Data Processing Agreement.

01Parties and roles

1. The Customer: the firm named in the order form or service agreement [TO CONFIRM: contract name]. The Customer is the controller of the personal data of people who call its lines.
2. Stak Group (legal entity and address [TO CONFIRM before first client]), data protection registration number [PENDING] (“Stak”). Stak is the processor.

This agreement applies whenever Stak processes Customer Personal Data to provide the service. If it conflicts with the service agreement on data protection, this agreement wins.

02Definitions

• Data Protection Law: the UK GDPR, the Data Protection Act 2018, and any other UK law on personal data that applies, as amended.
• Customer Personal Data: personal data Stak processes for the Customer under the service agreement, as described in Schedule 1.
• Sub-processor: a third party Stak engages to process Customer Personal Data.
• Regulator: the UK Information Commission (formerly the Information Commissioner’s Office).
• “Controller”, “processor”, “personal data”, “personal data breach”, “data subject” and “processing” have the meanings given in the UK GDPR.

03Processing only on instructions

1. Stak will process Customer Personal Data only on the Customer’s documented instructions, including on transfers outside the UK, unless UK law requires otherwise. If so, Stak will tell the Customer first unless the law forbids it.
2. The service agreement, the Customer’s settings (including whether call recording is on), and this agreement are the Customer’s instructions.
3. Stak will tell the Customer promptly if it believes an instruction breaks Data Protection Law.
4. No training. Stak will not use Customer Personal Data to train or improve AI models, and will not use it for its own purposes, marketing, or sale.

04The Customer’s responsibilities

1. The Customer is responsible for having a lawful basis for the processing and for giving callers the privacy information the law requires, including in its own privacy notice.
2. The Customer decides whether calls are recorded and is responsible for any call-recording notice and AI disclosure it chooses. Stak provides recommended wording.
3. The Customer will not instruct Stak to process data unlawfully.

05Confidentiality

1. Stak will make sure everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality.
2. Stak will treat all call content as confidential information of the Customer. This includes content that may be subject to legal professional privilege.
3. Access is limited to the people who need it to provide, support or secure the service.

06Security

Stak will take the technical and organisational measures required by Article 32 UK GDPR, including those in Schedule 3. Stak may improve these measures over time but will not reduce the overall level of protection.

07Sub-processors

1. The Customer gives general authorisation for Stak to use the Sub-processors listed in Schedule 2.
2. Stak will give the Customer at least [●] days [TO CONFIRM] notice by email before adding or replacing a Sub-processor. The Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may end the affected service without penalty [TO CONFIRM].
3. Stak will impose data protection obligations on each Sub-processor that are no less protective than these, as far as relevant to the service it provides.
4. Stak remains liable to the Customer for its Sub-processors’ performance of those obligations.

08International transfers

1. Customer Personal Data may be processed outside the UK, including in the United States and the European Union. Stak does not promise UK-only hosting.
2. Stak will only make or allow a restricted transfer where UK GDPR safeguards are in place: UK adequacy regulations (including for the EU, and the UK–US data bridge for US organisations certified under it), the ICO International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where required.
3. The safeguard used for each Sub-processor is shown in Schedule 2.

09Helping the Customer

1. Data subject requests. Stak will help the Customer respond to callers exercising their rights, including by finding, exporting, correcting or deleting call records. If a caller contacts Stak directly, Stak will pass the request to the Customer promptly and will not respond itself unless the Customer instructs it to.
2. Assessments. Stak will give reasonable help with data protection impact assessments and any prior consultation with the Regulator.
3. Breaches. Stak will notify and help the Customer as set out in Schedule 4.

10When the contract ends

At the Customer’s choice, Stak will return or delete Customer Personal Data when the service ends. Unless the Customer asks for a return first, Stak will delete it within 30 days of the end of the contract [TO CONFIRM], including copies held by Sub-processors as far as their systems allow. Stak may keep data only where UK law requires it, and will keep it confidential. Stak will confirm deletion in writing on request.

11Information and audits

1. Stak will make available all information needed to show compliance with Article 28 UK GDPR.
2. Stak will allow and contribute to audits, including inspections, by the Customer or an auditor it appoints, on [●] days’ [TO CONFIRM] written notice, during business hours, no more than once a year unless a breach has occurred or the Regulator requires it [TO CONFIRM]. The auditor must be bound by confidentiality.
3. Stak may first answer by providing written information, and Sub-processors’ certifications or audit reports where available.
4. Stak will make information available to the Customer’s regulators, including the SRA where relevant, on request.

12General

1. Liability under this agreement is subject to the limits in the service agreement [TO CONFIRM].
2. This agreement lasts as long as Stak processes Customer Personal Data.
3. This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction [TO CONFIRM].
4. Data protection contact for Stak: privacy@stakgroup.co.uk [TO CONFIRM; may route to edward@stakgroup.co.uk].

Schedule 1Processing details

Retention

Retention periods apply to Stak’s systems and are applied at Sub-processors as far as their settings allow [TO CONFIRM: ElevenLabs, Twilio and Gmail retention settings match these periods]. Email summaries delivered to the Customer’s own inbox are under the Customer’s control.

Schedule 2Sub-processors

Each provider may use its own sub-processors under its terms. ElevenLabs’ terms say conversations may be shared with its third-party large language model providers [TO CONFIRM: which LLM the agent uses].

Schedule 3Security measures

• Encryption in transit: data passing between Stak, its Sub-processors and the Customer is sent over TLS.
• Encryption at rest: call logs stored in Netlify Blobs are encrypted at rest by the provider. Netlify states AES-256 encryption at rest [TO CONFIRM: applies to Blobs].
• Access control: access to call data and provider dashboards is restricted to named people with individual accounts, protected by strong passwords and two-factor authentication where the provider offers it [TO CONFIRM].
• Least privilege: people and system components get only the access they need. API keys are held as environment secrets, not in code.
• Logging: access to and changes in systems holding call data are logged, and logs are reviewed when an incident is suspected.
• Confidentiality: everyone with access is bound by confidentiality (section 5).
• Retention and deletion: data is deleted on the schedule in Schedule 1.
• Sub-processor due diligence: Stak reviews each provider’s security and data protection terms before use.

Schedule 4Personal data breaches

1. Stak will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. This gives the Customer time to meet its own 72-hour duty to notify the Regulator.
2. The notice will go to the Customer’s nominated contact by email and phone, and will include as far as known: what happened; the categories and approximate number of callers and records affected; likely consequences; and the steps taken or proposed. Stak will send further information as it becomes available.
3. Stak will take reasonable steps to contain the breach and reduce its effects, and will help the Customer with notifications to the Regulator and to affected callers.
4. Stak will not notify the Regulator or callers about a breach of Customer Personal Data without the Customer’s agreement, unless the law requires it.