Data Processing Agreement

1. Roles

The Customer is the controller and CodeCue is the processor of personal data processed through the Service about the Customer's website visitors, customers and contacts ("Customer Personal Data"). The details of the processing are in Schedule 1.

2. Instructions

CodeCue will process Customer Personal Data only on the Customer's documented instructions, which are: the Terms, this DPA, and the Customer's use and configuration of the Service. CodeCue will tell the Customer if it believes an instruction breaks data protection law. CodeCue may also process data where required by law, and will tell the Customer first unless the law prevents it.

3. Customer responsibilities

The Customer is responsible for having a lawful basis for the processing, for giving visitors appropriate privacy information, for the lawfulness of its instructions, and for not using the Service to collect special category data unless it has a lawful basis and appropriate safeguards.

4. Confidentiality

CodeCue ensures that anyone it authorises to process Customer Personal Data is bound by confidentiality.

5. Security

CodeCue implements appropriate technical and organisational measures to protect Customer Personal Data, including those in Schedule 2, and may update them as long as protection is not reduced.

6. Sub-processors

6.1 The Customer gives general authorisation for CodeCue to use sub-processors. The current list is in Schedule 3.

6.2 CodeCue will give at least 14 days' notice of new or replacement sub-processors, by email or in the dashboard. The Customer may object on reasonable data protection grounds. If we cannot resolve the objection, the Customer may cancel the affected Service.

6.3 CodeCue will put data protection terms in place with each sub-processor that are at least as protective as this DPA, and remains responsible for its sub-processors.

7. International transfers

Some sub-processors may process Customer Personal Data outside the UK. Where they do, CodeCue relies on UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

8. Helping the Customer

Taking into account the nature of the processing, CodeCue will reasonably help the Customer to respond to data subject requests, and with security, breach notification, data protection impact assessments and consultations with the ICO. The dashboard lets the Customer view and delete conversations. If CodeCue receives a request directly from a data subject about Customer Personal Data, it will pass it to the Customer.

9. Personal data breaches

CodeCue will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. It will give the information reasonably available to help the Customer meet its own obligations, and will take reasonable steps to contain the breach.

10. Deletion and return

When the Service ends, the Customer can export its data for 30 days. CodeCue then deletes Customer Personal Data within 90 days, unless the law requires it to be kept. Backups are deleted on their normal cycle.

11. Audits

CodeCue will make available the information reasonably necessary to show compliance with this DPA. If that is not enough, the Customer may carry out an audit once a year, with at least 30 days' written notice, during business hours, at its own cost and under confidentiality, in a way that does not disrupt the Service or affect other customers' data.

12. US customers

Where US state privacy laws apply, CodeCue acts as the Customer's "service provider" or "processor". It will not sell or share Customer Personal Data, or use it for any purpose other than providing the Service, except as those laws allow.

13. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on data protection, this DPA wins.

Schedule 1: Details of processing

• Subject matter and purpose: providing the AI assistant and related features: answering visitor questions, capturing enquiries and booking requests, notifying the Customer, insights and support.
• Duration: for the term of the Service, plus the deletion period in section 10.
• Nature of processing: collection, storage, organisation, retrieval, use for generating AI replies, transmission, analysis for insights, and deletion.
• Data subjects: the Customer's website visitors, customers and prospective customers who use the chat or contact forms, and the Customer's staff who use the Service.
• Types of personal data: chat messages and their content; names, email addresses, phone numbers and booking details that visitors choose to provide; ratings and feedback; a random visitor identifier; technical data such as IP address (used briefly for security and rate limiting) and browser information.
• Special category data: not intended. Visitors may volunteer it in free text. The Customer should configure its assistant so it does not ask for it.

Schedule 2: Security measures

• Encryption in transit (TLS) for all traffic, and encryption at rest by our hosting providers.
• Separation of each customer's data, enforced in the database (row-level security), with automated tests.
• Access control based on least privilege, multi-factor authentication for CodeCue administrators, time-limited and logged administrator access to customer accounts, and an audit log of administrative actions.
• Secrets kept out of code, and tokens and access links stored as hashes.
• Rate limiting and abuse protection on public endpoints.
• Regular backups by our database provider, and monitoring of the Service.
• Incident response procedures and staff confidentiality.

Schedule 3: Sub-processors

• Anthropic, PBC (United States): AI model processing to generate assistant replies.
• Supabase, Inc. (database hosted in the EU, Frankfurt): database, authentication and storage.
• Vercel, Inc. (United States, with processing in the EU): application hosting.
• Resend (Plus Five Five, Inc.) (United States): sending email notifications.
• Stripe Payments Europe, Ltd. / Stripe, Inc.: payments and billing for the Customer's subscription (Customer account and billing data only).