Data Processing Agreement
This Data Processing Agreement (“DPA”) applies where ArbiXcel Systems processes personal data on behalf of a client in connection with agreed AI-assisted voice dispatch, scheduling, customer-intake or operational automation services.
1. Scope and Roles
This Data Processing Agreement supplements the applicable client agreement. The client will generally act as Controller where it determines the purposes and means of processing customer personal data. ArbiXcel may act as Processor for the agreed client workflows. The exact roles depend on the deployment, the parties’ instructions and applicable law.
2. Documented Instructions
ArbiXcel will process personal data only on the client’s documented instructions, including instructions in the applicable agreement and approved workflow configuration, unless processing is required by law. Where legally permitted, ArbiXcel will inform the client of such a requirement.
3. Confidentiality
ArbiXcel will ensure that persons authorised to process client personal data are subject to appropriate confidentiality obligations.
4. Security Measures
ArbiXcel will use appropriate technical and organisational measures designed to protect personal data, taking account of the nature, scope, context and purposes of processing and the risks involved. Measures may include HTTPS/TLS transport, controlled credentials, access restrictions, authentication, logging and client-specific permissions where supported by the relevant providers.
5. Subprocessors
Subprocessors may include providers of cloud hosting, databases, telephony, AI and voice processing, speech recognition, scheduling, CRM or FSM integration, analytics, monitoring, communications and website hosting. The exact subprocessors may vary according to the deployment. ArbiXcel will use subprocessors subject to appropriate contractual and data-protection obligations.
6. Data Subject Requests
ArbiXcel will assist the client with data-subject requests where reasonably required, taking account of the nature of processing, the information available to ArbiXcel and technical feasibility. The client remains responsible for assessing and responding to requests where it acts as Controller.
7. Personal Data Breaches
ArbiXcel will notify the client without undue delay after becoming aware of a personal data breach affecting client data where notification is required under the applicable agreement or law, and will provide reasonably available information to support the client’s response.
8. International Transfers
Where personal data is transferred internationally and data-protection law requires safeguards, the parties and relevant providers will use appropriate recognised mechanisms, which may include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, adequacy regulations or another lawful safeguard.
9. Retention and Deletion
Retention, return and deletion requirements will be governed by the applicable client agreement, system configuration, connected-provider capabilities and applicable law. ArbiXcel may retain information where reasonably necessary to provide, troubleshoot, secure or maintain the service, resolve disputes, enforce agreements or satisfy legal obligations.
10. Client Data, Recordings and Transcripts
Rights relating to client data, recordings and transcripts will be governed by the applicable client agreement, platform terms and data-protection requirements.
11. Audits and Information
ArbiXcel will make available information reasonably necessary to demonstrate compliance with applicable Processor obligations, subject to appropriate confidentiality, security, proportionality and commercial safeguards.
12. Governing Law
Unless otherwise agreed in writing, this DPA is governed by the laws of England and Wales and disputes are subject to the jurisdiction specified in the applicable client agreement.
DPA and legal enquiries may be sent to habib@arbixcel.com or submitted through the website enquiry form.