Data Processing Agreement

1. Scope and roles

This Data Processing Agreement forms part of the agreement between The Prime Work ("we", the "Service Provider" or "Processor") and the customer ("you", the "Business" or "Controller") under which you use our AI voice agent and live chat services (the "Services").

You determine why and how personal information about your callers, visitors and customers is handled. We handle it on your behalf and for no other purpose. Where we handle information about your own staff for account administration and billing, we act in our own right and our Privacy Policy applies to that limited data.

This DPA takes effect when you accept it or begin using the Services, whichever is earlier.

2. Definitions

"US Privacy Law" means the California Consumer Privacy Act as amended by the CPRA, and the comprehensive privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and any other US state law applicable to the processing.

"UK/EU Privacy Law" means the UK GDPR and Data Protection Act 2018 and the EU GDPR (Regulation (EU) 2016/679).

"Personal Information" means information covered by either, and includes personal data as defined in the GDPR. "Processing", "controller", "processor", "sub-processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. "Consumer", "business", "service provider", "sell" and "share" have the meanings given in the CCPA.

"SCCs" means the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the ICO's International Data Transfer Addendum.

3. US service provider obligations

We act as your service provider and, where applicable, processor under US Privacy Law. We certify that we will:

• Not sell Personal Information and not share it for cross-context behavioural advertising
• Not retain, use or disclose it for any purpose other than performing the Services specified in our agreement, including not for our own commercial purposes
• Not combine it with information received from another source, except as permitted to perform a business purpose on your behalf
• Not process it outside the direct business relationship between us
• Comply with the obligations applicable to a service provider under US Privacy Law, and give you the same level of privacy protection the law requires of you
• Notify you if we determine we can no longer meet these obligations, and stop processing or take remedial steps if you direct
• Allow you to take reasonable and appropriate steps to confirm we use Personal Information consistently with your obligations

4. Processing on instructions

We process Personal Information only on your documented instructions, which are set out in this DPA, the main agreement, and your configuration of the Services.

If we believe an instruction breaches applicable privacy law, we will tell you without undue delay and may pause that processing. If a law requires us to process beyond your instructions, we will notify you unless legally prohibited.

5. Confidentiality of staff

Everyone we authorise to process Personal Information, including the human agents who staff live chat, is bound by a written confidentiality obligation and receives privacy training appropriate to their role. Access is limited to those who need it to deliver the Services.

6. Security measures

We implement appropriate technical and organisational measures to protect Personal Information, as described in Annex 2. We review them periodically and may update them, provided the level of protection is not reduced.

7. Sub-processors

You give general authorisation for us to engage sub-processors. Current categories are listed in Annex 1, and a named list is available on request.

Every sub-processor is bound by written terms imposing obligations no less protective than this DPA, including the US service provider restrictions in section 3. We remain fully liable to you for their performance. We will give at least 14 days' notice before adding or replacing one. You may object on reasonable privacy or security grounds; if we cannot resolve the objection, you may terminate the affected Services without penalty for the unused portion of any prepaid fees.

8. Consumer and data subject requests

Taking into account the nature of the processing, we will assist you with requests to know, access, correct, delete, restrict, object to, port or opt out. The Services include self-service tools for finding, exporting and deleting call recordings, transcripts and chat records.

If someone contacts us directly about information we hold for you, we will not respond substantively. We will forward the request to you without undue delay.

9. Security incidents

We will notify you without undue delay, and in any event within 48 hours, of becoming aware of a breach of security leading to unauthorised access to, or loss or disclosure of, your Personal Information. The notice will describe the nature of the incident, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed.

We will assist you with your own notification obligations to individuals, state Attorneys General and supervisory authorities. Notification is not an admission of fault by either party.

10. Assessments

We will provide reasonable assistance with data protection impact assessments, US state data protection assessments, and prior consultations with supervisory authorities, to the extent required and taking into account the information available to us.

11. Deletion and return

On termination of the Services, and at your choice, we will return or delete all Personal Information processed on your behalf, and delete existing copies, within 30 days, unless a law requires us to keep it. Backups are purged on their normal rotation, within 90 days.

During the term, retention periods are configurable by you. Our defaults are 30 days for call recordings and transcripts and 12 months for chat transcripts.

12. Audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow and contribute to audits conducted by you or an independent auditor you appoint.

We may satisfy this by providing a written security summary or current third-party certification. On-site audits are limited to once in any 12-month period, require 30 days' notice, must be conducted during business hours without unreasonable disruption, and are subject to confidentiality. Additional audits required by a regulator are permitted.

13. International transfers

Because we are established in the United Kingdom, Personal Information about US individuals is transferred to and processed in the UK, and may also be processed in the United States and the European Economic Area depending on the provider. US Privacy Law does not restrict this, but you should disclose it in your own privacy notice.

Where data moves out of the UK or EEA to a country without an adequacy decision, the transfer is governed by the SCCs, with Module Two applying between you as data exporter and The Prime Work as data importer, supplemented by the UK Addendum where the UK GDPR applies. The SCCs are incorporated into this DPA by reference.

If you have a strict data residency requirement, raise it before onboarding, as it limits which providers can be used.

14. AI model use

Call audio, transcripts and chat content are processed by AI providers to deliver speech recognition, language understanding and speech synthesis. We do not permit those providers to use your Personal Information to train their foundation models, and our agreements with them reflect this.

We may use your data to tune and improve your own agent configuration. We do not use one customer's data to improve another customer's agent.

15. No HIPAA data

The Services are not currently configured to receive protected health information, and this DPA is not a Business Associate Agreement. You must not route calls or chats containing PHI through the Services unless we have signed a separate BAA and agreed a compliant configuration in writing. If a caller volunteers health information unprompted, we handle it under the security measures in Annex 2 and you should apply your own retention rules.

16. Liability and term

Each party's liability under this DPA is subject to the limitations and exclusions in the main agreement. This DPA takes effect alongside the main agreement and continues for as long as we process Personal Information on your behalf. Where this DPA conflicts with the main agreement on privacy, this DPA prevails.

Annex 1: Processing details

Annex 2: Security measures

• Encryption in transit using TLS, and encryption at rest for recordings, transcripts and databases
• Role-based access control, least privilege, and multi-factor authentication on administrative accounts
• Logical separation of each customer's data
• Audit logging of access to recordings and transcripts
• Configurable retention with automated deletion
• Regular patching of infrastructure and dependencies
• Backups with tested restoration, and a documented incident response process
• Confidentiality obligations and privacy training for all personnel with access
• Contractual security obligations imposed on every sub-processor

Signing

This DPA is accepted by using the Services. A countersigned copy for your records is available on request from theprimework.co.uk@gmail.com.