Data Processing Agreement

1. Who this is between

AI Profit Centres Ltd (AI Profit Centres Limited), company number 17421191, registered office 20 Wenlock Road, London N1 7GU; trading from 31-C Block, Balby Court Business Campus, Balby Carr Bank, Doncaster DN4 8DE; support@aiprofitcentres.com ("AIPC", "we", "us") — the processor.

The customer named on the order or payment record ("you") — the controller.

2. What this agreement covers

Your customers' personal data: the details of people who contact your business through your Talking Website or its voice agent (Ollie).

When someone contacts your business, they are giving their details to you, for your purposes — getting back to them and booking the work. That makes you the data controller. AIPC runs the system that takes the enquiry and gets it to you, on your instructions. That makes AIPC the data processor.

It does not cover your own details as an AIPC customer (your business name, contact details, payment records). For those, AIPC is the controller and our privacy policy applies.

3. The processing

Subject matter: answering enquiries through the Talking Website's AI voice agent and getting each enquiry to you.

Duration: for as long as you are an AIPC customer, plus the retention period in section 8.

Nature: the voice agent takes the call, records and transcribes it, and sends you a notification of the enquiry by email, text message or both, as you choose.

Purpose: so your business can respond to and book work from people who contact you. Nothing else.

Data subjects: members of the public who contact your business through your Talking Website.

Personal data: name, phone number, the date and time they're after, what they say about the job, and the call recording and transcript.

Special category data: none is asked for. The voice agent does not ask about health, religion or any other special category.

How it works: the caller talks to Ollie. Ollie's software (ElevenLabs) emails you an enquiry notification with the date and time, name and phone number. If you choose text notifications, the same details are sent to your mobile by text message through TextMagic. The call record stays in the voice agent account until it is deleted under section 8.

4. What AIPC commits to

Your instructions only. We process your customers' data only to provide the service described above, or as you ask us in writing. We never use it for our own purposes — we never market to your customers, and we never sell or share their details.

Confidentiality. Routine access to call records is limited to Martin Clarke, to run and support the service. Anyone else we authorise is bound by confidentiality.

Security. We keep the data secure with measures suited to the risk (section 5).

Sub-processors. We only use the sub-processors in section 6, each bound by data protection terms at least as protective as these.

Rights requests. If one of your customers asks what's held about them, or asks for it to be corrected or deleted, we help you respond. If they contact us directly, we pass it to you without delay and don't answer it ourselves.

Breaches. We tell you within 24 hours of becoming aware of a personal data breach affecting your customers' data — leaving you time to meet the 72-hour ICO reporting deadline if it applies. We tell you what happened, what data was involved and what we're doing about it, and help you with any report or notice.

Assessments. If you need a data protection impact assessment, or the ICO asks you for one, we give you the information about our processing you need.

End of service. When the service ends, we delete or return your customers' data at your choice (section 8).

Showing compliance. We give you the information you reasonably need to show we're meeting this agreement, and answer reasonable written questions within 14 days.

Unlawful instructions. If we think an instruction from you would break data protection law, we tell you straight away.

5. Security measures

Encryption in transit: the website is served only over HTTPS, and calls and data to our providers travel over encrypted connections.

Encryption at rest: our providers encrypt stored data by default.

Access control: provider accounts are protected with strong passwords and two-factor authentication where available, and access is limited to Martin Clarke.

Minimisation: the voice agent asks only for what's needed to get back to the caller and book the job.

AI tools: the AI tools used to build and run AIPC's systems have no routine access to your customers' data. Access is allowed only in a genuine emergency (a crash, bug, suspected hack or data corruption), and only to diagnose and contain it. The reason is logged before any access, and what was fixed and exactly what data was seen is logged afterwards. We tell you as soon as practical if your customers' data was involved.

Review: we review these measures at least once a year and whenever the service changes.

6. Sub-processors

ElevenLabs — runs the voice agent: call audio, transcript, and the enquiry email notification sent to you. US/EU; covered by ElevenLabs' data processing terms with Standard Contractual Clauses and the UK Addendum.

TextMagic — sends enquiry notifications to your mobile by text message, if you choose text notifications: the caller's name, phone number, and the date and time they're after. UK company, data stored in Europe; covered by TextMagic's data processing terms.

Vercel — hosts the Talking Website the voice agent runs on. US; covered by Vercel's data processing terms with Standard Contractual Clauses and the UK Addendum.

Anthropic, Anysphere (Cursor) and Google (Antigravity) — emergency access only, as in section 5. No routine access. US; covered by each provider's terms.

Railway (AIPC's hosting provider, data processing agreement signed 24 September 2026) hosts AIPC's own business systems. It does not hold your customers' enquiry data; if that ever changes, it will be added here under section 7.

Missed-call text-back: where included in your service, the text-back provider will be added here under section 7 before it goes live.

7. Changes to sub-processors

We give you at least 14 days' notice by email before adding or replacing a sub-processor that handles your customers' data. If you have a reasonable data protection objection, tell us within that period. If we can't resolve it, you can cancel with no further charges.

8. Retention and what happens at the end

Call records (audio and transcript) are kept in the voice agent account for 12 months from the date of the call, then deleted.

Enquiry emails are delivered to your inbox. How long you keep them after that is up to you as the controller.

When the service ends, you can ask for a copy of the call records we still hold within 30 days. After that they are deleted, unless the law requires us to keep something longer.

9. Your responsibilities as controller

Tell your customers how you use their details. AIPC includes a short privacy notice on your Talking Website naming your business as the controller and AIPC as the processor.

Deal with requests from your own customers (with our help under section 4).

Only give us lawful instructions.

10. International transfers

Some sub-processors are based outside the UK. Where data leaves the UK, it is protected by the provider's approved safeguards: the UK International Data Transfer Addendum, Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.

11. Liability

Each party is responsible for its own breaches of data protection law and of this agreement. Nothing in this agreement limits either party's liability where UK law does not allow it to be limited. AIPC holds business insurance, including negligence cover.

12. Order of precedence and law

If this agreement and the terms of service conflict about your customers' personal data, this agreement wins. It is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.