Data Processing Agreement

1.Roles of the parties

For personal data contained in Customer Data, you act as the controller and we act as the processor. You determine the purposes and means of processing; we process only on your documented instructions. For data we collect about your account and administrators, we act as controller under our Privacy Policy.

2.Scope and subject matter

The subject matter is the provision of the Service. The duration is your subscription term plus the retention periods below. The nature and purpose is hosting, storing and processing Customer Data so you can manage client relationships. The categories of data subject are your clients, prospects and personnel.

3.Our processing instructions

We process personal data only to provide, secure, maintain and support the Service, to comply with law, and as otherwise instructed by you in writing. We will inform you if we consider an instruction to breach applicable data protection law.

4.Prohibition on AI and model training

We do not use Customer Data to train, fine-tune, or otherwise develop machine learning or artificial intelligence models, whether our own or a third party’s. We do not sell Customer Data, share it with data brokers, or make it available to any third party for their own purposes.

Where an Omnir feature uses a third-party AI service, it will be documented, will process only the data necessary for the feature, and will be provided under terms that contractually prohibit that provider from retaining or training on your data.

5.Confidentiality of personnel

Access to personal data is restricted to personnel who need it to perform their role, who are bound by confidentiality obligations, and who receive training appropriate to their access.

6.Security measures

We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control with least privilege, logging and monitoring, regular backups with tested restoration, vulnerability management, and periodic independent testing. Details are summarised on our Security page.

7.Sub-processors

You authorise us to engage sub-processors to provide the Service — including infrastructure hosting, email delivery, payment processing and error monitoring. Each is bound by data protection obligations no less protective than this DPA. A current list is available on request, and we give notice before adding or replacing a sub-processor so you may object on reasonable data protection grounds.

8.Assistance with data subject rights

The Service provides functionality allowing you to access, correct, export and delete personal data yourself. Where a data subject contacts us directly, we will refer them to you and will assist you in responding, taking into account the nature of the processing.

9.Personal data breach notification

We will notify you without undue delay, and in any event within seventy-two hours, after becoming aware of a personal data breach affecting Customer Data. The notification will describe the nature of the breach, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed.

10.International transfers

Where personal data is transferred outside its country of origin, we rely on an appropriate transfer mechanism, including Standard Contractual Clauses where required. Regional data residency is available on the Business plan.

11.Audits

On reasonable written notice and no more than once a year, we will make available the information necessary to demonstrate compliance with this DPA, including third-party audit reports and completed security questionnaires. On-site audits may be arranged where a supervisory authority requires them.

12.Deletion and return

You may export Customer Data at any time during the subscription and for thirty days after termination. After that period we delete Customer Data from live systems, and from backups within a further thirty-five days, except where retention is required by law.