instructions, which include these terms and how you set up the services. If we think an instruction breaks data protection law, we will tell you. We will tell you if the law requires us to process data in another way, unless the law forbids telling you.
4. Your responsibilities
You confirm you have a lawful basis to collect Client Data and to contact your customers through the services, including consent or an existing customer relationship for newsletters, and that your own privacy notice explains this. You must not ask us to send messages that break the Privacy and Electronic Communications Regulations, or to offer incentives for reviews or post reviews that are not genuine.
5. Confidentiality and security
Anyone who processes Client Data for us, including Archie May, is bound by confidentiality. We use appropriate security, including reputable providers, encryption where available, two-step login and limited access.
6. Sub-processors
You agree we may use sub-processors for hosting, call booking, text messages, AI messaging, email and newsletters, the client portal and file storage. We have written terms with each that protect Client Data to the same standard. We will tell you before adding or replacing a sub-processor, and you can object on reasonable data protection grounds.
7. Transfers outside the UK
Where a sub-processor processes Client Data outside the UK, we make sure it is covered by UK adequacy regulations or the ICO’s International Data Transfer Agreement or Addendum.
8. Helping you
We will help you, as far as we reasonably can, to respond to requests from people about their data, to keep data secure, and with any data protection impact assessment or ICO enquiry. We will tell you without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting Client Data.
9. When the services end
Within 30 days of the services ending, we will return Client Data to you in a common format if you ask, and then delete it, unless the law requires us to keep it. Records we need to work out commission during the attribution period may be kept for that purpose only.
10. Audits
We will give you the information you reasonably need to show we are meeting this agreement, and allow a reasonable audit once a year with 30 days’ notice, at your cost.
Questions about this page? Email alfiepurday2@gmail.com or call 07984 233163.