Data Processing Addendum

This Addendum forms part of the Agreement. Customer is controller and Creative Communications Lab Ltd is processor for Customer Personal Data, except where either party is independently a controller under applicable law.

We process Customer Personal Data only on Customer’s documented instructions, including the Agreement, Orders, configuration and authorised support requests, unless law requires otherwise. We will notify Customer before legally required processing unless prohibited.

General acceptance does not constitute consent to shared-model training. A separate written opt-in is required.

Subject and duration: provision, security, support and termination of the Services for the Agreement term and applicable retrieval/deletion period.

Nature and purpose: storage, transmission, retrieval, organisation, routing, communications, reporting, integration, support and customer-configured AI assistance.

Data subjects: Customer users, customers, prospects, staff, suppliers and other people whose data Customer submits.

Data types: identity and contact data, communications, recordings and transcripts, account and operational records, configuration, reports, device/security data, and AI inputs and outputs.

The processing description includes information received through customer-authorised third-party connections for the configured service purpose. Restrictions associated with the source apply to copies and relevant derived information under our control. We will inform Customer if an instruction cannot be carried out lawfully or within the applicable provider restrictions and will work with Customer on a permitted alternative. This does not limit either party’s obligations under mandatory data-protection law.

People authorised to process Customer Personal Data are bound by confidentiality and receive appropriate data-protection and security instruction. Access follows least-privilege principles.

• Encryption in transit and appropriate encryption at rest.
• Role-based access, authentication controls and administrative audit records.
• Secure development, vulnerability management, logging, monitoring and incident response.
• Resilience, backup and recovery controls appropriate to the Service.
• Regular review of the effectiveness of technical and organisational measures.

Customer gives general authorisation for subprocessors needed to provide the Services. We will maintain an applicable list, impose materially equivalent data-protection obligations, remain responsible for their performance, and provide notice of material additions so Customer can raise a reasonable data-protection objection.

Taking account of the nature of processing and available information, we will reasonably assist with data-subject requests, security obligations, breach response, impact assessments, regulator consultation and demonstrations of compliance. Customer remains responsible for its instructions and controller obligations.

We will notify Customer without undue delay after becoming aware of a confirmed breach affecting Customer Personal Data and provide reasonably available information needed for Customer’s response. Notification is not an admission of fault.

Restricted transfers will use an applicable adequacy decision, the UK International Data Transfer Agreement or Addendum, approved contractual clauses, or another lawful mechanism. Customer authorises us to complete the relevant transfer modules on its behalf where incorporated by the Agreement.

During the subscription and retrieval period, Customer can obtain available Customer Personal Data through documented exports or switching procedures. The retrieval period will not be shorter than 30 calendar days unless Customer requests earlier deletion or law requires another period. This retrieval period applies only to information we are permitted to retain and make available. Where connected-service information must be deleted sooner under applicable provider requirements, the earlier deadline applies to that information, subject to mandatory law. We will explain any resulting restriction on retrieval where permitted. We then delete or anonymise the data, except legally retained records and backups that remain protected until expiry.

• AI inputs and outputs are Customer Personal Data where they contain personal data.
• AI providers process data only for the permitted service purpose.
• Customer Personal Data is not used for shared or general-purpose model training without separate written opt-in.
• Retention follows the Order, customer settings and Data Retention and Deletion Policy.
• Customer remains responsible for lawful deployment and meaningful human review.

We will provide information reasonably necessary to demonstrate compliance. Where that is insufficient, Customer may conduct a proportionate audit no more than annually, or following a material incident, subject to confidentiality, security, reasonable notice and avoidance of disruption or access to another customer’s information.