Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between OpsMind Technologies Ltd ("Processor") and the customer ("Controller"). It applies whenever OpsMind processes personal data on the Controller's behalf, and the Controller accepts it together with the Terms.

1. Roles and scope

For personal data the Controller uploads to, or generates in, its workspace, the Controller is the controller and OpsMind is its processor under Article 28 UK GDPR.

• Subject matter and purpose: providing the AI voice, chat and messaging service.
• Nature of processing: receiving, transcribing, answering, recording, storing and sending calls and messages, and storing the records that result.
• Duration: the term of the Terms of Service, and then until deletion under section 10.
• Data subjects: the Controller's callers, customers, contacts and users.
• Types of data: names, phone numbers, email addresses, voice recordings, message content, and anything the Controller's end users say or send.

2. Instructions

OpsMind processes Controller personal data only on the Controller's documented instructions, including its configuration of agents and including transfers to other countries, unless the law requires otherwise; in that case OpsMind tells the Controller first, unless the law forbids it. OpsMind tells the Controller straight away if it believes an instruction breaks data-protection law.

3. Sub-processors

The Controller gives general authorisation for the sub-processors listed in the Privacy Policy, which is Annex 1 of this DPA. OpsMind emails the Controller 30 days before adding or replacing one. The Controller may object on reasonable data-protection grounds; if the parties cannot resolve it, the Controller may terminate the affected service. OpsMind places data-protection obligations on each sub-processor and stays responsible for it.

4. International transfers

Controller personal data is processed outside the UK: on our main server in Palestine, by Google in the USA for live voice, and by the other sub-processors in the countries listed in Annex 1, which also shows the transfer safeguard for each. No UK adequacy regulations cover Palestine. Until OpsMind offers hosting in the EU, it does not take on Controllers whose data must stay within the UK or the EEA.

5. People

OpsMind ensures that only personnel who need access to run or support the Service can access Controller personal data, and that each of them is bound by confidentiality.

6. Security

OpsMind applies the measures described on the Security page, which is Annex 2 of this DPA, including the limits it states. OpsMind will tell the Controller before reducing any of them.

7. Personal-data breaches

OpsMind notifies the Controller without undue delay, and no later than 72 hours after becoming aware of a personal-data breach affecting the Controller's data. The notice gives the information Article 33(3) UK GDPR requires as it becomes available: what happened, roughly how many people and records are affected, a contact point, the likely consequences, and what is being done.

8. Help with requests and obligations

OpsMind helps the Controller answer data-subject requests, and with its duties on security, breach notification, impact assessments and consultation with the regulator, taking into account the information OpsMind holds. Transcripts, chats, audit logs, leads and contacts can be exported in the app. Other exports, and erasure of individual records, are done by OpsMind staff on the Controller's written request, in time for the Controller to meet its legal deadline.

9. Audits

Once a year, OpsMind answers a reasonable written security questionnaire from the Controller, and makes available the information needed to show compliance with this DPA. The Controller may also audit that compliance, remotely or on site, at its own cost, on 30 days' notice and under confidentiality.

10. Return and deletion

When the Terms end, OpsMind will, at the Controller's choice, return Controller personal data in a machine-readable format and/or delete it, including recordings, from the live system within 30 days, unless the law requires it to be kept. Backup copies expire within about 2 months.

11. Liability and order of precedence

This DPA is subject to the liability limits in the Terms. If it conflicts with the Terms on data protection, this DPA prevails.

12. Signed copy

A Controller that needs a signed copy can ask at hello@opsmind-tech.com. It is the same text, signed by both parties.

Questions about this document? Contact hello@opsmind-tech.com.

OpsMind Technologies Ltd · Registered in England & Wales · Company No. 16946193 · Registered office: 5th Floor, 167–169 Great Portland Street, London W1W 5PF, United Kingdom · Information Commission (ICO) registration ZC166859.