Data Processing Agreement

v1.0 · Approved 14 July 2026 · ICO registration submitted 14 Jul 2026 — reference to follow.

This DPA is incorporated into the Terms of Service between We Are Intrinsic Limited (company no. 13158150), registered office: Mabgate Business Centre, Mabgate, Leeds, LS9 7DR, England ("Processor") and the Customer ("Controller" — or, where the Customer is an agency/reseller processing on behalf of its own clients, the Customer acts as processor and appoints us as sub-processor, with these terms applying mutatis mutandis).

1. Processing particulars (Art. 28(3))

Subject matter	Capture, attribution, recording, transcription and AI analysis of inbound enquiries
Duration	Term of the Agreement + 30-day exit window
Nature & purpose	Providing the Loop service per documentation
Data subjects	Callers, form-fillers, chat users and visitors of Customer's (or its clients') websites; Customer's team members
Categories	Phone numbers, names, email addresses, call audio, transcripts, AI-derived analyses, IP-derived location, visitor identifiers, attribution/journey data
Special categories	Not intended; incidental capture in call audio is possible — minimised by retention controls

2. Processor obligations

Process only on documented instructions (the service configuration constituting standing instructions); ensure personnel confidentiality; implement the technical and organisational measures in Annex II; assist the Controller with data-subject requests (built-in search/export/erasure tooling), DPIAs and Art. 32–36 obligations; make available information necessary to demonstrate compliance, and allow audits on 30 days' notice, at Controller's cost, no more than annually (security documentation to be offered first).

3. Sub-processing

General authorisation for the sub-processors in Annex III (the Named Sub-processor List, provided to the Controller at contracting and available on request). Changes notified 30 days in advance by email to account owners; Controller may object on reasonable data-protection grounds, in which case the parties will seek a solution or the affected service element may be terminated. Equivalent obligations are flowed down in writing.

4. International transfers

Primary processing and storage: United Kingdom (London). Where a listed sub-processor processes outside the UK (currently: transcription and AI analysis — see Annex III), transfers occur under the UK International Data Transfer Addendum to the EU SCCs, with supplementary measures as documented. No other transfers without the safeguards of Chapter V.

5. Personal data breach

Notify the Controller without undue delay and in any event within 48 hours of becoming aware of a breach affecting Controller data, with the information reasonably required for the Controller's own ICO/72-hour assessment; cooperate fully; document per our incident-response runbook.

6. Deletion and return

During the term: self-service export at any time. On exit: 30-day export window, then deletion via the erasure engine — recordings destroyed in all locations (including any telephony-provider copy), personal data erased or irreversibly anonymised; anonymised statistics may be retained. Certification of deletion on request.

Annex II — Technical & organisational measures (summary)

UK (London) data residency for database, processing and recordings; telephony copies deleted post-transfer · row-level security enforcing tenant isolation at the database layer, adversarially tested · encryption in transit (TLS) and at rest · MFA on all infrastructure accounts; least-privilege keys, rotated on schedule and on suspicion · rate-limited public endpoints; signature-validated telephony webhooks; A-grade security headers · automatic retention engine (12-month default; configurable 90 days–7 years) with nightly audited sweeps · audit logging of privacy-relevant actions with masked identifiers · documented, tested incident-response runbook.

Annex III — Authorised sub-processors

The Named Sub-processor List, provided at contracting, maintained by the Processor, and incorporated by reference; a functions-and-regions overview is published at /subprocessors.