For clients
Data processing agreement.
This forms part of every client agreement and meets Article 28 of the UK GDPR. The client is the controller of their callers' data, and Instant Reply (MFDD Torquay Limited, company number 17486772) is the processor.
| What we process | Callers' phone numbers, the text conversations, and the details callers give (name, job, location, timing) |
|---|---|
| Whose data | People who ring the client and don't get an answer |
| Why | To reply to missed callers and pass their enquiry to the client, as set out in our terms |
| How long | While the agreement runs. Conversations are deleted 90 days after they happen |
1. Instructions. We only process the data to provide the service, and on the client's documented instructions (the client agreement counts as those instructions), unless the law requires otherwise. We tell the client if we think an instruction breaks data protection law.
2. Confidentiality. Everyone who can access the data is bound to keep it confidential.
3. Security. We use appropriate security, including access limited to the two founders, strong passwords and two-factor login on every system, and encryption in transit. We don't sell the data or use it to train AI models.
| Supplier | What for | Where |
|---|---|---|
| Twilio | Phone number, calls and texts | USA |
| Make.com (Celonis) | Automation | EU |
| Airtable | Storing conversations | USA |
| OpenAI (API) | Writing replies and extracting job details. API data isn't used for training | USA |
4. Sub-processors. The client agrees to us using the suppliers listed above, each under its own data processing terms. We'll give 30 days' notice by email before adding or changing a sub-processor, and the client may object. We remain responsible for our sub-processors.
5. International transfers. Where data leaves the UK, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK–US Data Bridge where the supplier is certified.
6. Helping the client. We help the client respond to people exercising their rights (access, deletion and so on), and with security, breach notification and impact assessments, as far as is reasonable.
7. Breaches. We tell the client without undue delay, and within 48 hours of becoming aware of a personal data breach affecting their data, with the information we have.
8. End of the agreement. Within 30 days of the agreement ending, we delete the client's caller data, or return it first if the client asks in writing, unless the law requires us to keep it.
9. Audits. We give the client the information they reasonably need to show both sides are meeting Article 28, and allow reasonable audits on reasonable notice.
Questions about this agreement: ddeniz@instant-reply.co.uk. Last updated October 2026.