Data Processing Agreement

1. Company Details

• Legal Entity: Atom Software Ltd
• Trading Name: AI Smarty
• Registered Address: Company information
• Jurisdiction: England and Wales
• Contact Email: [email protected]

2. Definitions

For the purposes of this DPA:

2.1 Affiliate

“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with a party.

2.2 Applicable Data Protection Laws

“Applicable Data Protection Laws” means all laws and regulations applicable to the processing of Personal Data under the Agreement, including where applicable:

• UK GDPR;
• EU GDPR;
• UK Data Protection Act 2018;
• Privacy and Electronic Communications Regulations 2003 (PECR);
• Swiss Federal Act on Data Protection (FADP);
• California Consumer Privacy Act (CCPA/CPRA);
• and other applicable international privacy laws.

2.3 Controller

“Controller” shall have the meaning given under Applicable Data Protection Laws.

2.4 Processor

“Processor” shall have the meaning given under Applicable Data Protection Laws.

2.5 Personal Data

“Personal Data” means any information relating to an identified or identifiable natural person.

2.6 Services

“Services” means the AI Smarty software platform and related services provided under the Agreement.

2.7 Sub-Processor

“Sub-Processor” means any third party engaged by AI Smarty to process Personal Data on behalf of Customer.

3. Scope and Roles of the Parties

3.1 Relationship of the parties

The parties acknowledge and agree that:

• Customer acts as Controller, or where applicable Processor on behalf of another Controller;
• AI Smarty acts as Processor when processing Personal Data on behalf of Customer;
• each party shall comply with its obligations under Applicable Data Protection Laws.

3.2 Customer responsibilities

Customer is solely responsible for:

• ensuring it has a lawful basis to collect and process Personal Data;
• ensuring transparency obligations are met;
• ensuring all instructions provided to AI Smarty are lawful;
• ensuring Personal Data uploaded to the Services complies with applicable laws.

Customer shall not use the Services to process unlawful content or data prohibited by Applicable Data Protection Laws.

3.3 AI Smarty responsibilities

AI Smarty shall:

• process Personal Data only on documented instructions from Customer;
• process Personal Data solely for the purposes of providing the Services;
• implement appropriate technical and organisational measures;
• notify Customer of confirmed Personal Data Breaches without undue delay.

4. Nature and Purpose of Processing

AI Smarty provides AI-powered SaaS functionality which may include:

• conversational AI agents;
• customer support agents;
• booking and appointment systems;
• lead capture forms;
• analytics dashboards;
• workflow automations;
• document uploads and retrieval systems;
• retrieval-augmented generation (RAG) systems;
• integrations with third-party services;
• communications and notifications.

Processing activities may include:

• collection;
• recording;
• organisation;
• storage;
• retrieval;
• transmission;
• analysis;
• deletion;
• support and troubleshooting;
• security monitoring.

5. Categories of Data Subjects and Personal Data

5.1 Categories of data subjects

Data Subjects may include:

• Customer employees;
• Customer contractors;
• Customer end users;
• website visitors;
• business leads;
• customers interacting with AI agents;
• support contacts.

5.2 Categories of personal data

Personal Data processed may include:

• names;
• email addresses;
• phone numbers;
• business information;
• booking information;
• enquiry details;
• uploaded files and documents;
• chat and conversation content;
• IP addresses;
• browser and device metadata;
• authentication identifiers;
• usage and analytics information.

5.3 Special category data

Customer shall not upload or submit Special Category Data unless:

• explicitly agreed in writing by AI Smarty; and
• appropriate safeguards are implemented.

Special Category Data includes:

• health data;
• biometric data;
• racial or ethnic origin;
• political opinions;
• religious beliefs;
• trade union membership;
• sexual orientation;
• criminal offence data.

6. Confidentiality

AI Smarty shall ensure that persons authorised to process Personal Data:

• are subject to confidentiality obligations;
• receive appropriate security and privacy training;
• access Personal Data only where necessary.

7. Security Measures

7.1 Technical and organisational measures

AI Smarty shall implement appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

7.2 Security controls

Security measures include those set out in Exhibit C (Technical and Organisational Measures), which covers tenant isolation and access control, data protection, upload and content safety, and operational security.

7.3 Shared responsibility

Customer acknowledges that security is a shared responsibility and Customer is responsible for:

• safeguarding account credentials;
• managing user permissions;
• configuring the Services appropriately;
• reviewing AI-generated outputs before reliance.

8. AI-Generated Content Disclaimer

Customer acknowledges that:

• AI-generated outputs may contain inaccuracies, hallucinations, or incomplete information;
• AI Smarty does not guarantee the accuracy, completeness, or suitability of generated outputs;
• Customer remains responsible for reviewing and validating outputs before use.

9. Sub-Processors

9.1 Authorisation

Customer authorises AI Smarty to engage Sub-Processors where reasonably necessary to provide the Services.

9.2 Subprocessor list

AI Smarty shall maintain a current list of material Sub-Processors at Exhibit B (Subprocessors) below.

9.3 Subprocessor obligations

AI Smarty shall ensure Sub-Processors are subject to contractual obligations substantially similar to those contained within this DPA.

9.4 Objections

Customer may reasonably object to a new Sub-Processor on legitimate data protection grounds within ten (10) days of notice.

Where no commercially reasonable alternative exists, AI Smarty may terminate affected Services.

10. International Data Transfers

10.1 International transfers

Customer acknowledges that Personal Data may be processed in:

• the United Kingdom;
• the European Economic Area (EEA);
• the United States;
• or other jurisdictions where approved infrastructure providers or Sub-Processors operate.

Customer files uploaded to the Services, including knowledge base documents and account assets, are stored at rest within the EEA. Transfers to the United States arise from the processing activities of the Sub-Processors listed in Exhibit B (Subprocessors), including model inference and embedding, which transmits content derived from stored files to an AI / LLM provider, as well as website content import, transactional email, payment processing, real-time messaging, and error monitoring.

10.2 Transfer safeguards

Where Personal Data is transferred outside the UK or EEA, AI Smarty shall implement appropriate safeguards including:

• adequacy regulations;
• Standard Contractual Clauses (SCCs);
• the UK International Data Transfer Addendum;
• or other lawful transfer mechanisms.

10.3 SCC incorporation

Where required under Applicable Data Protection Laws, the EU Standard Contractual Clauses approved by European Commission Decision 2021/914 and the UK International Data Transfer Addendum are incorporated by reference into this DPA.

11. Data Subject Rights

AI Smarty shall provide reasonable assistance to Customer in responding to Data Subject requests relating to:

• access;
• rectification;
• erasure;
• portability;
• restriction;
• objection.

Where legally permitted, AI Smarty may direct Data Subjects to Customer where Customer controls the relevant data.

12. Personal Data Breaches

12.1 Notification

AI Smarty shall notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.

12.2 Assistance

AI Smarty shall provide reasonable information available to assist Customer in meeting breach notification obligations.

12.3 No admission of liability

Notification of a Personal Data Breach shall not constitute an admission of fault or liability.

13. Retention and Deletion

13.1 Retention principles

AI Smarty shall retain Customer Personal Data only:

• for the duration necessary to provide the Services;
• as required by law;
• for the duration of a documented legal hold, limited to the data it covers;
• or as otherwise permitted under the Agreement.

13.2 Self-service export and deletion

Customer does not need to make a written request to exercise its deletion rights. Customer may, at any time and from within the platform:

• export a copy of Customer Data, including account profile, AI agent configuration, conversation history, lead forms and analytics summaries, from Account Settings;
• delete individual AI agents, knowledge sources, conversations and leads. Deleting a knowledge source also deletes the extracted text, chunks, embeddings, thumbnails and caches derived from it;
• delete the Customer account and every organisation it owns from Account Settings, once any active subscription has been cancelled. Deletion immediately revokes access and the AI agents stop serving.

Step-by-step instructions for each of these, including how to request deletion if Customer cannot sign in, are published at Data Deletion Instructions.

Where Customer operates a shared organisation, deleting an individual member account removes that member’s own account and profile only. Organisation-owned data remains under the control of the organisation owner.

13.3 Permanent erasure

Following an account or organisation deletion, AI Smarty shall permanently erase the associated Customer Personal Data within 30 days, except for:

• billing and accounting records, which are retained for six years after the end of the applicable financial year as required by law, with personal data minimised;
• data subject to a documented legal hold, for the duration of that hold.

Encrypted backups rotate on a cycle shorter than the erasure period, so deleted data does not persist in backups beyond it. Backups are used only for disaster recovery, and any data restored from a backup after its deletion is deleted again.

Aggregate analytics may be retained indefinitely only where they are fully anonymous and cannot be linked to any user, organisation, AI agent or data subject.

13.4 Termination

On termination or expiry of the Agreement, Customer may export and then delete Customer Data as described in section 13.2. Where Customer instead requests deletion or return in writing, AI Smarty shall complete it within 30 days of the request, subject to section 13.3.

14. Audits and Information Rights

14.1 Security documentation

Upon reasonable written request, AI Smarty may provide:

• security summaries;
• compliance documentation;
• audit summaries;
• or responses to security questionnaires.

14.2 Audit limitations

Any audit rights shall:

• occur no more than once annually;
• require reasonable advance notice;
• not unreasonably disrupt operations;
• remain subject to confidentiality obligations;
• be limited to information relevant to Customer.

AI Smarty may satisfy audit obligations through provision of existing security documentation where appropriate.

15. Use of AI Services and Third-Party Models

Customer acknowledges that AI Smarty may utilise third-party AI infrastructure providers and model providers to provide Services.

AI Smarty shall take reasonable steps to ensure such providers:

• are reputable commercial providers;
• maintain reasonable security measures;
• are contractually bound by confidentiality and data protection obligations where applicable;
• do not use Customer Data to train or improve their models, and retain it only transiently for abuse monitoring, under the provider’s applicable API data-processing terms.

16. Limitation of Liability

This DPA is subject to the exclusions and limitations of liability set forth in the Agreement unless prohibited by Applicable Data Protection Laws.

17. Governing Law

This DPA shall be governed by the laws of England and Wales.

The courts of England and Wales shall have exclusive jurisdiction except where Applicable Data Protection Laws require otherwise.

Exhibit A: Details of Processing

Subject matter

Provision of AI-powered SaaS services.

Duration

For the duration of the Agreement and applicable retention periods.

Nature of processing

Collection, storage, retrieval, organisation, transmission, analysis, deletion, support, and security processing.

Purpose of processing

To provide, maintain, secure, support, and improve the Services.

Categories of data subjects

• employees;
• contractors;
• customers;
• leads;
• website visitors;
• people who interact with Customer's AI agents.

Categories of personal data

• names;
• emails;
• phone numbers;
• uploaded content;
• documents;
• conversation data;
• IP addresses;
• browser metadata;
• booking details;
• analytics data.

Exhibit B: Subprocessors

AI Smarty may utilise trusted providers in the following categories: cloud infrastructure, storage providers, content delivery, AI / LLM model providers, website content import, real-time messaging, transactional email, payment processing, and error monitoring.

The current list of material Sub-Processors is below:

This list may be updated from time to time. Material changes will be communicated to Customers via the Services or by email.

Exhibit C: Technical and Organisational Measures

AI Smarty maintains the following technical and organisational measures:

Tenant isolation and access control

• row-level security enforced in the database across customer data tables, in addition to organisation scoping applied on every application query path;
• role-based access controls and least-privilege access;
• two-factor authentication available on customer accounts;
• privileged administrative access separately gated, re-authenticated, and audited;
• account passwords hashed using Argon2id;
• restricted production access with access reviews.

Data protection

• encryption in transit using TLS;
• server-side encryption at rest (AES-256) for stored files;
• credentials and third-party access tokens encrypted at rest under a dedicated key ring supporting key rotation;
• time-limited signed URLs for access to stored files;
• customer files stored at rest within the EEA;
• encrypted backups with documented recovery procedures.

Upload and content safety

• every uploaded file scanned for malware before processing, with production deployments refusing to run while scanning is disabled unless an explicitly acknowledged, error-logged emergency override is recorded;
• file type and content validation on upload;
• uploaded documents parsed within AI Smarty infrastructure;
• knowledge base search executed within AI Smarty’s own database.

Operational security

• rate limiting applied to public, authentication, and administrative endpoints;
• audit logging of administrative actions and file uploads;
• infrastructure and application error monitoring;
• automated dependency, secret, and static-analysis security scanning;
• regular patching and vulnerability remediation;
• secure deployment processes;
• incident response procedures.

Infrastructure may utilise reputable hosting and infrastructure providers operating within the UK, EEA, United States, or other approved jurisdictions.

Exhibit D: UK and EU Transfer Mechanisms

Where required by Applicable Data Protection Laws:

• the EU Standard Contractual Clauses approved by European Commission Decision 2021/914;
• and the UK International Data Transfer Addendum;

shall apply and are incorporated into this DPA by reference.

To the extent of any conflict:

• the SCCs and UK Addendum shall prevail where legally required;
• this DPA shall prevail over the Agreement regarding data protection matters;
• the Agreement shall prevail for all other commercial matters.