Template for the MVP. Placeholders are marked [like this]. Have a UK solicitor review before launch.
Data Processing Agreement
This DPA forms part of the agreement between the customer (“Controller”) and Nuova AI Ltd (“Processor”) and meets the requirements of article 28 of the UK GDPR.
1. Subject matter and duration
The Processor processes personal data to provide AI chat assistants on the Controller's websites and software, for as long as the Controller uses the service, plus the deletion period in clause 8.
2. Nature and purpose
Hosting, retrieval-augmented answering of visitor questions, lead capture, human handoff, analytics and support.
3. Data subjects and categories of data
- Website visitors: chat messages, contact details and comments they choose to provide (name, email, phone, a free-text comment), page URL, timestamps, feedback.
- Controller staff: names, email addresses, replies sent from the inbox.
The service is not designed for special category data; the Controller should instruct visitors not to share it.
4. Processor obligations
- Process only on the Controller's documented instructions (these terms and the Controller's configuration).
- Ensure staff are bound by confidentiality.
- Implement appropriate technical and organisational measures: encryption in transit and at rest, per-tenant isolation enforced by database row-level security, least-privilege access, audit logging, rate limiting and backups.
- Never use Controller data to train AI models, and contractually prohibit sub-processors from doing so.
- Assist the Controller with data subject requests (built-in export and erasure tools), DPIAs and breach notifications.
- Notify the Controller without undue delay, and in any case within [48] hours, of a personal data breach.
5. Sub-processors
The Controller authorises the sub-processors listed at /legal/sub-processors. The Processor will give [30] days' notice of changes, during which the Controller may object.
6. International transfers
Transfers outside the UK rely on adequacy regulations, the UK–US data bridge or the ICO International Data Transfer Addendum.
7. Audits
The Processor will make available information necessary to demonstrate compliance, and allow audits by the Controller or its mandated auditor on reasonable notice [once per year].
8. Return and deletion
On termination the Controller may export its data; the Processor deletes it within [30] days, unless law requires retention. Automatic retention settings apply throughout.
Signed for the Processor: [name, title, date] · Signed for the Controller: [name, title, date]