Data Processing Agreement (DPA)

1. Roles and scope

• For customer content (the emails, events, contacts, files, messages and calls the assistant processes, and the data of the people who appear in them), the customer is the controller and Albion is the processor. If the customer is itself a processor for another controller, Albion acts as a sub-processor.
• Albion is an independent controller of account, billing, security, fraud prevention and service usage data, as set out in its Privacy Policy. This DPA does not apply to that processing.
• This DPA applies under the EU GDPR, the UK GDPR and the Data Protection Act 2018, and equivalent national laws. It takes effect when the Terms are accepted and lasts for as long as Albion processes customer data.

The processor’s representative in the EU (Article 27 GDPR): Albion Wealth Services Europe, P. I. Casería del Rey, 5, 29532 Mollina (Málaga), Spain, contact@albionwealthservices.com.

2. Subject matter, nature and purpose (Annex I)

• Subject matter: providing the personal assistant: reading, summarising, searching, drafting and sending email; managing calendars, meetings and contacts; managing tasks, reminders and files; answering calls and messages from third parties (receptionist); sending notices and briefings; querying and operating integrations connected by the customer.
• Nature of the processing: collection, recording, organisation, structuring, storage, retrieval, use, disclosure by transmission, erasure, and processing by language models.
• Duration: the term of the contract, plus the deletion period in clause 11.
• Types of data: identification and contact details (name, email, phone), content of communications, professional data, diary and event locations, files, call recordings and transcripts, and any data the customer includes in its content. The customer must not instruct the processing of special category data or criminal offence data unless it is necessary and lawful; if such data appears, it is processed only to carry out the customer’s instructions.
• Data subjects: the customer and its staff, and the contacts, clients, suppliers, guests, senders, recipients and people who call or write to the assistant.

3. Controller’s instructions

Albion will process the data only on the customer’s documented instructions, which are: these Terms, this DPA, the panel settings and the instructions the customer gives the assistant through its channels. Albion will inform the customer immediately if it considers that an instruction infringes data protection law. Albion will not process the data for its own purposes, sell it, or use it for advertising or to train AI models.

4. Confidentiality

Albion ensures that the people authorised to process the data have committed themselves to confidentiality or are under an equivalent legal obligation, and that access is limited to those who need it to provide the service, to give support at the customer’s request or for security purposes.

5. Security (Annex II)

Albion applies technical and organisational measures appropriate to the risk, including:

• Encryption in transit (TLS) and encryption at rest of integration credentials (AES-256-GCM); secrets kept out of the source code.
• Logical separation between customers and row-level access control (RLS) in the database; least privilege and separation of environments.
• Authentication of the account holder, restricted and logged internal access, and backups.
• Risk classification of the assistant’s actions, explicit confirmation before sensitive actions and an audit log of the actions carried out.
• Monitoring and alerting for errors and configuration issues, vulnerability management and updates.
• Minimisation: only the content needed for each request is sent to the AI provider.

6. Assistance to the controller

Taking into account the nature of the processing, Albion will assist the customer, through technical and organisational measures, in responding to data subjects’ requests. If a data subject contacts Albion about customer data, Albion will pass the request on to the customer without delay and will not respond unless the customer instructs it to or the law requires it. Albion will also help the customer with impact assessments, prior consultations and security obligations, to the extent reasonably necessary.

7. Personal data breaches

Albion will notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer data, with the information available to it (nature of the breach, data and people affected, likely consequences, measures taken), and will supplement it as more becomes known. The customer decides whether to notify the authority and the people affected.

8. Customer’s obligations as controller

• Having a legal basis for the processing and for entrusting it to us, and informing data subjects (including those who interact with the assistant) appropriately.
• Telling people who talk or write to the assistant that it is an automated system and, for calls, that they are transcribed or recorded, obtaining any consents required.
• Giving lawful instructions, configuring the service sensibly and connecting only accounts it is entitled to connect.
• Not sending Albion data that is not needed, or special category data without need.

9. Sub-processors (Annex III)

• The customer gives general authorisation to use the sub-processors published at /subprocessors.
• Albion will give at least 15 days’ notice of any new or replacement sub-processor (by email, WhatsApp or the panel). The customer may object on reasonable data protection grounds within that period; if no solution is reached, it may terminate the contract without penalty and receive a pro rata refund of any prepaid period not used.
• Albion imposes equivalent data protection obligations on each sub-processor and remains liable to the customer for their compliance.

10. International transfers

Data is hosted in the EU (Germany and Ireland). If a sub-processor processes data outside the EEA or the United Kingdom, Albion ensures there is a valid transfer mechanism: an adequacy decision (including the EU–US Data Privacy Framework and the UK–US data bridge), the European Commission’s standard contractual clauses (Decision 2021/914) and, for the United Kingdom, the Addendum or the IDTA, with supplementary measures where appropriate. Those clauses are incorporated into this DPA by reference where they are needed.

11. Deletion or return

When the service ends, or earlier if the customer asks, Albion will delete or return the customer’s data (as the customer chooses) within 30 days from live systems and 90 days from backups, unless the law requires it to be kept (for example, billing records for 6 years, as an independent controller). The customer can export its information from the panel or by asking for it before closure.

12. Information and audits

Albion will make available to the customer the information needed to demonstrate compliance with this DPA and will allow reasonable audits (preferably by questionnaire and documents, and on site only if the law requires it), with 30 days’ prior notice, during working hours, without compromising security or other customers’ data, and at the customer’s expense.

13. Liability

Each party’s liability under this DPA is governed by the limitation of liability clause in the Terms of Service, without prejudice to data subjects’ rights against either party or to anything that data protection law does not allow to be limited.

14. Order of precedence, law and contact

In the event of a conflict on data protection matters, this DPA prevails over the Terms. It is governed by the law that applies to the Terms, except that the standard contractual clauses are governed by the law they specify. Processor’s contact: Albion Wealth Services, Ltd, 66 Paul Street, London EC2A 4NA, United Kingdom, contact@albionwealthservices.com.

Annexes

Annex I: clause 2. Annex II: clause 5. Annex III: list of sub-processors.