Data Processing Agreement

This agreement covers the personal data of your customers that Aira processes for you. It forms part of our Terms of Service, and you agree to it when you agree to them.

1. Who's who

Your business (“you”) is the controller of your customers' personal data: you decide why and how it's used. SH Tech Limited, company number 17137266, which provides Aira (“we”, “us”), is your processor: we process that data on your behalf, only to provide Aira to you.

Words such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in the UK GDPR and the Data Protection Act 2018 (“data protection law”).

2. What we process

Subject matter and purpose

Receiving and replying to the messages your customers send you on Instagram, Facebook Messenger and WhatsApp; working out when a conversation needs a person and summarising it; offering appointment times and logging bookings through Calendly; and showing all of this to you in Aira.

Whose data

People who message your connected accounts, and people who book with you through a link Aira sends.

Types of data

• Names, usernames and account IDs on Instagram, Messenger and WhatsApp, including WhatsApp phone numbers.
• Message content, and photos and screenshots sent in messages.
• Details shared in a conversation, such as a phone number, an email address or a request for a call back.
• Booking details from Calendly, such as the invitee's name, email address, phone number and answers to your booking questions.
• Summaries of conversations and the follow-up items Aira creates from them.

Customers sometimes share information about their health or other special category data in a message, especially with clinics. You're responsible for having a lawful basis, and a condition under data protection law, for processing it.

How long

For as long as we provide Aira to you, and then until the data is deleted under section 9.

3. Your instructions

We process your customers' personal data only on your documented instructions. These terms, the Terms of Service, and the settings you choose in Aira are your instructions. We'll process it differently only where the law requires us to, and if so we'll tell you first unless the law forbids that.

We'll tell you if we think an instruction breaks data protection law.

4. Your responsibilities

You're responsible for making sure your use of Aira, and your instructions, comply with data protection law: that you have a lawful basis for the processing, that you give your customers the privacy information they need, and that you handle their requests to use their rights.

5. Confidentiality and security

Everyone at SH Tech Limited who can access your customers' personal data is bound by a duty of confidentiality, and only accesses it when they need to: to give you support you've asked for, to fix a problem, or where the law requires it.

We use technical and organisational measures appropriate to the risk, as data protection law requires. They include:

• encryption of data in transit, and of the credentials that connect your accounts;
• access controls that limit our staff's access to what they need, and a record of staff access to customer accounts;
• checks that incoming data really comes from the services you've connected; and
• automatic deletion of the photos customers send, after the period you choose.

We review these measures and may update them, as long as the protection they give doesn't go down.

6. Sub-processors

You authorise us to use other companies (“sub-processors”) to help provide Aira, such as our hosting, AI, email, SMS and notification providers. We'll give you the current list on request.

We'll tell you by email before we add or replace a sub-processor that processes your customers' personal data, so you can object. If you object on reasonable data protection grounds and we can't address your concern, you can end the agreement by cancelling your plan and deleting your account.

Each sub-processor is bound by a written contract with data protection obligations that are no less protective than this agreement. We remain responsible to you for what they do.

7. Transfers outside the UK

Some sub-processors are based outside the UK, mainly in the United States. We transfer your customers' personal data outside the UK only where data protection law allows it: to a country the UK recognises as adequate, or with safeguards it approves, such as the UK International Data Transfer Agreement or Addendum.

8. Helping you

• Customers' rights. If one of your customers asks us to use their data protection rights, we'll pass the request to you and won't answer it ourselves unless you ask us to. We'll help you respond, for example by deleting a customer's conversation when you ask us to.
• Compliance. We'll give you reasonable help with your duties on security, breach notification, data protection impact assessments and consulting the Information Commissioner's Office, taking into account what we process and the information we have.
• Breaches. If we become aware of a personal data breach affecting your customers' personal data, we'll tell you without undue delay, with the information you reasonably need to meet your own obligations, and we'll take reasonable steps to limit its effects.

9. When the agreement ends

When you delete your account, we delete your customers' personal data, except where the law requires us to keep it. Any backup copies are deleted as they are overwritten in the normal course. If you want a copy of your conversations first, ask us before you delete your account.

Photos customers send are deleted throughout, after the period you choose in Teach Aira.

10. Audits

We'll give you the information you reasonably need to show that we meet the obligations in this agreement. If that isn't enough, you or an auditor you appoint, who is bound by confidentiality, may audit our compliance on at least 30 days' notice, during business hours, no more than once a year (unless a regulator requires it or after a personal data breach), and at your cost.

11. General

This agreement is part of the Terms of Service, and the limits on liability in the Terms of Service apply to it. If they conflict on how we process your customers' personal data, this agreement wins. It's governed by the law of England and Wales.

Questions about this agreement: support@aira-ai.uk.