Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, AuditSail's Terms of Service between AuditSail Limited and the Customer. The Customer accepts this DPA when it accepts the Terms of Service. This DPA applies only to the extent the Processor Processes Personal Data on the Controller's behalf as a processor in connection with the Services.
AUDITSAIL LIMITED ("the Processor") — company number 16979974, registered in England and Wales
and
the Customer identified in the Terms of Service ("the Controller")
DEFINITIONS
1.1 In this DPA, unless otherwise defined, capitalised terms have the meanings given in the Terms of Service.
1.2 The following additional definitions apply:
DEFINITIONS Term Definition "Controller" The Customer, being the Data Controller for the purposes of the Data Protection Legislation. "Data Protection Legislation" The UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (where applicable), and any successor or replacement legislation, in each case as amended from time to time. "Data Subject" An identified or identifiable natural person to whom Personal Data relates. "International Data Transfer Agreement" or "IDTA" The international data transfer agreement issued by the Information Commissioner under section 119A of the Data Protection Act 2018. "Personal Data" Any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the UK GDPR, that is Processed by the Processor on behalf of the Controller in connection with the Services. "Personal Data Breach" A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data, as defined in Article 4(12) of the UK GDPR. "Processing" Any operation or set of operations performed on Personal Data, as defined in Article 4(2) of the UK GDPR (and "Process" and "Processed" shall be construed accordingly). "Processor" AuditSail Limited, being the Data Processor for the purposes of the Data Protection Legislation. "Services" The services AuditSail provides to the Controller under the Terms of Service. "Sub-processor" Any third party engaged by the Processor to Process Personal Data on behalf of the Controller. "UK GDPR" The United Kingdom General Data Protection Regulation, as defined in section 3(10) of the Data Protection Act 2018. SCOPE AND ROLES
2.1 This DPA governs the Processing of Personal Data by the Processor on behalf of the Controller in connection with the provision of the Services under the Terms of Service, as described in Annex A. It applies only to the extent the Processor Processes Personal Data on behalf of the Controller; where the Services do not involve such Processing, this DPA imposes no obligations. The provisions and Sub-processors identified in Annexes A and B as applying only where call monitoring is enabled take effect automatically if and when the Controller enables that feature.
2.2 The Controller is the Data Controller and the Processor is the Data Processor for the purposes of the Data Protection Legislation.
2.3 This DPA does not apply to Processing carried out by AuditSail as an independent controller for AI model improvement and evaluation feedback, as described in the Terms of Service and in AuditSail's Privacy Policy. That Processing is governed by those terms and not by this DPA.
CONTROLLER OBLIGATIONS
3.1 The Controller shall determine the purposes and means of Processing of Personal Data and shall be responsible for compliance with the Data Protection Legislation as it applies to the Controller, including (without limitation) obligations under Articles 13 and 14 of the UK GDPR (transparency and fair processing information to Data Subjects).
3.2 The Controller warrants that it has a lawful basis for all Personal Data submitted to the Processor, and (where the Personal Data includes special category data) that it has satisfied a condition for processing under Article 9 of the UK GDPR.
3.3 The Controller shall ensure that its instructions to the Processor comply with the Data Protection Legislation. The Controller's instructions are deemed to be those set out in the Terms of Service, this DPA, and Annex A. Any instruction outside that scope requires the Processor's prior written agreement and may be subject to additional charges.
PROCESSOR OBLIGATIONS
The Processor shall:
- (a) Process Personal Data only on documented instructions from the Controller (being the instructions set out in the Terms of Service, this DPA, and Annex A), unless required to do so by applicable law, in which case the Processor shall (to the extent permitted by law) notify the Controller before carrying out such Processing. The Processor shall immediately inform the Controller if, in the Processor's opinion, an instruction infringes the Data Protection Legislation, and the Processor shall not be required to comply with any such instruction until the Controller confirms it in writing after being so informed;
- (b) ensure that all persons authorised to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
- (c) implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 of the UK GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects;
- (d) comply with the conditions for engaging Sub-processors set out in paragraph 5 of this DPA;
- (e) taking into account the nature of the Processing, assist the Controller in responding to requests from Data Subjects exercising their rights under Chapter III of the UK GDPR, primarily through the platform's existing search and download functionality and, where that is insufficient, by providing reasonable additional assistance taking into account the information available to the Processor. The Processor may charge a reasonable fee, notified in advance where practicable, for assistance beyond the platform's functionality, except where the assistance is required as a result of the Processor's own breach;
- (f) assist the Controller in ensuring compliance with the obligations under Articles 32 to 36 of the UK GDPR (security of processing, notification of Personal Data Breaches to the supervisory authority, communication of Personal Data Breaches to Data Subjects, data protection impact assessments, and prior consultation), taking into account the nature of Processing and the information available to the Processor. The Processor may charge a reasonable fee, notified in advance where practicable, for assistance under this paragraph that goes beyond the Processor's own compliance obligations, except where the assistance is required as a result of the Processor's own breach;
- (g) on termination or expiry of the Terms of Service, at the Controller's choice, delete or return the Personal Data and delete existing copies, unless storage is required by law. Where the Controller makes no such choice, the Processor will by default make all stored Personal Data available for export by the Controller for a period of thirty (30) days and will then securely delete all remaining Personal Data held in its capacity as Processor within thirty (30) days. This deletion obligation does not apply to Personal Data retained by AuditSail in its capacity as independent controller, which is not governed by this DPA. For the avoidance of doubt, data that has been anonymised and incorporated into aggregated datasets does not constitute Personal Data and is not subject to this deletion obligation; and
- (h) make available to the Controller all information reasonably necessary to demonstrate compliance with the obligations set out in this DPA, and allow for and contribute to audits in accordance with paragraph 8 of this DPA.
SUB-PROCESSORS
5.1 The Controller provides general written authorisation for the Processor to engage Sub-processors for the Processing of Personal Data. The Sub-processors approved as at the date of this DPA are listed in Annex B.
5.2 The Processor shall maintain and update the list of Sub-processors in Annex B. The Processor shall give the Controller reasonable prior written notice before engaging a new Sub-processor or replacing an existing one.
5.3 If the Controller does not accept a new or replacement Sub-processor notified under paragraph 5.2, the Controller's sole remedy is to terminate the Terms of Service by giving the Processor thirty (30) days' written notice. The Processor may proceed with the engagement of the new or replacement Sub-processor regardless of any such termination notice.
5.4 The Processor shall impose on each Sub-processor, by way of a written contract, data protection obligations no less protective than those set out in this DPA, to the extent applicable to the nature of the Processing carried out by that Sub-processor.
5.5 The Processor shall remain fully liable to the Controller for the performance of each Sub-processor's data protection obligations under this DPA.
PERSONAL DATA BREACH
6.1 The Processor shall notify the Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Personal Data Processed under this DPA. For the purposes of this paragraph, the Processor "becomes aware" when it has a reasonable degree of certainty that a Personal Data Breach has occurred; an unverified alert or suspicion that is still being assessed does not by itself constitute awareness.
6.2 The notification under paragraph 6.1 shall include such information about the Personal Data Breach as the Processor is reasonably able to provide at the time of notification, taking into account the information then available to the Processor. Where it is not possible to provide all information at the time of the initial notification, the Processor shall provide further information in phases without further undue delay.
6.3 The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation and remediation of any Personal Data Breach. The costs of any remediation steps that go beyond the Processor's own compliance obligations shall be at the Controller's cost.
INTERNATIONAL TRANSFERS
7.1 The Processor shall not transfer Personal Data outside the United Kingdom unless appropriate safeguards are in place in accordance with Chapter V of the UK GDPR, including (as applicable) an International Data Transfer Agreement, a UK adequacy decision, or another transfer mechanism permitted under Article 46 of the UK GDPR.
7.2 As at the date of this DPA, the Processor transfers Personal Data to, or makes it accessible from, the Sub-processor locations set out in Annex B. The transfer mechanism for each is set out in that Annex.
AUDIT
8.1 The Processor may satisfy any audit request under paragraph 4(h) by providing the Controller with a copy of a relevant third-party audit report or certification (SOC 2, ISO 27001, or equivalent).
8.2 If the Controller reasonably demonstrates that a report or certification provided under paragraph 8.1 does not address a specific compliance concern, the Controller may request an on-site audit, subject to all of the following conditions being met:
- (a) the Controller gives the Processor not less than thirty (30) days' written notice specifying the scope of the proposed audit;
- (b) the audit is limited to once per calendar year;
- (c) the audit is conducted during the Processor's normal business hours only;
- (d) the audit must not disrupt the Processor's operations or permit access to any other customer's data;
- (e) the audit is entirely at the Controller's cost, including the Processor's reasonable internal costs of facilitating the audit;
- (f) the Controller enters into a confidentiality agreement on reasonable terms before any audit begins; and
- (g) all audit findings and reports are the Processor's Confidential Information, save that the Controller may disclose them to its professional advisers and auditors (under confidentiality) and to a regulator or where required by law.
8.3 The Processor may object to any auditor that the Processor reasonably considers to be a competitor or otherwise conflicted, in which case the Controller shall appoint an alternative auditor.
DURATION AND TERMINATION
9.1 This DPA shall come into effect on the date of the Terms of Service and shall continue for the duration of the Terms of Service.
9.2 On termination or expiry of the Terms of Service, the Processor's obligations under paragraph 4(g) of this DPA shall apply.
9.3 Any provision of this DPA that expressly or by implication should survive termination or expiry of the Terms of Service shall continue in full force and effect.
LIABILITY
10.1 The liability of each party under or in connection with this DPA is subject to the limitations and exclusions set out in the Terms of Service.
GENERAL
11.1 This DPA forms part of the Terms of Service. In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail in respect of data protection matters relating to the provision of the Services.
11.2 This DPA is governed by the law of England and Wales and the parties submit to the exclusive jurisdiction of the courts of England and Wales.
11.3 Where the parties choose to sign a counterpart of this DPA (see the Incorporation section), it may be executed and delivered electronically (including by email in PDF) and in any number of counterparts, which together constitute one agreement.
ANNEX A – PROCESSING DESCRIPTION
Part 1 – General platform processing (all customers, to the extent submitted content contains personal data)
| Item | Detail |
|---|---|
| Subject matter | Processing of content the Controller submits to the platform for compliance review (for example marketing assets, ad copy, scripts) to the extent that content contains personal data. |
| Nature | Storage, automated analysis against the Controller's rules, scoring, and reporting. |
| Purpose | Provision of the Services under the Terms of Service. |
| Duration | Duration of the Terms of Service, plus the thirty (30) day post-termination export period and the thirty (30) day deletion period under paragraph 4(g). |
| Categories of Data Subjects | Individuals whose personal data is incidentally contained in the Controller's submitted content. |
| Categories of Personal Data | Personal data incidentally contained in submitted content (for example names, contact details, or other identifiers). |
| Controller's instructions | Process Personal Data solely to provide the Services as described in the Terms of Service. Any instruction outside this scope requires the Processor's prior written agreement. |
Part 2 – Call monitoring (only where the Controller enables call monitoring)
| Item | Detail |
|---|---|
| Subject matter | Processing of call recordings and related data for call-monitoring services. |
| Nature | Storage, transcription, automated analysis against the Controller's rules, scoring, and reporting. |
| Purpose | Provision of the call-monitoring Services under the Terms of Service. |
| Duration | As in Part 1. |
| Categories of Data Subjects | Callers to the Controller's call centres or call centre affiliates; the Controller's call centre staff and agents. |
| Categories of Personal Data | Call recordings (audio); call transcriptions (text); call metadata (date, time, duration, agent identifiers); compliance analysis outputs (scores, flags, rule matches). May incidentally include special category data (e.g. health, financial difficulty) and vulnerability indicators. |
| Controller's instructions | Process Personal Data solely to provide the call-monitoring Services as described in the Terms of Service. Enabling call monitoring constitutes the Controller's documented instruction to carry out this Processing, and the Controller's confirmation that it has a lawful basis (including any Article 9 condition where special category data may be present), has given any required recording notices, and authorises AssemblyAI as Sub-processor for transcription. Any instruction outside this scope requires the Processor's prior written agreement and may be subject to additional charges. |
ANNEX B – APPROVED SUB-PROCESSORS
Engaged for all processing
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure and hosting | UK hosting region; AWS Inc. is US-incorporated | UK Addendum to the EU SCCs |
| Google LLC | AI processing (compliance analysis) | USA | UK Extension to the EU-US Data Privacy Framework (UK Addendum to the EU SCCs as fallback) |
| OpenAI, Inc. | AI processing (fallback analysis) | USA | UK Addendum to the EU SCCs |
| AuditSail Pvt Ltd (AuditSail group company) | Software development, technical support, and platform operations | India | UK IDTA (intra-group) |
Engaged only where call monitoring is enabled
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| AssemblyAI, Inc. | Call transcription | USA | UK Extension to the EU-US Data Privacy Framework where certified, otherwise UK Addendum to the EU SCCs |
INCORPORATION
This DPA is incorporated into and forms part of the Terms of Service. The Customer accepts it by accepting the Terms of Service (including by electronic acceptance); no separate signature is required. A signed counterpart may be provided on request for customers who require one.