Data Processing Agreement

01

Introduction

This Data Processing Agreement governs the processing of personal data between Kinto Creative Ltd (Processor, Company Number: 17159021) and the client (Controller). It is governed by the UK GDPR and Data Protection Act 2018.

02

Definitions

• Personal Data: any information relating to an identified or identifiable individual
• Processing: any operation performed on personal data
• Controller: determines the purposes and means of processing (the client)
• Processor: processes personal data on behalf of the Controller (Kinto Creative Ltd)
• Sub-processor: any third party engaged by the Processor to process personal data

03

Role of the Parties

The client acts as the Data Controller. Kinto Creative Ltd acts as the Data Processor. The Processor shall only process personal data on documented instructions from the Controller, unless required by law.

04

Subject Matter & Duration

Processing relates to the provision of AI automation, communication, booking, website hosting, marketing, and SEO services. Processing shall continue for the duration of the service agreement unless otherwise agreed or required by law.

05

Nature & Purpose of Processing

The Processor may process personal data to:

• Manage communications: SMS, calls, chat, social messaging, email
• Automate bookings and appointment management
• Store and manage customer interactions via CRM
• Host websites and process enquiry form submissions
• Deliver SEO, content, and marketing automation services

06

Types of Personal Data

May include names, contact details (email, phone, address), appointment and booking data, communication content, website enquiry data, and technical and usage data.

07

Processor Obligations

The Processor shall:

• Process personal data only on documented instructions from the Controller
• Ensure all persons authorised to process data are bound by confidentiality
• Implement appropriate technical and organisational security measures
• Assist the Controller in complying with data subject rights obligations
• Notify the Controller of any personal data breach without undue delay
• Delete or return personal data upon termination of services unless legally required to retain it

08

Sub-Processors

The Controller authorises the Processor to engage sub-processors as necessary. The Processor currently engages Cloudflare, Inc. for website hosting, DNS and edge compute, Hetzner Online GmbH for the servers running the Processor’s own automation systems, located in the European Union, and Google LLC for email delivery and storage. Enquiry data submitted through the Processor’s websites is handled by systems the Processor operates itself rather than by a third-party CRM.

Voice AI Service

For clients using the voice AI receptionist service, the Processor also engages:

• Twilio Inc., United States: telephony, call handling, and text messages
• Vapi, United States: the voice AI platform, covering speech-to-text, text-to-speech, and call orchestration
• Anthropic, PBC, United States: generates the AI agent’s responses
• Ideal Postcodes, United Kingdom: address and postcode lookup during bookings

Bookings the AI makes are stored in the client’s own Google Calendar, provided by Google LLC. How long each provider keeps call data is set out in the Voice AI Call Recording Disclosure.

The Processor shall ensure sub-processors are subject to equivalent data protection obligations, and shall give the Controller notice of any intended change to this list.

09

International Data Transfers

Where personal data is transferred outside the UK, the Processor shall ensure appropriate safeguards are in place including UK-approved Standard Contractual Clauses or transfers to countries with adequacy decisions.

For the voice AI service, transfers to Twilio Inc. rely on the UK Extension to the EU-US Data Privacy Framework together with Standard Contractual Clauses, and transfers to Vapi and Anthropic, PBC rely on Standard Contractual Clauses with the UK Addendum.

10

Data Breach Notification

The Processor shall notify the Controller without undue delay upon becoming aware of a personal data breach, and shall provide sufficient information to assist the Controller in meeting its reporting obligations under UK GDPR.