Data Processing Agreement

Data Processing Agreement

Deputise Ltd

Last updated: 17 October 2026

This agreement applies where a customer uses Deputise in the course of a business and is the controller of personal data that Deputise processes on its behalf, for example personal data about other people that the customer puts into an assistant's instructions or facts. A person who uses Deputise for personal or household purposes does not need it; our privacy policy describes how we handle their data as controller. For a signed copy, write to legal@deputise.ai.

Section A: Key terms

Section B: Legal terms

1. Purpose and scope

1.1 This agreement meets Article 28(3) and (4) of the UK GDPR and of the EU GDPR, each to the extent it applies to the processing.

1.2 It applies to the processing described in Section A and forms part of the Base Agreement. It applies automatically to every customer within its scope.

2. Interpretation

2.1 Terms defined in the UK GDPR or the EU GDPR have the same meaning here.

2.2 This agreement is to be read consistently with those regulations and not in a way that reduces the rights of data subjects.

3. Precedence

Where this agreement conflicts with the Base Agreement on a data protection matter, this agreement prevails unless the Parties agree otherwise in writing.

4. Processor's obligations

4.1 Documented instructions. We process personal data only on the Controller's documented instructions, including for transfers to a third country, unless UK or EU law requires otherwise, in which case we tell the Controller before processing unless that law forbids it. The Controller's instructions are Section A, the Base Agreement and the settings it chooses in the Service. Further instructions must be in writing.

4.2 Unlawful instructions. We tell the Controller at once if we consider an instruction breaks data protection law.

4.3 Purpose limitation. We process personal data only for the purposes in Section A and not for our own purposes.

4.4 No AI training. We do not use personal data processed under this agreement to train, fine-tune or improve any AI model, and we do not permit our sub-processors to. This extends to de-identified derivatives where re-identification is reasonably possible.

4.5 Confidentiality. Everyone we authorise to process personal data is bound by confidentiality, and access is limited to those who need it for their work.

4.6 Security. We implement the measures in Section C, taking account of the state of the art, the cost of implementation and the risks to data subjects, as Article 32 requires.

4.7 Special category data. Where the Controller tells us in writing that an assistant processes special category data, we apply any additional safeguards the Controller reasonably requires.

5. Documentation and audits

5.1 Each Party keeps the records needed to show it complies with this agreement.

5.2 We answer the Controller's reasonable enquiries about the processing promptly.

5.3 We make available the information the Controller reasonably needs to demonstrate compliance with Article 28.

5.4 We keep a record of processing carried out for the Controller under Article 30(2).

5.5 Audits. Once in any 12 months, or at any time after a personal data breach or at a supervisory authority's request, the Controller may ask in writing for the documentation and records needed to verify compliance. The Controller may appoint an independent auditor, bound by confidentiality, to conduct a remote audit at the Controller's cost. An audit is limited to the processing under this agreement and respects our confidentiality and business secrets. No on-site audits are available.

5.6 We provide audit results to a competent supervisory authority where the law requires.

6. Sub-processors

6.1 The Controller authorises us to use the sub-processors on the sub-processors page.

6.2 We give the Controller at least 30 days' notice by email before a new or replacement sub-processor processes its personal data, naming the sub-processor, its location and what it will do.

6.3 The Controller may object in writing within that period on reasonable data protection grounds. If we cannot accommodate the objection, either Party may terminate the affected processing or the Base Agreement without penalty, and we refund any prepaid fees for the period after termination.

6.4 We bind each sub-processor by written contract to data protection obligations no less protective than these, and we remain responsible to the Controller for the sub-processor's performance.

6.5 On request we provide a copy of a sub-processor agreement, redacted for commercial terms not relevant to data protection.

7. International transfers

7.1 We transfer personal data outside the UK or the EEA only in compliance with Chapter V of the UK GDPR, the Data Protection Act 2018 and, where it applies, Chapter V of the EU GDPR.

7.2 Transfers rely on one or more of: an adequacy decision of the UK Secretary of State or the European Commission; the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified; the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; the EU Standard Contractual Clauses; or another mechanism the law recognises.

7.3 We carry out and keep transfer risk assessments where required and apply supplementary measures where needed.

7.4 Each sub-processor in a third country is bound to safeguards consistent with this clause.

8. Data subject rights

8.1 If a data subject contacts us directly about data we process for the Controller, we tell the Controller promptly and do not respond without the Controller's authority, except to direct the person to the Controller.

8.2 We help the Controller, so far as possible and by appropriate measures, to respond to requests to exercise rights of access, rectification, erasure, restriction, portability and objection, and rights relating to automated decision-making. In practice the Controller can meet most requests itself through the Service, by deleting an assistant, a fact or a conversation.

8.3 We help the Controller respond to complaints a data subject makes to a supervisory authority about the processing.

9. Impact assessments

We give the Controller reasonable help with data protection impact assessments and any prior consultation with a supervisory authority, taking account of the nature of the processing and the information available to us.

10. Personal data breach

10.1 We notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting data processed under this agreement.

10.2 The notice describes, as far as known, the nature of the breach and the categories and approximate numbers of data subjects and records concerned, a contact point, the likely consequences and the measures taken or proposed. Where not everything is known at once, we provide it in phases.

10.3 We help the Controller investigate and remedy the breach, notify the supervisory authority within 72 hours where Article 33 requires, and inform data subjects where Article 34 requires.

11. Deletion and return

11.1 When the Base Agreement ends, or earlier on the Controller's written request, we delete the personal data or, if the Controller asks before deletion, return it in a commonly used machine-readable format and then delete it.

11.2 Deletion is completed within 31 days unless the law requires longer storage. Backups are overwritten on our normal rotation and are not actively processed after termination.

11.3 On request we confirm deletion in writing.

12. Termination

12.1 The Controller may instruct us to suspend processing while we are in breach of this agreement.

12.2 The Controller may terminate this agreement and the Base Agreement if we materially breach this agreement and do not remedy it within 30 days of written notice, if a breach cannot be remedied, or if we fail to comply with a binding decision of a court or supervisory authority.

12.3 Clauses 4.4, 5, 10, 11 and 13 survive termination.

13. Liability

Each Party's liability under this agreement is subject to the limits in the Base Agreement, except that no limit applies to liability for a Party's wilful or grossly negligent breach of data protection law.

Section C: Technical and organisational measures

We review these measures regularly and update them to keep security appropriate to the risk.

1. Organisational measures

• A named person is responsible for data protection and information security
• Everyone with access to personal data is bound by confidentiality and trained in their responsibilities on joining and at intervals thereafter
• Access rights are removed promptly when someone leaves or changes role
• A documented incident response procedure covers identification, containment, recovery and notification, and feeds the 48-hour notice in clause 10
• Changes to production systems go through code review and automated testing before deployment
• Sub-processors are assessed before engagement and reviewed periodically

2. Technical measures

• Access control. Production systems and the admin tools are reachable only by named staff through single sign-on (Cloudflare Access). Customers and their users authenticate by emailed sign-in link; there are no passwords to steal. Access follows least privilege
• Encryption. Data in transit is encrypted with TLS 1.2 or higher, and data at rest, including the database, backups and stored pictures, is encrypted by the hosting providers
• Staff access logging. Every time a member of staff reads a conversation, an assistant's facts or a support picture, the record holds who looked, what they looked at and the reason, which they must give. Staff actions such as suspensions, deletions and credit adjustments are recorded the same way. These records are kept for 24 months and can be read back but not edited through the admin tools' own interface [OWNER TO CONFIRM: that audit records are protected against tampering at the database level]
• Application logs are kept for 7 days
• Pictures are held in a private bucket and served only through an authenticated route to people entitled to see the conversation they belong to
• DDoS protection is provided by Cloudflare, and the registration form is protected against automated sign-ups
• Backups are automated and encrypted, and restoration is tested
• Dependencies are monitored for known vulnerabilities and updated; production, preview and development environments are separate
• Retention is enforced by scheduled jobs that delete conversations, pictures, unused sign-in links, decided safety reports and staff access records when their periods expire, and alert an operator if they fall behind

3. AI-specific measures

• AI providers are used under API terms that prohibit training on customer content
• Every AI request passes through Cloudflare's AI Gateway to the provider named on the sub-processors page. The provider receives the assistant's instructions and facts, the conversation and the names of the owner and the person chatting, not their email addresses
• [OWNER TO CONFIRM: whether zero-data-retention or reduced-retention options are enabled with OpenAI and Anthropic, and whether AI Gateway request logging is disabled. The code sets neither.]
• Conversation data is stored only for the periods in the privacy policy
• Every chat tells the person that they are talking to an AI assistant, and every invitation says that an AI assistant is being shared

Contact

Deputise Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Email: legal@deputise.ai