Data Processing Agreement

Last updated 16 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service and applies whenever DigitAIse processes personal data of third parties (your customers, suppliers, contacts) on your behalf. Capitalised terms not defined here have the meaning given in the Terms.

1. Parties & roles

The processor is AIME TECH UK LIMITED ("DigitAIse", "we"), company number 16819323, registered office 42 Beaufort Court, Admirals Way, London E14 9XL, ICO registration number ZC169006. The controller is the customer business that accepts the Terms ("you"). For End-Customer Data, you are the Controller and DigitAIse is the Processor. For account, billing and usage data we are a separate controller, as described in the Privacy Policy; this DPA does not cover that data. Each party will comply with UK GDPR and the Data Protection Act 2018.

2. Subject-matter & details of processing

Subject matter: Providing the DigitAIse Service to you.
Duration: For the term of your subscription, plus the 30-day closure period and deletion described in section 9.
Nature: Collecting data from the sources you connect, storing, extracting, organising, searching, analysing, generating AI drafts and answers, sending or publishing what you approve or set to answer automatically, and deleting. Email reaches Nova by forwarding to Nova's address or, if you connect your mailbox directly (Gmail or Outlook through Composio; other providers with an app password, stored encrypted), by Nova reading new mail only; Nova only sends the replies you approve. If you connect a calendar, Nova reads when you are busy and adds only the meetings you agree in replies you approve.
Purpose: So Nova can draft communications, answer website chat and booking messages you turn on, schedule, respond to reviews/mentions, remind your customers of their bookings and chase payment of your own unpaid customer invoices, by email or text, where you turn those features on (and recognise when they are paid, from a bank account you link), organise documents and surface insights, as you configure it.
Categories of data: Contact details (names, emails, phone numbers), correspondence and message content, booking and calendar details, transactional/financial data from documents (including bank details such as IBANs), invoice and payment status details for Get Paid, incoming payments (payer name, amount, date and reference) from a bank account you link, reviews and social mentions, website-chat and call content, text messages we send for you and their delivery status, and any other personal data you choose to submit. The Service is not designed for special category or criminal-offence data; do not submit it unless you have a lawful condition for doing so.
Data subjects: Your customers and prospects, website visitors, suppliers, employees and contacts, and anyone else whose data is in content you connect.

Website visitors (Webdesigner) — when you use Webdesigner, we also process the following for you.

Subject matter: Hosting your website and passing on what its visitors send through the integrations you switch on (website chat, booking requests and the contact form).
Data subjects: Visitors to the website we host for you.
Categories of data: Name, email address, phone number, message and requested day or time from enquiries and booking requests; chat transcripts, when website chat is on; and technical logs at our hosting edge (Cloudflare), including IP address, browser and time of request.
Purpose: To deliver enquiries, booking requests and chats to you, and to keep the site secure and available.
Retention: Enquiries, booking requests and chat transcripts are kept as set out in section 9, unless you set or promise your visitors a shorter period. The privacy page our site template generates tells visitors that booking requests are kept for up to 12 months; if you publish that wording, you must delete them by then or ask us to, and we will. Edge logs are kept by Cloudflare for a short period for security; we do not use them for anything else.
Sub-processor: Cloudflare — website hosting and content delivery (CDN), file storage (R2) and, for domains you buy through us, domain registration (Cloudflare Registrar).

3. Your instructions & obligations as Controller

These Terms, this DPA and your configuration and use of the Service are your documented instructions, including for international transfers (section 7).
Ensure you have a lawful basis and any required notices/consents to submit End-Customer Data and to instruct the processing — including telling your website visitors and customers that Website chat, booking chats and Phone are answered by AI, and that the chat widget keeps a random visitor ID in their browser, and, for a website we host for you, publishing an accurate privacy notice on it (the one our site template generates is a starting point you must check).
Your instructions must comply with data protection law.

4. Our obligations as Processor

Process End-Customer Data only on your documented instructions (including via your use of the Service), unless the law requires otherwise — in which case we will tell you first unless the law forbids it. We will tell you if we think an instruction infringes data protection law.
Ensure personnel with access are bound by confidentiality. Staff see account-level activity, not the content of your documents, emails or messages, unless you ask us to as part of a support request or the law requires it.
Implement appropriate technical and organisational security measures (section 5).
Assist you, taking into account the nature of processing, with data subject requests (passing on any request we receive), security, breach notification, DPIAs and prior consultation with the ICO.
Not sell End-Customer Data or use it to train AI models.
On termination, delete or return End-Customer Data on your instruction (section 9), and make available the information needed to demonstrate compliance, including audits (section 10).

5. Security measures

Per-tenant database schema isolation; sensitive fields encrypted with a per-tenant key; encryption in transit (TLS); daily backups encrypted before they leave our servers.
Access controls, two-factor authentication for sensitive actions, single sign-on and sign-in logging for staff admin tools, least-privilege service architecture and audit logging.
Uploaded-file safety checks, rate limits and error monitoring; UK-based hosting.
Human-in-the-loop approval before Nova sends drafts; AI-generated messages are marked.
Automatic deletion at the end of the retention periods in section 9.

6. Sub-processors

You give us general authorisation to engage the sub-processors below. We will tell you by email or in the app at least 30 days before adding or replacing one, so you can object on reasonable data-protection grounds. If we cannot resolve your objection, you may end your subscription before the change takes effect and we will refund any fees paid for the period after it ends. We put each sub-processor under written data protection terms that are at least as protective as this DPA, and we remain responsible for their performance.

OVHcloud — Hosting infrastructure (UK)
Google Cloud — Encrypted backups (UK, London)
Cloudflare — Edge network; for Webdesigner, website hosting and content delivery (CDN), file storage (R2) and domain registration (Cloudflare Registrar)
Anthropic — AI model processing
Brevo — Email delivery
TrueLayer — Open Banking access to the bank account you link (accounts, balances and incoming payments), when enabled
Zernio — Social account connections & posting (Instagram, Facebook, LinkedIn, Google Business, WhatsApp), when enabled
Twilio — Voice telephony and text messages (SMS) sent for you (your customers' phone numbers and message text), when enabled
Meta — WhatsApp messaging, when enabled
Composio — Connects your Gmail or Outlook mailbox, and your Google or Outlook calendar, so Nova can read new mail, send the replies you approve, see when you are busy and add meetings you agree (only if you connect them). Handles mailbox and calendar access and their content in transit (USA).

Support requests you send us through Chat to us, which may include End-Customer Data you choose to share, are kept in our own operations system, hosted by OVHcloud in the UK.

7. International transfers

Primary processing and hosting are in the UK. Where a sub-processor processes End-Customer Data outside the UK (for example Anthropic, Cloudflare, Twilio, Meta and Composio in the USA), an appropriate transfer mechanism will apply: UK adequacy regulations, the UK-US data bridge where the recipient is certified to it, or the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses.

8. Personal data breach

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting End-Customer Data. We will give you the information you reasonably need to meet your own notification obligations (in stages if it is not all available at once) and take reasonable steps to contain it. We will not notify the ICO or data subjects about your data on your behalf unless you ask us to or the law requires it.

9. Return & deletion

End-Customer Data in documents, emails and activity records is kept for 3 years (6 years for financial records such as invoices), then deleted automatically. You can export your data at any time, including before closing your account. When you close your account we keep the data for 30 days so you can reactivate, then permanently delete your tenant's data and files. On your written request we will delete or return End-Customer Data within 30 days, save where retention is required by law. Deleted data can remain in our encrypted backups for up to about 6 months, until those backups expire.

10. Audit

We will make available the information reasonably necessary to demonstrate compliance with this DPA and answer reasonable security questionnaires. If that is not enough, we will allow and contribute to an audit or inspection by you or an independent auditor bound by confidentiality, on at least 30 days' notice, in business hours, no more than once a year (unless required by a regulator or after a personal data breach), at your cost, and without access to other customers' data.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. This does not limit either party's liability to data subjects or regulators where the law does not allow it.

12. Term & precedence

This DPA sets out the terms required by Article 28(3) UK GDPR. It lasts for as long as we process End-Customer Data for you, including after your subscription ends until deletion is complete. If the Terms and this DPA conflict on data protection, this DPA prevails.

← Back to home Terms Privacy