Data Processing Agreement.

1. What is processed

Subject matter	Answering the Customer's calls with an AI assistant, taking messages, texting callers, sending summaries, transferring calls; hosting the Customer's website and any enquiry form on it
Duration	The term of the service, plus the retention periods in section 6
Nature and purpose	Automated call answering, speech recognition and synthesis, message taking, notifications, appointment booking where the plan includes it, form delivery
Personal data	Caller's voice, name, telephone number, the reason for the call and anything the caller says; for websites, whatever the enquiry form collects
Data subjects	The Customer's callers, prospective and existing customers, and anyone who fills in a form on the Customer's website
Special category data	Not intended. If the Customer expects callers to disclose health or other special category data, the Customer tells Frame Empire and recording is switched off for that assistant (Terms, clause 8)

2. Frame Empire's obligations

Frame Empire will:

1. process the personal data only on the Customer's documented instructions, which are the Terms, the order, the assistant's script and any written instruction from the Customer, unless required to do otherwise by UK law, in which case Frame Empire tells the Customer first where the law allows;
2. tell the Customer immediately if, in its opinion, an instruction breaks data protection law;
3. make sure everyone with access to the data is bound by confidentiality;
4. apply the security measures in section 5;
5. engage sub-processors only as section 4 allows;
6. help the Customer, by appropriate technical and organisational measures, respond to requests from data subjects (access, erasure, objection and the rest), at no charge for a reasonable number of requests;
7. help the Customer meet its own obligations on security, breach notification, data protection impact assessments and consultation with the Information Commissioner, taking into account what Frame Empire knows;
8. notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, with what it knows about the nature of the breach, the data and people affected, the likely consequences and the steps taken;
9. at the end of the service, delete the personal data or return it to the Customer, at the Customer's choice, and delete remaining copies within 30 days, unless UK law requires it to be kept;
10. make available the information needed to show compliance with this agreement, and allow and contribute to audits by the Customer or an auditor the Customer appoints, on 14 days' written notice, no more than once a year unless a breach has occurred, during working hours, without disrupting the service.

3. The Customer's obligations

The Customer is responsible for the lawfulness of the processing it instructs: for telling its callers that calls are answered by an assistant and recorded (the assistant says so at the start of every call, and the Customer keeps that announcement on), for its own privacy notice, and for the content of the script. The Customer will not instruct processing that would put Frame Empire in breach of the law.

4. Sub-processors

The Customer gives general written authorisation to the sub-processors in the current list, by category: telephony providers (to carry the calls and send texts), speech and language model providers (to understand and reply), and hosting providers (for the website, forms and Frame Empire's records). The named list is available on request from hello@frameempire.co.uk and is sent to the Customer at the start of the service. Frame Empire will tell the Customer at least 14 days before adding or replacing a sub-processor; the Customer may object in writing within that period on reasonable data protection grounds, and if the objection cannot be resolved either party may end the affected service without penalty. Frame Empire imposes on every sub-processor, by written contract, obligations no less protective than these, and remains fully liable to the Customer for their performance.

5. Security

Frame Empire keeps: access to call data restricted to named people with a business need, behind individual logins; encryption in transit between every component; recordings and transcripts held only by the providers in section 4 under their security certifications, not on personal devices; deletion on the schedule in section 6; a record of who accessed what; and a breach procedure that meets section 2.8.

6. Retention

Data	Kept for
Call recordings	30 days, then deleted
Transcripts and call summaries	12 months, then deleted
Text and email summaries sent to the Customer	The Customer's own records
Enquiry form submissions	12 months from the last contact
Records after the service ends	Deleted or returned within 30 days (section 2.9)

7. International transfers

Some sub-processors process data outside the United Kingdom, mainly in the United States. Every such transfer is covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or by a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified). Frame Empire keeps a transfer risk assessment for each and shows it to the Customer on request.

8. Liability and term

Each party's liability under this agreement is subject to the liability clause in the Terms, except that nothing limits liability to a data subject under Article 82 UK GDPR. This agreement lasts as long as Frame Empire processes personal data for the Customer.

9. Signing

This agreement is accepted when the Customer accepts the Terms (by paying the setup fee or the first invoice), and is countersigned on request.

Frame Empire Ltd, registered in England and Wales, Company No. 16163944. Registered office: 4 Thameshill Avenue, Romford, Essex, RM5 3BU.