Data Processing Agreement
The template agreement we sign with every client before we handle their customers' personal data.
This template is completed for each client. It sets out the terms required by Article 28 of the UK GDPR.
1. Parties
Controller: [client business name, company number and address] ("the Client").
Processor: RAMCo Property Ltd, trading as Ask Dave AI, company number 11906139, registered office c/o Black Fox Advisers Limited, Fletchers Business Centre, Grendon Road, Polesworth, B78 1NS ("Ask Dave AI").
2. Subject Matter and Duration
Ask Dave AI processes personal data only to set up, run and support the automations described in the Client's order. This agreement lasts as long as Ask Dave AI processes personal data for the Client.
3. Ask Dave AI's Obligations
Ask Dave AI will:
- process personal data only on the Client's documented instructions, including on transfers outside the UK, unless the law requires otherwise (in which case it will tell the Client first, where allowed);
- make sure everyone authorised to process the data is bound by confidentiality;
- take appropriate technical and organisational security measures, as required by Article 32 UK GDPR (see Annex 2);
- only use sub-processors with the Client's prior written authorisation, under a written contract with the same data protection obligations, and tell the Client of any intended changes so it can object (current sub-processors are listed in Annex 3);
- help the Client respond to requests from people exercising their data protection rights;
- help the Client meet its obligations on security, personal data breach notification, data protection impact assessments and prior consultation with the ICO;
- at the end of the services, delete or return all personal data, as the Client chooses, unless the law requires it to be kept;
- make available the information needed to show compliance with this agreement, and allow for and contribute to audits and inspections by the Client or an auditor it appoints.
4. Personal Data Breaches
Ask Dave AI will tell the Client without undue delay, and in any event within [48 hours], after becoming aware of a personal data breach affecting the Client's data, and give the information the Client needs to meet its own reporting duties.
5. International Transfers
Ask Dave AI will only transfer personal data outside the UK where there is an adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum.
6. The Client's Obligations
The Client confirms it has a lawful basis for the processing, has given people the required privacy information (including that they may speak to an AI), and has obtained any consents needed under UK GDPR and PECR.
Annex 1: Details of Processing
| Nature and purpose | [for example: answering missed calls, sending booking reminders, chasing quotes and invoices, requesting reviews] |
|---|---|
| Types of personal data | [for example: names, phone numbers, email addresses, call recordings and transcripts, booking and invoice details] |
| Special category data | [none, or describe, for example health information for clinics, with the extra safeguards agreed] |
| Categories of data subjects | [for example: the Client's customers, enquirers, tenants, patients or staff] |
| Retention | [as instructed by the Client] |
Annex 2: Security Measures
- Access limited to the people who need it, with strong passwords and two-factor authentication.
- Data encrypted in transit, and at rest where the tool allows.
- Only the minimum personal data needed is sent to AI tools.
- Regular checks that automations work as expected, with logs kept of changes.
- [any further measures agreed with the Client]
Annex 3: Approved Sub-Processors
[List each tool used for this Client, for example telephony, messaging, automation platform and AI model provider, with its location and transfer safeguard.]
Signatures
Signed for the Client: [name, role, date]
Signed for Ask Dave AI: [name, role, date]