Data Processing Agreement

1. Who does what

• This agreement is between Optik AI Limited (company number NI725113) ("Optik") and the Customer under our Terms of Service. It applies when Optik processes personal data in Customer Data on the Customer's behalf ("Customer Personal Data").
• For Customer Personal Data, the Customer is the controller (or a processor acting for its own clients), and Optik is the processor (or sub-processor).
• Optik is a controller, not a processor, for the data it uses to run the Customer's account, billing and security, as described in our Privacy Notice.
• "Data Protection Law" means UK GDPR, the Data Protection Act 2018 and PECR, and, where they apply, EU GDPR and national laws implementing the ePrivacy Directive.

2. Instructions

• Optik processes Customer Personal Data only on the Customer's documented instructions: this agreement, the Terms, the Customer's use and settings of the Service, and other written instructions we agree. The only exception is where the law requires otherwise, in which case we tell the Customer first unless the law forbids it.
• If we think an instruction breaks Data Protection Law, we'll tell the Customer.
• The Customer is responsible for the lawfulness of its instructions and of the Customer Personal Data, including any notices and consents its contacts need (see section 8 of the Terms).

3. Confidentiality

Optik ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, and that they access it only as needed to provide, support or secure the Service.

4. Security

Optik keeps in place the technical and organisational measures in Annex 2. We may update them as long as protection doesn't go down.

5. Sub-processors

• The Customer generally authorises Optik to use sub-processors. Annex 3 lists them by category and location. The named list is available to customers on request at contact@optikai.io.
• We bind each sub-processor by contract to data-protection terms at least as protective as these, and we remain responsible for them.
• Before we add or replace a sub-processor, we'll tell the Customer by email to the workspace's Super Admin and billing contact, at least 30 days in advance. The email names the provider, what it will do and where, and we update Annex 3 at the same time.
• The Customer may object on reasonable data-protection grounds within that period. If we can't resolve the objection, the Customer may end the affected part of the Service, and we'll refund prepaid fees for the rest of the term for that part.

6. International transfers

• Customer Personal Data is hosted in Ireland (eu-west-1).
• Some sub-processors process it in other countries, including the United States, as shown in Annex 3.
• Where a transfer needs a safeguard, we rely on:
  • an adequacy decision (for example, the UK Extension to the EU–US Data Privacy Framework for certified providers);
  • the UK International Data Transfer Agreement or Addendum; or
  • for EU data, the EU Standard Contractual Clauses (Module 2 or 3).
• These clauses are incorporated by reference where needed, and they prevail if they conflict with this agreement.
• For EU customers, transfers from the EU to Optik in the UK rely on the EU's adequacy decision for the UK.

7. Helping the Customer

• Data subject requests. The Service lets the Customer find, export, correct and delete contact data. Where it doesn't, we'll help with reasonable requests. If someone sends their request to Optik, we'll pass it to the Customer and won't answer it ourselves unless the Customer asks us to.
• Assessments. We'll give reasonable help with data protection impact assessments and with consultations with a regulator, as far as they concern the Service.

8. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we'll tell the Customer without undue delay, and within 48 hours. We'll give what we know (what happened, the data and people affected, the likely consequences and what we're doing about it) and add details as we learn them. We'll take reasonable steps to contain the breach and stop it happening again.

9. When the agreement ends

While the subscription is active, the Customer can export its data. After it ends, we delete Customer Personal Data within 90 days, unless the law requires us to keep it. Copies in backups are overwritten in the normal backup cycle.

10. Information and audits

• We'll make available the information reasonably needed to show we meet this agreement: these terms, Annex 2, Annex 3, the named sub-processor list, and answers to a reasonable security questionnaire once a year.
• If a regulator requires it, or the information we provide isn't enough to show compliance, the Customer may audit, through an independent auditor bound by confidentiality. Audits need 30 days' notice, take place in working hours, happen at most once a year, and are at the Customer's cost.

11. Liability and precedence

Each party's liability under this agreement is subject to the limits in the Terms. If this agreement conflicts with the Terms on data protection, this agreement wins; the Standard Contractual Clauses or IDTA win over both.

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption: in transit everywhere (HTTPS/TLS); at rest by our hosting and database providers.
• Separation: every workspace's data is kept separate, and every query is limited to the workspace's own data.
• Access in the app: role-based permissions, which the Customer controls; secure password storage; email verification; protection against automated sign-ups and log-in attacks.
• Staff access: limited to people who need it for support or operations, through individual accounts. Viewing a Customer's workspace for support needs that Customer's permission and is shown on screen while it happens.
• Infrastructure: hosted with our cloud and database providers in Ireland (EU); secrets held in a managed secrets store; separate production and test environments.
• Resilience: continuous database backups with point-in-time restore; monitoring and alerting of errors and availability.
• Development: code review for every change, automated tests and static analysis before release; dependencies kept up to date.
• Incident response: a defined process to assess, contain and report incidents (section 8).
• Suppliers: sub-processors chosen for their security and bound by contract (section 5).

Annex 3: Sub-processors

Optik uses sub-processors in the categories below to process Customer Personal Data. This annex is the current list (section 5). The names of the providers in each category are available to customers on request at contact@optikai.io.

Browser notifications that a user switches on are delivered by the push service of that user's browser. Under the Web Push standard their content is encrypted end to end, so the push service can't read it.

Providers that Optik uses only for its own website and sales, not for Customer Personal Data, are covered by our Privacy Notice and Cookie Policy.