Data Processing Agreement

1. What we process for you

• Subject matter and purpose: answering the calls you divert to Pickuply, taking messages and callback requests, booking appointments and sending you call summaries.
• Duration: while your account is open, then until deletion under section 8.
• People: your callers, and anyone whose details they give or who you add to your calendar or contacts.
• Data: names, phone numbers, email addresses, the content of calls as text, appointment details and anything else callers choose to share. Callers may sometimes mention special category data (for example health) or details of legal matters; Pickuply is set up to take only a short summary.

2. Your instructions

We only process this data on your documented instructions, which are these terms and the settings you choose in Pickuply. If we think an instruction breaks data protection law, we will tell you. We never use your callers' data for our own purposes, never sell it, and never use it to train AI models.

3. Confidentiality

Everyone at Zapx Labs who can access your data is bound by confidentiality, and access is limited to what they need to run and support the service.

4. Security

• Encryption in transit (TLS) and at rest with our hosting and database providers.
• The database is hosted in London (AWS eu-west-2).
• Call audio is not recorded. Transcripts are deleted after 30 days.
• Connections to your calendar and other tools are stored encrypted.
• Access to production systems is restricted to the people who run the service.

5. Sub-processors

You give general authorisation for the sub-processors listed in our Privacy Policy. We will tell you by email at least 14 days before adding or replacing one, so you can object; if we can't resolve the objection, you can end the service. We put data protection terms in place with each sub-processor that are no less protective than these, and we remain responsible for them.

6. International transfers

Where a sub-processor processes data outside the UK, we make sure an appropriate safeguard is in place, such as the UK International Data Transfer Addendum or the UK–US data bridge.

7. Helping you

• Requests from callers: if a caller asks us about their data, we pass the request to you, and we help you answer requests to access, correct or delete it.
• Breaches: we tell you without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting your data, with the details you need to meet your own obligations.
• Assessments: we give you reasonable help with data protection impact assessments and with questions from the Information Commissioner's Office.

8. Deletion and return

When your account ends, or earlier if you ask, we delete your callers' data within 30 days, unless the law requires us to keep it. Before deletion you can ask us for an export.

9. Audits

We will give you the information you reasonably need to show that we meet these terms, and answer reasonable written questions about our security and processing.