This Data Processing Agreement ("DPA") is entered into between Saltara AI (a limited company registered in England and Wales), Suite 195-197 Wood Street, London E17 3NU (the "Processor"), and the business client engaging Saltara AI to operate an AI-powered WhatsApp booking service (the "Controller").
This DPA forms part of and supplements the Terms and Conditions agreed between the parties. In the event of any conflict between this DPA and the Terms and Conditions, this DPA shall take precedence in respect of data protection matters.
Children's Data means Personal Data relating to individuals under the age of 18, applicable where the Controller's business involves services to or involving children.
The above definition applies in addition to all standard definitions in this document.
The Processor shall process Personal Data for the purpose of providing the Services to the Controller, specifically the operation of an AI-powered WhatsApp booking system on the Controller's behalf.
Processing shall continue for the duration of the engagement between the parties and for such period as is necessary to fulfil the Processor's obligations upon termination, including secure deletion of Personal Data in accordance with clause 7.
Processing activities include: collection of Personal Data via WhatsApp messaging, storage and transmission of booking data, AI-assisted processing of booking requests, and transmission of booking information to the Controller.
Personal Data is processed solely for the purpose of operating the booking service on behalf of the Controller and fulfilling bookings or service enquiries made by Data Subjects.
Depending on the nature of the Controller's business, the following categories of Personal Data may be processed:
Where the Controller's business involves services to or involving children, the following additional categories of Personal Data may be processed:
The above categories apply in addition to all standard categories in this clause.
Data Subjects include end users of the booking service — individuals who interact with the WhatsApp booking bot to request services or make bookings on their own behalf or on behalf of others.
Where Children's Data is processed, Data Subjects also include children on whose behalf a parent or guardian makes a booking. The Processor does not knowingly interact directly with children via the Service.
The above applies in addition to all standard clauses in this section.
The Processor shall process Personal Data only on the documented instructions of the Controller, as set out in this DPA and the Terms and Conditions, unless required to do so by applicable law.
The Processor shall ensure that all persons authorised to process the Personal Data are subject to appropriate obligations of confidentiality.
The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:
The Controller hereby provides general authorisation for the Processor to engage the following Sub-processors:
The Processor shall notify the Controller of any intended changes to Sub-processors, giving the Controller the opportunity to object.
The Controller confirms that it has reviewed the Sub-processor arrangements above and accepts them as appropriate for the processing of Children's Data. The Processor shall ensure Sub-processors apply enhanced security measures where Children's Data is involved.
The above applies in addition to all standard clauses in this section.
The Processor shall assist the Controller in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under UK GDPR, including rights of access, rectification, erasure, restriction, portability, and objection.
The Processor shall notify the Controller without undue delay, and in any event within 48 hours, upon becoming aware of a personal data breach involving Personal Data processed under this DPA.
The Controller warrants and confirms that:
Where the Controller's business involves services to or involving children, the Controller additionally warrants that:
The above obligations apply in addition to all standard clauses in this section.
Where Personal Data is transferred outside the United Kingdom, the Processor shall ensure that appropriate safeguards are in place in accordance with UK GDPR Chapter V, including Standard Contractual Clauses approved by the ICO.
Children's Personal Data (name and date of birth): maximum 12 months from date of booking. Children's Data must be deleted immediately upon request from a parent or guardian, regardless of the standard retention period.
The above applies in addition to all standard clauses in this section.
Upon termination, the Processor shall, at the Controller's election, return or securely delete all Personal Data within 30 days. The Processor shall provide written confirmation of deletion upon request. This obligation extends to all Sub-processors.
The Processor shall permit and contribute to audits conducted by the Controller or an appointed third-party auditor, provided that reasonable notice is given (not less than 30 days), audits are conducted no more than once per year in normal circumstances, and the Controller bears the cost of any audit it commissions.
Each party's liability under this DPA shall be subject to the limitations and exclusions set out in the Terms and Conditions. Nothing in this DPA shall limit either party's liability for death or personal injury caused by negligence, fraud, or any liability that cannot be excluded by law.
This DPA is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.
The Processor may update this DPA from time to time. The Processor will provide at least 30 days' written notice of material changes. Continued use of the Services after that period constitutes acceptance of the updated DPA.
By engaging Saltara AI's Services, the Controller confirms acceptance of this Data Processing Agreement.