Data processing agreement

This agreement forms part of the terms of service between the operator of Replyline (the processor) and the business using Replyline (the controller), as required by Article 28 of the UK GDPR.

1. What is processed

• Subject matter and purpose: providing Replyline: capturing enquiries, storing contacts and conversations, sending messages, reminders and follow-ups, AI-assisted drafting when the controller enables it, and reporting.
• Duration: for as long as the controller uses the service, then until deletion under clause 8.
• Data subjects: the controller's prospective and existing customers, and its staff using the service.
• Personal data: names, email addresses, phone numbers, social media handles and ids, enquiry and message contents, appointment details, marketing consent records. The service isn't designed for special category data; the controller should not ask customers to send it.

2. Instructions

We process the personal data only on the controller's documented instructions (its use and configuration of the service is its instruction), unless the law requires otherwise, in which case we'll tell the controller first unless the law forbids it. We'll tell the controller if we think an instruction breaks data protection law.

3. Confidentiality

Everyone we authorise to process the data is bound by confidentiality.

4. Security

We maintain appropriate technical and organisational measures, including: each business's data separated at the database level by row-level security; encryption in transit (TLS) and at rest; stored access tokens encrypted with AES-256-GCM; passwords stored as salted scrypt hashes; access to production limited to named people; audit logs of sensitive actions; backups.

5. Sub-processors

The controller authorises the sub-processors listed on our sub-processors page. We give at least 30 days' notice of a new one by email to the account owner; the controller may object on reasonable data protection grounds and, if we can't resolve it, end the agreement. We impose the same data protection obligations on each sub-processor and remain liable for them.

6. Helping the controller

Taking into account the nature of the processing, we help the controller respond to data subject requests (the service includes export and erasure for each contact), and with security, breach notification, data protection impact assessments and consultation with the ICO.

7. Personal data breaches

We notify the controller without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting its data, with the information it needs to meet its own obligations.

8. Deletion or return

The controller can export its data at any time. When the agreement ends we delete the controller's personal data within 90 days, unless the law requires us to keep it. Backups are overwritten on their normal cycle.

9. Audits

We make available the information needed to demonstrate compliance with this agreement and allow for audits, including inspections, by the controller or an auditor it appoints, on reasonable notice and subject to confidentiality.

10. International transfers

Where a sub-processor processes data outside the UK, we ensure it is covered by UK adequacy regulations, the UK International Data Transfer Addendum, or the UK–US data bridge.

Questions about this agreement: hello@replyline.co.uk.