Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between [Company legal name] ("Ventriqa", "we", the processor) and the business that uses Ventriqa ("you", the controller). It meets the requirements of Article 28 of the UK GDPR and applies whenever we process personal data on your behalf. By accepting the Terms of Service you accept this DPA.

Ventriqa is a trading name of [Company legal name], a company registered in England and Wales (company number [Company number]). Our registered office is at [Registered address]. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO registration number].

Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR. "Data protection law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time.

1. Details of the processing

Subject matter

Providing the Ventriqa platform and its features to you under the Terms of Service.

Duration

For as long as you have an account, and afterwards until the data is deleted as described in section 10.

Nature and purpose

Collecting, recording, storing, organising, analysing, transcribing, summarising, retrieving, transmitting and deleting personal data so that Ventriqa can, on your instructions:

• answer, route, record and summarise phone calls and voicemails, including with an AI assistant;
• send and receive text and WhatsApp messages;
• run website chatbots and AI agents that answer questions, capture enquiries and book appointments;
• collect feedback and reviews, run QR code campaigns, loyalty passes and prize draws, and draft review replies;
• keep customer records and link one customer's contacts across channels within your account;
• find public business contact details through the lead finder;
• send emails and campaigns you create;
• generate marketing plans and content from the information you provide.

Types of personal data

• Identity and contact details: name, phone number, email address, postal address where given.
• Communications: call audio and recordings, transcripts and summaries, voicemails, text, WhatsApp and chat messages.
• Appointments and enquiries: services requested, dates and times, notes.
• Feedback: reviews, ratings, comments and photos.
• Preferences: marketing opt-in and opt-out status.
• Technical data: IP address, browser and device type (for example for QR code scans).
• Anything else you or your customers choose to put into Ventriqa, including documents uploaded to your Business Brain.
• Details of your own staff you add (for example names on staff QR codes).

Ventriqa is not designed to process special category data (such as health information) or criminal offence data. You must not deliberately use it for that. We recognise that callers and chat visitors may volunteer such information, and we protect it in the same way as all other data.

Data subjects

• Your customers and prospective customers: callers, chat visitors, message contacts, reviewers, people who book appointments, QR code users and marketing-list subscribers.
• Business contacts found through the lead finder.
• Your staff and team members.

2. Your responsibilities

You confirm that:

• you have a lawful basis for the processing you ask us to carry out, and your instructions comply with data protection law;
• you have given data subjects the privacy information they need, including about call recording and the use of AI assistants and service providers;
• you have any consents required for marketing communications and call recording, and will keep records of them.

3. Our obligations as processor

We will:

• process personal data only on your documented instructions — which are the Terms of Service, this DPA and how you configure and use Ventriqa — unless the law requires otherwise, in which case we will tell you first unless the law prevents it;
• tell you if we believe an instruction breaks data protection law;
• make sure everyone we authorise to process the data is bound by confidentiality;
• take the security measures in section 6;
• use sub-processors only as set out in section 4;
• help you respond to data subjects exercising their rights (section 8);
• help you with security, breach notification, data protection impact assessments and consulting the ICO, taking into account the nature of the processing and the information available to us (section 8);
• delete or return personal data at the end of the service (section 10);
• make available the information you reasonably need to show compliance with Article 28, and allow audits (section 11).

We will not sell your personal data, use it for our own marketing, or combine it with data from other customers' accounts. We may use anonymised, aggregated information that does not identify any person or business to run and improve the service.

4. Sub-processors

• You give us general authorisation to use sub-processors. The current list is on our sub-processors page, and you authorise those listed there.
• We will give you at least 30 days' notice before adding or replacing a sub-processor, by updating that page and emailing the account owner.
• You may object on reasonable data protection grounds within that notice period by emailing privacy@ventriqa.com. We will discuss your concerns in good faith. If we cannot resolve them, you may end the affected part of the service and we will refund any prepaid fees for the period after it ends.
• We will put a written contract in place with each sub-processor that imposes data protection obligations equivalent in substance to this DPA, and we remain responsible to you for their performance.

5. International transfers

Some sub-processors process personal data outside the UK, as shown on the sub-processors page. Where a transfer is to a country without UK adequacy regulations, we will make sure an appropriate safeguard is in place, where applicable: the UK Extension to the EU–US Data Privacy Framework for certified US recipients, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

6. Security measures

We take appropriate technical and organisational measures, taking into account the state of the art, the cost, and the nature and risks of the processing. They currently include:

• Encryption in transit: the platform is served over HTTPS, with HTTP Strict Transport Security and secure session cookies in production.
• Encryption of secrets at rest: access tokens for connected accounts (such as Meta, Google Calendar and WhatsApp), telephony credentials and two-factor secrets are encrypted in the database with the application key. Passwords are stored only as salted hashes.
• Access control: role-based access within each account; data export, billing and account deletion restricted to the account owner; two-factor authentication available to all users and required for platform administrators and partner administrators.
• Separation between customers: every business's records are scoped to its own account, and each business has its own separate collection in our AI search index.
• Limiting what AI shares: public-facing chatbots and assistants may only use knowledge marked as suitable for customers; private business planning notes are excluded.
• Audit trail: every time our support staff or a partner administrator views an account as a user, the session is logged, including who, when and from which IP address. Data exports are logged.
• Protecting inbound and outbound connections: webhooks from our call providers are checked for a valid signature; the platform checks web addresses before fetching them so it cannot be tricked into reaching internal systems; requests are rate-limited.
• Security headers: a content security policy and other standard browser security headers.
• Resilience: nightly database backups, kept for 14 days on the server, with an optional off-server copy.
• Data minimisation: automatic deletion of personal data after set periods (section 10).

We review these measures from time to time and may change them, as long as the overall level of protection does not go down.

7. Personal data breaches

• We will tell you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your data.
• We will give you the information you reasonably need to meet your own obligations, including to report to the ICO within 72 hours and tell affected people where required: what happened, the categories and approximate numbers of people and records affected, likely consequences, and what we have done or plan to do. Where we don't have all of this at first, we will provide it as it becomes available.
• We will take reasonable steps to contain the breach and reduce its effects.
• Telling you about a breach is not an admission of fault.

8. Assistance

• Data subject requests. If we receive a request from one of your customers, we will pass it to you promptly and not respond ourselves except to redirect them, unless you ask us to. The account owner can export the account's data as a ZIP file from the Profile page, which helps with access and portability requests. Where you cannot deal with a request using the platform, we will help you on request.
• Impact assessments and the ICO. We will give reasonable help with data protection impact assessments and prior consultation with the ICO relating to Ventriqa.
• We may charge reasonable costs for help beyond what the platform provides, where the request is excessive or repeated. [Confirm.]

9. Confidentiality

We restrict access to personal data to the people who need it to run, support and secure the service, and they are bound by confidentiality obligations.

10. Retention, deletion and return

While your account is open, the following personal data is deleted automatically by a daily job:

• full technical call records from our call provider (including caller numbers and transcripts): after 30 days;
• website chat, AI agent, text and WhatsApp conversations: after 365 days without activity;
• call transcripts, summaries and recording links: after 365 days (the basic call record needed for billing is kept);
• voicemails: after 365 days.

Call recording audio is stored by our telephony provider, and our clean-up removes Ventriqa's link to it rather than the audio itself. [Confirm retention and deletion of recordings at the telephony provider.]

At the end of the service:

• Before closing the account, the account owner can download the account's data as a ZIP file from the Profile page. This is how we return your data.
• When the account is deleted, it is closed straight away and its personal data is permanently deleted 30 days later, including from our AI search index. An account with a live paid subscription is not deleted until the subscription ends.
• Copies in our database backups are deleted as those backups expire: 14 days for backups on our server [confirm the expiry of off-site backup copies].
• We may keep data where the law requires us to, and will continue to protect it under this DPA while we do.

11. Information and audits

• We will make available the information you reasonably need to show that we meet Article 28, including answering reasonable security questionnaires.
• If that is not enough, or a regulator requires it, you (or an independent auditor you appoint, bound by confidentiality) may audit our compliance, on at least 30 days' written notice, during business hours, no more than once a year unless there has been a breach, and in a way that does not disrupt the service or put other customers' data at risk.
• You will pay your own audit costs, and our reasonable costs where the audit takes more than [one] working day of our time.

12. Liability and order of precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where data protection law does not allow them. If this DPA conflicts with the Terms of Service about personal data, this DPA wins.

13. Partners and white-label accounts

Where an agency, franchisor or white-label partner manages accounts for its clients, the partner acts as a processor for each client and we act as its sub-processor. The partner must have a data processing agreement with each client that allows this, and passes on the obligations in this DPA.

14. Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

15. Contact

Data protection questions and notices: privacy@ventriqa.com. If you need a signed copy of this DPA, email legal@ventriqa.com.