Data Processing Agreement

The client is normally controller for its customer, visitor, lead, enquiry, voice transcript, booking, quote and CRM data. Pembico AI acts as processor when processing that data to provide the agreed services.

The subject matter is website, enquiry, AI agent, SEO/reporting and support services. The duration is the service term plus any agreed retention period.

Data may include names, contact details, business details, job requirements, website/chat/form messages, voice transcripts, call/message metadata, booking details, quote status, invoice status, reviews, service areas and technical logs. Data subjects may include client staff, customers, prospects, website visitors and suppliers.

Pembico AI will process personal data only on documented client instructions unless legally required otherwise, and will use reasonable technical and organisational security measures appropriate to the service.

Pembico AI may use sub-processors for hosting, forms, email/CRM, analytics, AI models, voice agents, SEO/reporting, storage, security and support. Providers may include Vercel, Formspree, OpenAI, ElevenLabs, Arvow and business administration tools. International transfers will use appropriate safeguards where required.

Pembico AI will provide reasonable help with data subject requests, security incidents, DPIAs and regulator enquiries relating to the services. Pembico AI will notify the client without undue delay after becoming aware of a personal data breach affecting client personal data.

At the end of services, Pembico AI will delete or return personal data where reasonably possible, subject to legal, accounting, security and backup retention. Pembico AI will provide reasonable audit/cooperation information, normally by documentation or written responses rather than unrestricted system access.