Data processing agreement
This agreement forms part of our customer terms between [company name], trading as Virtualized (the processor), and the business using Virtualized (the controller). It meets the requirements of Article 28 of the UK GDPR.
1. Details of the processing
| Subject and purpose | Running an AI chat assistant on the controller's website: answering visitors, passing on their enquiries, and keeping records the controller can review. |
|---|---|
| Duration | For as long as the controller uses Virtualized, plus up to 30 days for deletion afterwards. |
| Nature of processing | Receiving, storing, analysing with an AI model, displaying, emailing and deleting; on the Business plan, also converting visitors' voice recordings to text and replies to speech. |
| Data subjects | Visitors to the controller's website who use the chat. |
| Personal data | Chat messages; name, phone number and email address when given; a summary of the enquiry; the page the chat started on; the visitor's language; on the Business plan, voice recordings, which are passed on for conversion to text and not stored. IP addresses are used briefly for abuse prevention and not stored. |
| Special category data | Not intended. The controller must not use the chat to collect it. |
2. Processor's obligations
The processor will:
- process the personal data only on the controller's documented instructions, which are these terms and the controller's settings in the dashboard, unless the law requires otherwise, in which case it will tell the controller first unless the law prohibits that;
- ensure that people authorised to process the data are bound by confidentiality;
- take appropriate technical and organisational security measures, including encrypted connections, hashed passwords, separation of each controller's data, protected sign-in sessions and restricted database access;
- engage sub-processors only as set out in section 3;
- help the controller respond to requests from data subjects exercising their rights, including by providing tools in the dashboard to view, download and delete enquiries and conversations;
- help the controller meet its obligations on security, breach notification, data protection impact assessments and consultation with the Information Commissioner, taking into account the information available to the processor;
- notify the controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the controller's data, with the information the controller needs;
- delete chat transcripts automatically 90 days after the last message and, when the controller's account ends, delete all of the controller's personal data within 30 days, unless the law requires it to be kept; the controller can download its enquiries before then; and
- make available the information needed to show compliance with this agreement, and allow for and contribute to reasonable audits, on reasonable notice and no more than once a year unless a breach has occurred.
3. Sub-processors
The controller gives general authorisation for the processor to use the sub-processors below. The processor will give at least 14 days' notice by email of any new or replacement sub-processor, during which the controller may object on reasonable data protection grounds; if the parties cannot resolve the objection, the controller may cancel without further charge. The processor will impose data protection terms on each sub-processor no less protective than this agreement and remains responsible for them.
| Provider | What they do for us | Where |
|---|---|---|
| Anthropic, PBC | Provides the AI model that reads visitors' messages and writes the assistant's replies. | United States |
| Render Services, Inc. | Hosts the Virtualized website, the chat service and the database where chats and enquiries are stored. | United States |
| Resend, Inc. | Delivers the emails that tell a business about a new enquiry. | United States and Ireland |
| Khaya AI (GhanaNLP) | For businesses on the Business plan, turns visitors' spoken messages into text and reads replies aloud in Ghanaian languages phones cannot handle, such as Twi. | Ghana |
| ElevenLabs, Inc. | Backup for the Business plan premium voice, used if Khaya AI is unavailable. | United States |
4. International transfers
Our providers are based in, or process data in, the United States. Where personal data is sent outside the UK, we rely on the UK's data bridge with the United States for providers certified under it, or otherwise on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses approved by the Information Commissioner, together with the provider's own security measures.
5. Controller's obligations
The controller is responsible for having a lawful basis for the processing, for giving visitors the information required by law (including that it uses Virtualized), and for the lawfulness of its instructions.
6. General
If this agreement conflicts with the customer terms on data protection, this agreement prevails. It is governed by the law of England and Wales. Contact: [contact email address].