Draft — to be checked by a solicitor before launch.

Data Processing Agreement

Under Article 28 of the UK GDPR · Draft of 27 October 2026

1. Parties and roles

• The business that uses AI Receptionist is the controller ("you").
• Adria Technologies Limited, trading as AI Receptionist, a company registered in England and Wales, company number 17543235, registered office 66 Paul Street, London, EC2A 4NA, is the processor ("we"). ICO registration number: [registration pending].

This agreement is part of our Terms of service. It applies to personal data we process for you when the service handles your calls. Where it differs from the terms, this agreement wins on data protection.

2. Details of the processing

3. Instructions

• We process the data only on your documented instructions. These terms, and the settings you choose in the service (for example how long data is kept, the alert number and the booking system), are your instructions. This includes transfers abroad (section 10).
• If the law makes us process data in another way, we will tell you first, unless the law forbids that.
• We will tell you at once if we think an instruction breaks data protection law.
• We do not use your callers' data for our own purposes, and we do not use it to train AI models. We opt out of Deepgram's model-improvement programme on every call [to confirm: other providers' training settings].

4. Confidentiality

Everyone we allow to process the data is bound by a duty of confidentiality [to confirm: staff and contractor agreements].

5. Security

We take appropriate technical and organisational measures (Article 32). Today these are:

• data is sent over encrypted connections (TLS);
• row-level security in the database, so each business can only reach its own data;
• keys and links for connected booking systems are stored encrypted (pgcrypto), with a key that only our server holds;
• access to production systems is limited to the people who run the service;
• call audio is not stored by us;
• a nightly job deletes transcripts, summaries, caller numbers, messages and past bookings once your retention times pass.

[to confirm: logging, testing and backup measures to add here]

Retention

Your settings set how long data is kept. The defaults are:

A job runs every night and deletes data once its time has passed. Call audio is not stored: it is streamed live and is not kept by us.

6. Sub-processors

• You give us general permission to use the sub-processors below. The same list is in our Privacy notice.
• We will tell you at least 30 days before we add or replace one [to confirm: notice period]. You may object for a reasonable data protection reason. If we cannot solve it, you may end the service.
• Each sub-processor is bound by data protection terms that protect the data as well as this agreement does. We stay responsible to you for them.

7. Help with people's rights

• Callers may ask you to see, correct or delete their data. We help you answer.
• You can see and read each call, message and booking in your dashboard.
• On your request we can erase one caller's data for your business: their call transcripts, summaries and number on the call log, and their messages and bookings.
• If a caller contacts us directly, we pass the request to you and do not answer it ourselves, unless you ask us to.

8. Data breaches

We tell you without undue delay after we become aware of a personal data breach that affects your data. We aim to do so within 48 hours [to confirm]. We give you the information you need to report it to the ICO and to tell callers, and we help you limit the harm.

9. DPIAs and the ICO

We help you with data protection impact assessments and any prior consultation with the ICO, as far as they concern our service. We plan to provide a short summary of our own assessment for you to use [to confirm].

10. International transfers

• Our database is in the EU (Frankfurt, Germany), which the UK treats as adequate.
• Some sub-processors are in the US, and Supabase and Render have US parent companies (see section 6). For them we rely on the UK Addendum to the EU Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA), and the UK–US Data Bridge where the provider is certified [solicitor to confirm per provider].

11. Deletion at the end

When the service ends, we delete your callers' personal data within 30 days [to confirm], unless the law requires us to keep it. Before then you can ask us to return it to you instead [to confirm: export format]. Copies in backups are deleted as the backups expire [to confirm: backup period].

12. Information and audits

We give you the information you reasonably need to show that this agreement is followed. We first answer a written questionnaire. If that is not enough, you may audit us, with reasonable notice, at your cost, and at most once a year unless there has been a breach [to confirm].

13. Your duties as controller

• You have a lawful basis for the processing, and a condition for any special category data (for example health details at a clinic).
• You tell your callers how their data is used, in your own privacy notice. The receptionist tells callers at the start that it is an AI and that the call is transcribed.
• You set retention times that suit your business, and you do not use the service for marketing calls or texts.

14. General

The liability terms in the Terms of service apply to this agreement [for the solicitor]. This agreement is governed by the law of England and Wales. Questions: support@adriatechnology.com.