Data Processing Agreement

How this document applies

This Data Processing Agreement (“DPA”) is incorporated into and forms part of the Sidekiq Terms of Service (the “Agreement”) between Sidekiq AI Ltd (“Sidekiq”, the “Processor”) and the Customer (the “Controller”). By accepting the Agreement, including by ticking the acceptance box at the point of purchase, the Customer agrees to the terms of this DPA. Where this DPA is referenced by a separately signed order form or service agreement, it forms part of that agreement in the same way. Capitalised terms not defined in this DPA have the meanings given to them in the Agreement.

1Definitions

In this DPA:

• “Applicable Data Protection Law” means the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and any other applicable data protection legislation in force from time to time in the United Kingdom.
• “Personal Data”, “Data Controller”, “Data Processor”, “Data Subject”, “Processing”, “Personal Data Breach” and “Supervisory Authority” have the meanings given to them in Applicable Data Protection Law.
• “Sub-Processor” means any third party appointed by the Processor to process Personal Data on behalf of the Controller under this DPA.

2Scope and Roles

The Controller determines the purposes and means of Processing of Personal Data. The Processor provides an AI-powered inbound call handling service, including call answering, recording, transcription, categorisation and summary delivery (the “Services”). In delivering those Services the Processor processes Personal Data on the Controller’s behalf, and does so solely in accordance with this DPA and the Agreement.

The details of the Processing, including the subject matter, duration, nature, purpose, types of Personal Data and categories of Data Subjects, are set out in Annex 1 (Details of Processing) to this DPA.

Personal Data is processed within third-party platforms that the Processor operates and manages under its own accounts, and within the Controller’s own systems where outputs of the Service (such as call summaries and email alerts) are delivered. Data held in Processor-managed platforms is retained and deleted in accordance with Clause 11.

3Processing Instructions

The Processor shall process Personal Data only on the documented instructions of the Controller, including with regard to international transfers, unless required to do so by applicable law. The Agreement, this DPA and the configuration agreed at setup constitute the Controller’s documented instructions.

• If the Processor is required by applicable law to process Personal Data other than on the Controller’s instructions, the Processor shall inform the Controller of that legal requirement before carrying out the Processing, unless prohibited by law from doing so.
• The Processor shall immediately inform the Controller if, in the Processor’s reasonable opinion, an instruction from the Controller infringes Applicable Data Protection Law.

4Confidentiality

The Processor shall ensure that all persons authorised to process Personal Data under this DPA, including employees, contractors and any other authorised personnel, are bound by appropriate obligations of confidentiality, whether by contract or by statutory duty. Access to Personal Data is limited to those persons who need access to perform the Services under the Agreement.

5Security

The Processor shall implement and maintain appropriate technical and organisational measures to protect Personal Data against unauthorised or unlawful Processing and against accidental loss, destruction or damage, appropriate to the risk and consistent with Applicable Data Protection Law.

• Access to Personal Data is limited to personnel who require it to deliver the Services, such personnel are subject to confidentiality obligations, and reasonable account and device security measures are used.
• The Processor shall regularly review and, where necessary, update its security measures to ensure ongoing appropriateness.

6Sub-Processors

The Processor uses a small number of Sub-Processors to deliver the Services: a voice AI platform (call handling, recording and transcription), a telephony provider (call routing) and a workflow automation platform (categorisation and delivery of summaries and alerts). A current list of Sub-Processors is available from billing@sidekiq.co.uk on request.

• The Controller provides general written authorisation for the engagement of these Sub-Processors.
• The Processor shall notify the Controller of any intended addition or replacement of Sub-Processors and give the Controller a reasonable opportunity to object on reasonable data protection grounds before the new Sub-Processor begins Processing.
• The Processor shall impose data protection obligations on any Sub-Processor it appoints that are no less protective than those set out in this DPA, and remains fully liable to the Controller for the performance of any Sub-Processor’s obligations under those terms.

7Assistance to the Controller

Taking into account the nature of the Processing and the information available to the Processor, the Processor shall provide reasonable assistance to the Controller with:

• responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law;
• the Controller’s obligations relating to the security of Processing where relevant;
• notifying Personal Data Breaches to the Information Commissioner’s Office (“ICO”) or other relevant Supervisory Authority;
• communicating Personal Data Breaches to affected Data Subjects where required by Applicable Data Protection Law;
• carrying out data protection impact assessments where required; and
• prior consultation with the ICO or other Supervisory Authority where required.

The Controller shall reimburse the Processor’s reasonable costs of providing such assistance where the assistance goes beyond what is required for the Processor’s own compliance obligations.

8Personal Data Breach

The Processor shall notify the Controller without undue delay, and in any event within 24 hours, upon becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA.

• The notification shall include, to the extent reasonably available: a description of the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it.
• The Processor shall cooperate with the Controller in investigating and mitigating the breach.

9International Transfers

The Processor shall not make a restricted transfer of Personal Data to any country or territory outside the United Kingdom except on the Controller’s documented instructions, and where the transfer is made in compliance with Applicable Data Protection Law and subject to appropriate safeguards where required.

10Audit

The Processor shall make available to the Controller, on reasonable request, information reasonably necessary to demonstrate compliance with this DPA.

• The Controller may conduct audits of the Processor’s compliance with this DPA on reasonable written notice during normal business hours and in a manner that minimises disruption to the Processor’s business, and no more than once per calendar year in the ordinary course.
• Notwithstanding the annual limitation, the Controller may request further information or exercise additional audit rights where reasonably required following a Personal Data Breach, a request or investigation by a Supervisory Authority, or any other serious compliance concern.
• The Processor shall cooperate with and provide reasonable assistance during any audit conducted under this clause.

11Data Return and Deletion

On termination or expiry of the Agreement, the Processor shall, at the Controller’s written election, return to the Controller all Personal Data processed on the Controller’s behalf that is held by the Processor, or delete all such Personal Data and confirm deletion in writing.

• The Processor shall delete existing copies of Personal Data unless applicable law requires retention. Personal Data remaining in Processor-managed platforms, together with any temporary exports or troubleshooting logs, shall be deleted within 90 days of termination. Where immediate deletion from backups or archives is not reasonably practicable, deletion shall occur on the next appropriate deletion cycle, provided the data remains protected and is not further used in the interim.
• For the avoidance of doubt, this clause does not require the Processor to delete or return outputs of the Service (such as call summaries and alerts) already delivered into the Controller’s own systems, where the Processor does not control retention.

12Liability

The liability of each party under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement, to the extent permitted by applicable law.

13Governing Law

This DPA shall be governed by and construed in accordance with the laws of England and Wales, consistent with the Agreement. Both parties submit to the exclusive jurisdiction of the courts of England and Wales.

Annex 1: Details of Processing

Subject matter of Processing

Operation of an AI Receptionist service answering inbound telephone calls on the Controller’s behalf, including call handling, recording, transcription, categorisation and delivery of summaries and alerts.

Duration of Processing

For the duration of the Agreement and the limited retention period thereafter set out in Clause 11.

Nature and purpose of Processing

Answering inbound calls to the Controller’s designated telephone lines using an AI voice agent; recording and transcribing those calls; extracting and categorising the caller’s details and enquiry; and delivering call summaries and alerts to the Controller by email or to the Controller’s designated systems.

Types of Personal Data

Callers’ names; telephone numbers; email addresses; voice recordings; call transcripts; the content of enquiries (which may include addresses, property details, tenancy or purchase circumstances); and any other personal data a caller chooses to share during a call.

Categories of Data Subjects

Individuals who call the Controller’s telephone lines, including the Controller’s clients, prospective clients, tenants, landlords, suppliers and other members of the public; and the Controller’s own personnel where they appear in calls or summaries.

Controller obligations and rights

The Controller remains Controller, determines the purposes of Processing, controls its own systems and accounts, and provides instructions to Sidekiq in connection with the Services. The Controller is responsible for ensuring it has a lawful basis for the Processing and for providing any notices required to callers, including that calls are handled by an AI assistant and are recorded.

Contact

Data protection enquiries: billing@sidekiq.co.uk
Sidekiq AI Ltd, C/O SGB Accountants, Sopers House, Sopers Road, Cuffley, EN6 4RY