Data Processing Agreement

This agreement sets the UK GDPR Article 28 terms for the personal data we process on a Customer's behalf. It forms part of the Terms of Service, and a Customer accepts it by accepting the Terms.

1. Parties and scope

1.1 This agreement is between the Customer, as controller, and Pinnacle Crest Ltd, as processor. Terms defined in the Terms of Service have the same meaning here.

1.2 It applies to Customer Personal Data: the personal data in Customer Content, and the Viewer statistics, that we process on the Customer's behalf. It does not apply to data we process as a controller, which our Privacy Policy covers.

1.3 If the Customer acts as a processor for another controller, the Customer confirms that its instructions to us are authorised by that controller, and we act as its sub-processor.

1.4 For the processing of personal data, this agreement prevails over the Terms of Service. A transfer agreement under clause 9, where one applies, prevails over this agreement.

2. Definitions

2.1 "Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the UK GDPR.

2.2 "Customer Personal Data" has the meaning in clause 1.2. "Sub-processor" means a third party we engage to process Customer Personal Data. "IDTA" means the International Data Transfer Agreement, and "UK Addendum" the International Data Transfer Addendum to the European Commission's standard contractual clauses, both issued by the UK Information Commissioner.

3. Details of the processing

4. Customer's obligations

4.1 The Customer is responsible for the lawfulness of the processing it instructs. In particular, it must have a lawful basis, meet a condition under Article 9 of the UK GDPR for any special category data, give data subjects the information required by its Articles 13 and 14, and carry out any data protection impact assessment the law requires.

4.2 The Customer's documented instructions are: the Terms of Service, this agreement, and the Customer's own configuration and use of the Service, such as starting sessions, choosing languages, enabling premium voice, exporting and deleting. Further instructions must be agreed in writing and may be charged for.

5. Our obligations

5.1 We process Customer Personal Data only on the Customer's documented instructions, including for international transfers, unless UK law requires otherwise. In that case we tell the Customer first, unless that law forbids it.

5.2 We tell the Customer if, in our opinion, an instruction infringes Data Protection Law. We are not obliged to give legal advice.

5.3 Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.

5.4 We implement the technical and organisational measures in Annex 1. We may update them, provided the overall level of protection does not decrease.

5.5 We do not sell Customer Personal Data, use it for our own purposes, or use it to train machine-learning models. The only exceptions are measuring usage volumes for billing, keeping the Service secure and complying with the law, which we do as a controller under our Privacy Policy.

5.6 Taking into account the nature of the processing and the information available to us, we assist the Customer with its obligations under Articles 32 to 36 of the UK GDPR: security, breach notification, impact assessments and prior consultation.

6. Sub-processors

6.1 The Customer gives us general written authorisation to engage the sub-processors in our sub-processor list, which we provide on request, as at the date the Customer accepts the Terms.

6.2 We give at least 30 days' notice before a new or replacement sub-processor starts processing Customer Personal Data. We do this by updating the sub-processor list and emailing the Account owner.

6.3 The Customer may object on reasonable data protection grounds during the notice period. The parties will discuss the objection in good faith. If it cannot be resolved, the Customer may terminate the affected Subscription as its sole remedy, and we refund prepaid Fees for the period after termination.

6.4 Where an urgent replacement is needed for security or continuity of the Service, we may make it immediately and notify the Customer promptly afterwards. Clause 6.3 still applies.

6.5 We impose on each sub-processor, by written contract, data protection obligations that are no less protective than those in this agreement. We remain responsible to the Customer for each sub-processor's performance of those obligations, subject to clause 12.

7. Data subject requests

7.1 If a data subject contacts us about Customer Personal Data, we do not answer the request ourselves, except to direct them to the Customer. We pass the request to the Customer without undue delay.

7.2 Taking into account the nature of the processing, we help the Customer respond to requests, by appropriate technical and organisational measures where possible. The dashboard lets the Customer view and export session records. We delete session data on the Customer's written request.

7.3 We may charge reasonable costs for assistance beyond the Service's self-service features, where the law allows.

8. Personal data breaches

8.1 We notify the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

8.2 The notice describes, as far as known: the nature of the breach, including the categories and approximate numbers of data subjects and records concerned; its likely consequences; the measures taken or proposed; and a contact point. Information we do not yet have may follow in stages.

8.3 We take reasonable steps to contain, investigate and mitigate the breach.

8.4 The Customer is responsible for any notification to supervisory authorities and data subjects. A notice from us is not an admission of fault or liability.

9. International transfers

9.1 The Customer authorises transfers of Customer Personal Data to the sub-processors outside the UK shown in our sub-processor list, provided a safeguard under Chapter V of the UK GDPR is in place.

9.2 Transfers to the European Economic Area rely on the UK's adequacy regulations. For other transfers to sub-processors, we rely on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US providers, or on the IDTA or the UK Addendum.

10. Return and deletion

10.1 During the term, the Customer can export session transcripts from the dashboard and can ask us in writing to delete session data.

10.2 When the Terms of Service end, the Customer may ask for an export of Customer Personal Data within the following 30 days. At the end of those 30 days we delete Customer Personal Data, unless UK law requires us to keep it. Copies in backups are deleted as the backups are overwritten, within a further 30 days.

10.3 On request, we confirm the deletion in writing.

11. Information and audits

11.1 We make available the information needed to demonstrate compliance with Article 28 of the UK GDPR: this agreement, Annex 1, the sub-processor list, and written answers to one reasonable security questionnaire a year.

11.2 If that information is not sufficient, or a supervisory authority requires it, the Customer may audit our compliance with this agreement. The audit is carried out by the Customer or by an independent auditor who is bound by confidentiality and is not our competitor. It requires at least 30 days' notice, takes place during business hours, happens no more than once in any 12 months, gives no access to other customers' data, and follows our security policies. The Customer bears its own costs and pays our reasonable costs of supporting the audit.

11.3 For sub-processors, we may rely on their independent certifications and audit reports.

12. Liability

Each party's liability under this agreement is subject to clause 17 of the Terms of Service, to the extent the law allows. Nothing in this agreement limits any data subject's rights under Article 82 of the UK GDPR.

13. Duration

This agreement lasts for as long as we process Customer Personal Data. Obligations of confidentiality and deletion continue after it ends.

14. Changes

We may change this agreement where the law, a supervisory authority or a change to the Service requires it. We give at least 30 days' notice of any change that adversely affects the Customer, who may terminate the affected Subscription before the change takes effect.

Annex 1: Technical and organisational measures

Annex 2: Sub-processors

The sub-processors authorised under clause 6 are those in our sub-processor list, which we provide on request from [email protected].