Data Processing Agreement.

1. Parties and scope.

This Data Processing Agreement (the "DPA") forms part of the agreement between Samurai Computing Ltd ("Processor", "we") and the business subscriber ("Controller", "you") that uses the team.help voice AI receptionist service (the "Service"). It applies whenever we process personal data on your behalf in connection with the Service.

Where this DPA conflicts with the Terms and Conditions, this DPA prevails on data protection matters.

2. Definitions.

"UK GDPR" means the UK General Data Protection Regulation as defined in the Data Protection Act 2018. "Personal data", "processing", "data subject", "controller", and "processor" have the meanings given in the UK GDPR. "Sub-processor" means any third party engaged by us to process personal data on your behalf.

3. Roles.

For personal data processed under the Service, you are the controller and we are the processor. We will only process personal data on your documented instructions, which include the configuration choices you make in your team.help account, your written instructions through the support channel, and the operations needed to deliver the Service set out in Annex 1.

If we believe an instruction infringes UK GDPR or other data protection law, we will tell you without undue delay.

4. Subject matter, duration, nature, and purpose of processing.

See Annex 1 for full details. In summary:

• Subject matter: handling incoming telephone calls to your business and related messaging.
• Duration: for the term of your subscription and any retention period set out in section 11.
• Nature and purpose: answering calls with an AI voice receptionist; transcribing calls; answering questions from your knowledge base; taking and confirming bookings; sending booking-related messages; integrating with your existing business systems where configured.
• Categories of data subjects: people who call your business's phone line, primarily existing and prospective customers.
• Categories of personal data: as set out in Annex 1.

5. Confidentiality.

We will ensure that anyone authorised to process personal data under this DPA is subject to a duty of confidence and only processes personal data on our instructions, which reflect yours.

6. Security.

We will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. These measures include:

• encryption of personal data in transit (TLS);
• encryption at rest of call recordings, video-room recordings, and stored calendar and mailbox credentials;
• role-based access controls and least-privilege administration;
• a log of each call recording a user deletes, recording who deleted it;
• automatic installation of operating-system security updates on our servers;
• secure software development practices;
• resilience and backup of processing systems; and
• regular review and testing of these measures.

Call recordings and video-room media are encrypted at rest under a shared encryption key common to every recording we hold, rather than a key unique to each Controller. We do not consider this a security gap: on deletion — whether at the end of the retention period set out in Annex 1 or in response to an erasure request under Clause 8 — we remove the encrypted file itself, and a shared key cannot reconstruct a file that no longer exists. This puts a deleted recording beyond use in the same way a dedicated per-Controller key would. Call recordings are kept for 30 days from the date of the call, and, for calls transferred to the Controller, the copy held by our telephony carrier (Twilio) is deleted once we have downloaded it; recordings of calls made by the Controller's staff through the Service, and voicemails, are held by Twilio until they are deleted. The Service's database is backed up to Microsoft Azure storage in the UK (London); backup copies are kept only for a limited period, for recovering from a failure, and are not used to restore data that has been deleted.

7. Sub-processors.

You give us general written authorisation to engage sub-processors. The current list is in Annex 2. We will:

• impose data protection terms on each sub-processor that are no less protective than those in this DPA;
• remain liable to you for the acts and omissions of our sub-processors as if they were our own; and
• give you reasonable prior notice (by email or in-product notice) of any intended addition or replacement of a sub-processor, so that you have an opportunity to object on reasonable data protection grounds. If you object, we will work with you in good faith to find a workable solution; if none can be found, you may terminate the affected part of the Service.

8. Assistance with data subject rights.

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to requests from data subjects exercising their rights under UK GDPR (access, rectification, erasure, restriction, portability, and objection). Where a data subject contacts us directly, we will refer them to you, except where the request is to delete a specific call recording held by us, which we will action and notify you of.

9. Assistance with the Controller's other obligations.

Taking into account the nature of processing and the information available to us, we will assist you in complying with your obligations under Articles 32 to 36 UK GDPR (security, breach notification, data protection impact assessments, and prior consultation with the ICO).

10. Personal data breaches.

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting personal data processed under this DPA. Our notification will describe (so far as known) the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures we have taken or propose to take.

11. Return or deletion on termination.

On termination of the Service, you may export your booking and customer data through the team.help admin area for 30 days. After that, we will delete or return all personal data processed on your behalf, except where we are required to keep a copy by law or for the limited audit and dispute-resolution purposes set out in our Privacy Policy.

12. Audits and information.

We will make available to you all information reasonably necessary to demonstrate compliance with our obligations under Article 28 UK GDPR. We will allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, on reasonable prior written notice, no more than once per year (unless required by a regulator or following a personal data breach), during business hours, and subject to reasonable confidentiality undertakings.

13. International transfers.

Our own copies of personal data - the application, database and its backups, call recordings, file storage, and email - are held in the United Kingdom and the European Economic Area, as set out for each sub-processor in Annex 2. Material the Controller chooses to publish publicly, such as videos and gallery images, is delivered through a content delivery network that caches copies outside that area. Groq, ElevenLabs (and, through ElevenLabs, OpenAI) and Anthropic process the content of calls and messages in the United States. The content is sent so that the AI can understand the caller and reply, and the resulting text is returned to us. Groq and Anthropic process it for that purpose only; ElevenLabs keeps a record of each telephone conversation (the transcript and audio) in our account, which we delete when a data subject asks us to delete their data. Groq, ElevenLabs and Anthropic are not permitted to use it to train their own models. Other sub-processors in Annex 2 may also process personal data outside the UK and EEA, as stated there.

Our safeguard for transfers outside the UK and EEA under Article 46 UK GDPR is the European Commission's Standard Contractual Clauses together with the UK Addendum (version B.1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018), or the UK International Data Transfer Agreement, incorporated into our data processing agreement with each provider. ElevenLabs is additionally certified under the EU - US Data Privacy Framework and its UK Extension. Calendar data: we send the AI only the free appointment times worked out from connected calendars, so it can offer them to callers. These may be processed in the US. Event titles, attendees, locations and descriptions are not sent to our AI sub-processors, and calendar data is never used to train AI models. If we propose to introduce a further sub-processor outside the UK and EEA, we will give you prior notice under section 7 and will only proceed under an appropriate transfer mechanism.

14. Liability and governing law.

The liability provisions and governing law set out in the Terms and Conditions apply to this DPA. This DPA is governed by the laws of England and Wales and the courts of England and Wales have exclusive jurisdiction.

Annex 1 - Processing details.

• Subject matter: Voice AI reception, knowledge-base answering, booking, and messaging for the Controller's business.
• Duration: The term of the subscription, plus the retention periods in our Privacy Policy.
• Nature and purpose: Answering incoming telephone calls; speech-to-text transcription; LLM-based conversation grounded in the Controller's knowledge base; booking creation and amendment; sending SMS confirmations and reminders; integration with the Controller's existing business systems where configured; AI analysis of call summaries to identify unfinished enquiries for follow-up; AI drafting of the Controller's published content and of message text.
• Types of personal data: Caller telephone number (CLI); name; enquiry details and booking history; full call audio recordings; AI-generated transcripts; call metadata (time, duration, outcome); the content of SMS, WhatsApp and website chat messages, and photos, documents and other files sent by callers or uploaded by the Controller; emails received through a connected or forwarded mailbox; public online reviews of the Controller's business, which can include reviewers' names; where a calendar integration is enabled: OAuth refresh tokens or app-specific passwords (stored encrypted), connected account email address, calendar event IDs, start/end times, event summaries, locations, free/busy status, all-day flags, ETags, sub-calendar membership, and attendee email addresses.
• Categories of data subjects: Existing and prospective customers of the Controller's business who call or message its team.help-powered phone line; the Controller's own staff or account holders whose calendar is connected to team.help.
• Special category data: None expected. Callers are asked not to volunteer special category data; any such data they nonetheless provide is processed only to the extent necessary to take the booking.

Annex 2 - Sub-processors.

The following sub-processors are engaged by us in the provision of the Service. Each entry states where that sub-processor processes personal data and, where that is outside the United Kingdom and the European Economic Area, the transfer safeguard we rely on under section 13.

• Telephony, SMS, WhatsApp and video carrier (Twilio) - call origination and termination, call recording before we download it, SMS and WhatsApp delivery, and video rooms. Location: may be processed outside the UK, including in the United States. Safeguards: the IDTA or EU Standard Contractual Clauses with the UK Addendum, incorporated into Twilio's data protection addendum.
• Application hosting (Hetzner Online GmbH) - the servers that run the team.help application, store call recordings, and run our search index and self-hosted calendar-sync infrastructure. Location: EEA (Finland).
• Database hosting, database backups, email sending, and credential storage (Microsoft Azure) - the virtual machine in the UK (London) that hosts the Service's main database; Azure Storage in the UK (London) for database backups; Azure Communication Services for outgoing email (data location: United Kingdom); Azure Key Vault for service credentials (Sweden).
• File storage and content delivery (bunny.net) - storage of photos, documents and other files sent by callers or uploaded by the Controller, and delivery of content the Controller chooses to publish. Location: storage in the United Kingdom; published content is cached by the content delivery network in locations worldwide.
• Inbound email (Amazon Web Services) - receives email sent to the Controller's team.help forwarding address before it is passed to us. Location: United Kingdom (London region).
• Speech recognition and Large Language Model inference (Groq, Inc.) - transcription of speech and generation of the AI's responses. Location: United States. Safeguards: EU Standard Contractual Clauses with the UK Addendum, incorporated into Groq's data processing addendum. Groq does not retain inference inputs or outputs by default, and we have enabled Zero Data Retention on our Groq organisation, which opts us out of the logging of inference inputs and outputs that Groq would otherwise keep for up to 30 days to troubleshoot a fault or investigate suspected abuse.
• Voice conversation (ElevenLabs, Inc.) - running the AI's telephone conversations: recognising the caller's speech and speaking the AI's responses. The language model used on calls is OpenAI's GPT-5.4 mini, which ElevenLabs engages as its own sub-processor (OpenAI, United States). Location: United States. Safeguards: EU Standard Contractual Clauses with the UK Addendum, incorporated into ElevenLabs' data processing addendum; ElevenLabs is additionally certified under the EU - US Data Privacy Framework and its UK Extension.
• AI text generation (Anthropic PBC) - AI text generation for content and message drafting; call-summary analysis. Location: United States. Safeguards: EU Standard Contractual Clauses (modules two and three) with the UK Addendum, version B.1.0, incorporated into Anthropic's data processing addendum. Anthropic is contractually prohibited from training its models on our content, and deletes inputs and outputs within 30 days of receipt or generation except where it is required to keep them longer to enforce its usage policy or by law.
• Video avatars (LiveAvatar and HeyGen) - where the Controller uses them: LiveAvatar shows an animated presenter that speaks the AI's replies to visitors on the Controller's website; HeyGen produces the Controller's marketing videos. They receive the words spoken and, where the Controller creates a video likeness, the Controller's own footage and voice; they do not receive call recordings. Location: may be processed outside the UK, including in the United States, under the safeguards in section 13.
• Search and review data (DataForSEO) - fetching the Controller's public search results and online reviews for its reputation features. Location: may be processed outside the UK, under the safeguards in section 13.
• Location lookup (postcodes.io and OpenStreetMap Nominatim) - turning a postcode or town given by a caller into a location. They receive only that postcode or place name. Location: postcodes.io, United Kingdom; Nominatim, may be processed outside the UK.
• Telephone Preference Service screening (TPS Checker) - checking a telephone number against the TPS register before the Service calls or texts it on the Controller's behalf. Location: United Kingdom.
• Payment processing (Stripe) - handling subscription payments from business subscribers and, where the Controller takes payment through the Service, payments from its customers. Location: may be processed outside the UK, including in the United States, under the safeguards in section 13.

Note on WhatsApp: WhatsApp messages also pass through Meta Platforms Ireland Limited, which operates WhatsApp. Meta processes them as an independent controller under its own terms, not as our sub-processor; the Controller accepts Meta's terms when it connects its WhatsApp Business Account.

Note on calendar-sync infrastructure: The Nango calendar-sync component runs on our own hosted infrastructure (listed above) and is operated entirely by Samurai Computing Ltd. It is not a third-party sub-processor; it is part of our infrastructure. OAuth refresh tokens for Google Calendar and Microsoft 365 integrations are held within this self-hosted environment. iCloud and CalDAV credentials are encrypted and stored in team.help's own database using ASP.NET Core IDataProtectionProvider and do not pass through Nango.

An up-to-date list of sub-processors, including the legal entity name of each, is available on request from help@team.help.

Contact.

Samurai Computing Ltd
67 Hoo Road, Meppershall, Shefford, Bedfordshire, SG17 5LP, United Kingdom
Email: help@team.help