Data Processing Agreement.

01Parties and roles

1. The Customer: the firm named in the order form or service agreement [TO CONFIRM: contract name]. The Customer is the controller of the personal data of people who call its lines.
2. Klyp (trading name; legal entity and address [TO CONFIRM before first client]), data protection registration number [PENDING]. Klyp is the processor.

This agreement applies whenever Klyp processes Customer Personal Data to provide the service. If it conflicts with the service agreement on data protection, this agreement wins.

02Definitions

• Data Protection Law: the UK GDPR, the Data Protection Act 2018, and any other UK law on personal data that applies, as amended.
• Customer Personal Data: personal data Klyp processes for the Customer under the service agreement, as described in Schedule 1.
• Sub-processor: a third party Klyp engages to process Customer Personal Data.
• Regulator: the UK Information Commission (formerly the Information Commissioner’s Office).
• “Controller”, “processor”, “personal data”, “personal data breach”, “data subject” and “processing” have the meanings given in the UK GDPR.

03Processing only on instructions

1. Klyp will process Customer Personal Data only on the Customer’s documented instructions, including on transfers outside the UK, unless UK law requires otherwise. If so, Klyp will tell the Customer first unless the law forbids it.
2. The service agreement, the Customer’s settings (including whether call recording is on), and this agreement are the Customer’s instructions.
3. Klyp will tell the Customer promptly if it believes an instruction breaks Data Protection Law.
4. No training. Klyp will not use Customer Personal Data to train or improve AI models, and will not use it for its own purposes, marketing, or sale.

04The Customer’s responsibilities

1. The Customer is responsible for having a lawful basis for the processing and for giving callers the privacy information the law requires, including in its own privacy notice.
2. The Customer decides whether calls are recorded and is responsible for any call-recording notice and AI disclosure it chooses. Klyp provides recommended wording.
3. The Customer will not instruct Klyp to process data unlawfully.

05Confidentiality

1. Klyp will make sure everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality.
2. Klyp will treat all call content as confidential information of the Customer. This includes content that may be subject to legal professional privilege.
3. Access is limited to the people who need it to provide, support or secure the service.

06Security

Klyp will take the technical and organisational measures required by Article 32 UK GDPR, including those in Schedule 3. Klyp may improve these measures over time but will not reduce the overall level of protection.

07Sub-processors

1. The Customer gives general authorisation for Klyp to use Sub-processors to provide the service. Klyp will give the Customer its current list of Sub-processors on request.
2. Klyp will give the Customer at least 30 days’ notice by email before adding or replacing a Sub-processor. The Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may end the affected service without penalty.
3. Klyp will impose data protection obligations on each Sub-processor that are no less protective than these, as far as relevant to the service it provides.
4. Klyp remains liable to the Customer for its Sub-processors’ performance of those obligations.

08International transfers

1. Customer Personal Data may be processed outside the UK. Klyp will only make or allow such a transfer where the safeguards required by UK data protection law are in place.
2. Klyp will give the Customer details of the safeguard used on request.

09Helping the Customer

1. Data subject requests. Klyp will help the Customer respond to callers exercising their rights, including by finding, exporting, correcting or deleting call records. If a caller contacts Klyp directly, Klyp will pass the request to the Customer promptly and will not respond itself unless the Customer instructs it to.
2. Assessments. Klyp will give reasonable help with data protection impact assessments and any prior consultation with the Regulator.
3. Breaches. Klyp will notify and help the Customer as set out in Schedule 4.

10When the contract ends

At the Customer’s choice, Klyp will return or delete Customer Personal Data when the service ends. Unless the Customer asks for a return first, Klyp will delete it within 30 days of the end of the contract, including copies held by Sub-processors as far as their systems allow. Klyp may keep data only where UK law requires it, and will keep it confidential. Klyp will confirm deletion in writing on request.

11Information and audits

1. Klyp will make available all information needed to show compliance with Article 28 UK GDPR.
2. Klyp will allow and contribute to audits, including inspections, by the Customer or an auditor it appoints, on 30 days’ written notice, during business hours, no more than once a year unless a breach has occurred or the Regulator requires it. The auditor must be bound by confidentiality.
3. Klyp may first answer by providing written information, and Sub-processors’ certifications or audit reports where available.
4. Klyp will make information available to the Customer’s regulators, including the SRA where relevant, on request.

12General

1. Liability under this agreement is subject to the limits in the service agreement [TO CONFIRM].
2. This agreement lasts as long as Klyp processes Customer Personal Data.
3. This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
4. Data protection contact for Klyp: privacy@stakgroup.co.uk [TO CONFIRM; may route to edward@stakgroup.co.uk].

Schedule 1Processing details

Retention

Klyp keeps Customer Personal Data only as long as needed to provide the service and in line with the Customer’s instructions, and deletes it within 30 days after the service ends (section 10).

Schedule 2Sub-processors

Klyp uses Sub-processors in these categories: telephony, voice technology, hosting and storage, and email delivery. The current list is available to the Customer on request, and changes follow section 7.

Schedule 3Security measures

• Encryption in transit: data passing between Klyp, its Sub-processors and the Customer is sent over TLS.
• Encryption at rest: stored call records are encrypted at rest by the hosting provider.
• Access control: access to call data and provider dashboards is restricted to named people with individual accounts, protected by strong passwords and two-factor authentication where the provider offers it.
• Least privilege: people and system components get only the access they need. API keys are held as environment secrets, not in code.
• Logging: access to and changes in systems holding call data are logged, and logs are reviewed when an incident is suspected.
• Confidentiality: everyone with access is bound by confidentiality (section 5).
• Retention and deletion: data is deleted on the schedule in Schedule 1.
• Sub-processor due diligence: Klyp reviews each provider’s security and data protection terms before use.

Schedule 4Personal data breaches

1. Klyp will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. This gives the Customer time to meet its own 72-hour duty to notify the Regulator.
2. The notice will go to the Customer’s nominated contact by email and phone, and will include as far as known: what happened; the categories and approximate number of callers and records affected; likely consequences; and the steps taken or proposed. Klyp will send further information as it becomes available.
3. Klyp will take reasonable steps to contain the breach and reduce its effects, and will help the Customer with notifications to the Regulator and to affected callers.
4. Klyp will not notify the Regulator or callers about a breach of Customer Personal Data without the Customer’s agreement, unless the law requires it.