Data Processing Agreement

1. Scope and roles

This Data Processing Agreement forms part of the IvyAI Terms between IvyAI Ltd as processor and the customer as controller. It applies to personal data processed by IvyAI on the customer's behalf. Terms such as controller, processor, data subject and personal data have the meanings in UK data protection law.

2. Customer instructions

IvyAI will process personal data only on the customer's documented instructions, including to provide, secure and support the service, and as required by law. The Terms, account configuration and lawful support requests constitute instructions. We will tell the customer if an instruction appears to infringe data protection law, unless prohibited.

3. Confidentiality and security

Anyone authorised to process personal data is bound by confidentiality. IvyAI will maintain appropriate technical and organisational measures, including access control, authentication, tenant separation, encryption in transit, monitoring, vulnerability management, backup controls and incident response, taking account of risk, cost and the state of the art.

4. Subprocessors

The customer gives general authorisation for the subprocessors on our Subprocessors page. We will impose materially equivalent data protection obligations and remain responsible for their processing as required by law. We will give reasonable notice of a new subprocessor. The customer may object on reasonable data protection grounds before the change takes effect. We will work in good faith on a solution, which may include discontinuing the affected feature.

5. Assistance

Taking account of the processing, IvyAI will reasonably assist the customer with data subject requests, security obligations, breach notifications, data protection impact assessments and regulator consultations. The customer remains responsible for responding to data subjects and determining whether a notification is required.

6. Personal data breaches

IvyAI will notify the customer without undue delay after becoming aware of a personal data breach affecting customer data. We will provide available information about its nature, likely consequences, affected data, mitigation and contact point, and provide updates as the investigation progresses.

7. International transfers

IvyAI will not make a restricted transfer of UK personal data without a lawful transfer mechanism. Where needed, the UK Addendum or International Data Transfer Agreement and relevant supplementary measures will apply. The customer authorises transfers required by the listed subprocessors subject to these safeguards.

8. Return and deletion

On termination and at the customer's choice, IvyAI will delete or return customer personal data, unless law requires retention. Operational deletion follows the published retention schedule, including a normal closed or read-only period of up to 30 days and backup rotation. The customer should export required data before closure.

9. Information and audits

IvyAI will provide information reasonably necessary to demonstrate compliance. Audits should first use current policies, test summaries and provider assurance documents. If that is insufficient, the customer may request a proportionate remote audit no more than once annually, except after a material incident or regulator request. Audits require reasonable notice, confidentiality, minimal disruption and no access to other customers' data or security-sensitive material. Each party bears its own costs unless a material breach is found.

10. Processing schedule

• Subject: provision of IvyAI booking and business administration services.
• Duration: the account term plus the documented retention and deletion period.
• Nature and purpose: collecting, storing, organising, displaying, transmitting, securing, supporting and deleting booking and account data.
• Data subjects: customer personnel, authorised users, booking customers and people contacting support.
• Data: names, contact details, account identifiers, business roles, booking details, service and location selections, administrative messages, technical logs and support correspondence.
• Special category data: not intended or permitted in IvyAI V1.

11. Priority

If this Agreement conflicts with the Terms on processing personal data, this Agreement prevails. It is governed by the law and jurisdiction stated in the Terms.