Data Processing Agreement (template)¶
Draft: needs the owner's lawyer review. Not legal advice. Replace every
<...>before sending. Terms follow UK GDPR / EU GDPR Art. 28. The Standard Contractual Clauses and the UK Addendum are attached by reference, not reproduced.
Between
1. Subject matter and duration¶
Provider runs the Bill & Ben agents (Teams chat and meetings, console, Helmora) for Customer. Processing lasts for the subscription term and the deletion period in section 10.
2. Nature, purpose, data and people¶
- Nature and purpose: hosting and running AI agents on Customer's instructions; speech-to-text, summarising, answering, task execution.
- Data: chat and meeting text, meeting audio and transcripts, task inputs and outputs, user names, emails and identifiers, usage records.
- People: Customer's staff and guests who talk to or are heard by the agents.
3. Instructions¶
Provider processes only on Customer's documented instructions (the agreement, console settings, API calls) and tells Customer if an instruction infringes data protection law. Customer's settings (permissions, retention per data class, model allow-list) are instructions.
4. Confidentiality and security (Art. 32)¶
People with access are bound by confidentiality. Measures: per-tenant isolation (row-level security, a separate agent environment for each tenant), permission checks
on every action, hash-chained audit log, encryption in transit, backups kept by rotation (7 daily, 4 weekly and 12 monthly copies, so about 12 months). The
full list is annexed as Annex 2
5. Sub-processors¶
Customer gives general authorisation for the sub-processors in the Sub-processors list. Provider gives 30 days notice of a change; Customer may object in writing within that period. If the parties cannot agree, Customer may terminate the affected service. Provider imposes equivalent terms on each sub-processor and stays liable for them.
6. International transfers¶
Transfers outside the UK or EEA rely on: EU Standard Contractual Clauses (module 2 controller to processor, module 3 processor to processor
for Customer-as-processor cases) and the UK International Data Transfer Addendum, plus a transfer risk assessment per US sub-processor.
7. Data subject rights¶
Provider assists Customer with access, erasure and other requests through the privacy tools: export of a person's or the tenant's data in a zip within 72 hours, and deletion (a person is replaced in the audit log by a tombstone id; a tenant's rows, volumes, model team and identity org are removed; billing records are kept minimised for tax). Some stores cannot erase one person (agent session files, meeting recording vendor); Provider says so in the request result and removes them with tenant deletion or retention.
8. Breach notification¶
Provider notifies Customer without undue delay and within <48> hours of becoming aware of a personal data breach, with the information Art. 33(3) needs.
9. Audits¶
Provider provides the information needed to show compliance and allows audits by Customer or its auditor, with <30 days> notice, once a year unless a breach requires more. Provider's audit log verification report can be given as evidence.
10. Return and deletion¶
On termination Provider exports Customer's data on request, then deletes it within <30 days>; backup copies are not erased on request and expire by rotation, up to about 12 months later (
11. AI-specific terms¶
The agents tell people they are AI and that meetings are recorded (see the AI transparency notice). Customer is responsible for a lawful basis for recording and for informing its own meeting guests where its law requires consent.
12. Liability and law¶
Annexes¶
- Processing details (sections 1 and 2 expanded). 2. Security measures. 3. Sub-processors (the Sub-processors list). 4. SCC and UK Addendum.