Data Processing Agreement

1. Company Details

• Legal Entity: Atom Software Ltd
• Trading Name: AI Smarty
• Registered Address: 838 Ecclesall Road, Sheffield, South Yorkshire, S11 8TD, United Kingdom
• Jurisdiction: England and Wales
• Contact Email: [email protected]

2. Definitions

For the purposes of this DPA:

2.1 Affiliate

“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with a party.

2.2 Applicable Data Protection Laws

“Applicable Data Protection Laws” means all laws and regulations applicable to the processing of Personal Data under the Agreement, including where applicable:

• UK GDPR;
• EU GDPR;
• UK Data Protection Act 2018;
• Privacy and Electronic Communications Regulations 2003 (PECR);
• Swiss Federal Act on Data Protection (FADP);
• California Consumer Privacy Act (CCPA/CPRA);
• and other applicable international privacy laws.

2.3 Controller

“Controller” shall have the meaning given under Applicable Data Protection Laws.

2.4 Processor

“Processor” shall have the meaning given under Applicable Data Protection Laws.

2.5 Personal Data

“Personal Data” means any information relating to an identified or identifiable natural person.

2.6 Services

“Services” means the AI Smarty software platform and related services provided under the Agreement.

2.7 Sub-Processor

“Sub-Processor” means any third party engaged by AI Smarty to process Personal Data on behalf of Customer.

3. Scope and Roles of the Parties

3.1 Relationship of the parties

The parties acknowledge and agree that:

• Customer acts as Controller, or where applicable Processor on behalf of another Controller;
• AI Smarty acts as Processor when processing Personal Data on behalf of Customer;
• each party shall comply with its obligations under Applicable Data Protection Laws.

3.2 Customer responsibilities

Customer is solely responsible for:

• ensuring it has a lawful basis to collect and process Personal Data;
• ensuring transparency obligations are met;
• ensuring all instructions provided to AI Smarty are lawful;
• ensuring Personal Data uploaded to the Services complies with applicable laws.

Customer shall not use the Services to process unlawful content or data prohibited by Applicable Data Protection Laws.

3.3 AI Smarty responsibilities

AI Smarty shall:

• process Personal Data only on documented instructions from Customer;
• process Personal Data solely for the purposes of providing the Services;
• implement appropriate technical and organisational measures;
• notify Customer of confirmed Personal Data Breaches without undue delay.

4. Nature and Purpose of Processing

AI Smarty provides AI-powered SaaS functionality which may include:

• AI chatbot systems;
• customer support agents;
• booking and appointment systems;
• lead capture forms;
• analytics dashboards;
• workflow automations;
• document uploads and retrieval systems;
• retrieval-augmented generation (RAG) systems;
• integrations with third-party services;
• communications and notifications.

Processing activities may include:

• collection;
• recording;
• organisation;
• storage;
• retrieval;
• transmission;
• analysis;
• deletion;
• support and troubleshooting;
• security monitoring.

5. Categories of Data Subjects and Personal Data

5.1 Categories of data subjects

Data Subjects may include:

• Customer employees;
• Customer contractors;
• Customer end users;
• website visitors;
• business leads;
• customers interacting with AI agents;
• support contacts.

5.2 Categories of personal data

Personal Data processed may include:

• names;
• email addresses;
• phone numbers;
• business information;
• booking information;
• enquiry details;
• uploaded files and documents;
• chat and conversation content;
• IP addresses;
• browser and device metadata;
• authentication identifiers;
• usage and analytics information.

5.3 Special category data

Customer shall not upload or submit Special Category Data unless:

• explicitly agreed in writing by AI Smarty; and
• appropriate safeguards are implemented.

Special Category Data includes:

• health data;
• biometric data;
• racial or ethnic origin;
• political opinions;
• religious beliefs;
• trade union membership;
• sexual orientation;
• criminal offence data.

6. Confidentiality

AI Smarty shall ensure that persons authorised to process Personal Data:

• are subject to confidentiality obligations;
• receive appropriate security and privacy training;
• access Personal Data only where necessary.

7. Security Measures

7.1 Technical and organisational measures

AI Smarty shall implement appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

7.2 Security controls

Security measures may include:

• encryption in transit using TLS;
• encryption at rest where applicable;
• multi-factor authentication;
• role-based access controls;
• secure password policies;
• logging and monitoring;
• infrastructure hardening;
• secure deployment pipelines;
• restricted production access;
• regular backups;
• vulnerability remediation;
• disaster recovery procedures.

7.3 Shared responsibility

Customer acknowledges that security is a shared responsibility and Customer is responsible for:

• safeguarding account credentials;
• managing user permissions;
• configuring the Services appropriately;
• reviewing AI-generated outputs before reliance.

8. AI-Generated Content Disclaimer

Customer acknowledges that:

• AI-generated outputs may contain inaccuracies, hallucinations, or incomplete information;
• AI Smarty does not guarantee the accuracy, completeness, or suitability of generated outputs;
• Customer remains responsible for reviewing and validating outputs before use.

9. Sub-Processors

9.1 Authorisation

Customer authorises AI Smarty to engage Sub-Processors where reasonably necessary to provide the Services.

9.2 Subprocessor list

AI Smarty shall maintain a current list of material Sub-Processors at Exhibit B (Subprocessors) below.

9.3 Subprocessor obligations

AI Smarty shall ensure Sub-Processors are subject to contractual obligations substantially similar to those contained within this DPA.

9.4 Objections

Customer may reasonably object to a new Sub-Processor on legitimate data protection grounds within ten (10) days of notice.

Where no commercially reasonable alternative exists, AI Smarty may terminate affected Services.

10. International Data Transfers

10.1 International transfers

Customer acknowledges that Personal Data may be processed in:

• the United Kingdom;
• the European Economic Area (EEA);
• the United States;
• or other jurisdictions where approved infrastructure providers or Sub-Processors operate.

10.2 Transfer safeguards

Where Personal Data is transferred outside the UK or EEA, AI Smarty shall implement appropriate safeguards including:

• adequacy regulations;
• Standard Contractual Clauses (SCCs);
• the UK International Data Transfer Addendum;
• or other lawful transfer mechanisms.

10.3 SCC incorporation

Where required under Applicable Data Protection Laws, the EU Standard Contractual Clauses approved by European Commission Decision 2021/914 and the UK International Data Transfer Addendum are incorporated by reference into this DPA.

11. Data Subject Rights

AI Smarty shall provide reasonable assistance to Customer in responding to Data Subject requests relating to:

• access;
• rectification;
• erasure;
• portability;
• restriction;
• objection.

Where legally permitted, AI Smarty may direct Data Subjects to Customer where Customer controls the relevant data.

12. Personal Data Breaches

12.1 Notification

AI Smarty shall notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.

12.2 Assistance

AI Smarty shall provide reasonable information available to assist Customer in meeting breach notification obligations.

12.3 No admission of liability

Notification of a Personal Data Breach shall not constitute an admission of fault or liability.

13. Retention and Deletion

AI Smarty shall retain Personal Data only:

• for the duration necessary to provide the Services;
• as required by law;
• for legitimate business purposes;
• or as otherwise permitted under the Agreement.

Upon written request and subject to legal obligations, AI Smarty shall delete or return Customer Personal Data within a reasonable timeframe following termination of Services.

14. Audits and Information Rights

14.1 Security documentation

Upon reasonable written request, AI Smarty may provide:

• security summaries;
• compliance documentation;
• audit summaries;
• or responses to security questionnaires.

14.2 Audit limitations

Any audit rights shall:

• occur no more than once annually;
• require reasonable advance notice;
• not unreasonably disrupt operations;
• remain subject to confidentiality obligations;
• be limited to information relevant to Customer.

AI Smarty may satisfy audit obligations through provision of existing security documentation where appropriate.

15. Use of AI Services and Third-Party Models

Customer acknowledges that AI Smarty may utilise third-party AI infrastructure providers and model providers to provide Services.

AI Smarty shall take reasonable steps to ensure such providers:

• are reputable commercial providers;
• maintain reasonable security measures;
• are contractually bound by confidentiality and data protection obligations where applicable.

16. Limitation of Liability

This DPA is subject to the exclusions and limitations of liability set forth in the Agreement unless prohibited by Applicable Data Protection Laws.

17. Governing Law

This DPA shall be governed by the laws of England and Wales.

The courts of England and Wales shall have exclusive jurisdiction except where Applicable Data Protection Laws require otherwise.

Exhibit A — Details of Processing

Subject matter

Provision of AI-powered SaaS services.

Duration

For the duration of the Agreement and applicable retention periods.

Nature of processing

Collection, storage, retrieval, organisation, transmission, analysis, deletion, support, and security processing.

Purpose of processing

To provide, maintain, secure, support, and improve the Services.

Categories of data subjects

• employees;
• contractors;
• customers;
• leads;
• website visitors;
• chatbot users.

Categories of personal data

• names;
• emails;
• phone numbers;
• uploaded content;
• documents;
• conversation data;
• IP addresses;
• browser metadata;
• booking details;
• analytics data.

Exhibit B — Subprocessors

AI Smarty may utilise trusted providers in the following categories: cloud infrastructure, storage providers, content delivery, AI / LLM model providers, document parsing, real-time messaging, payment processing, and error monitoring.

The current list of material Sub-Processors is below:

This list may be updated from time to time. Material changes will be communicated to Customers via the Services or by email.

Exhibit C — Technical and Organisational Measures

AI Smarty maintains technical and organisational measures including:

• encrypted communications;
• encrypted backups;
• authentication controls;
• least-privilege access controls;
• production access restrictions;
• infrastructure monitoring;
• activity logging;
• regular patching;
• backup and recovery procedures;
• vulnerability remediation;
• secure deployment processes;
• access reviews;
• incident response procedures.

Infrastructure may utilise reputable hosting and infrastructure providers operating within the UK, EEA, United States, or other approved jurisdictions.

Exhibit D — UK and EU Transfer Mechanisms

Where required by Applicable Data Protection Laws:

• the EU Standard Contractual Clauses approved by European Commission Decision 2021/914;
• and the UK International Data Transfer Addendum;

shall apply and are incorporated into this DPA by reference.

To the extent of any conflict:

• the SCCs and UK Addendum shall prevail where legally required;
• this DPA shall prevail over the Agreement regarding data protection matters;
• the Agreement shall prevail for all other commercial matters.