Data Processing Agreement
In plain English
- You're the data controller; we only process your customers' data on your instructions, to run the service.
- We use listed sub-processors, each under a written data-protection contract, with 14 days' notice of changes.
- Data is encrypted, kept separate per business, hosted in the EU, and we tell you promptly about any breach.
- You can export your data any time; after you leave it is deleted at the end of your plan's grace period, or sooner if you ask.
- Written for UK GDPR Article 28 and section 8 of India's DPDP Act.
Summary for convenience; the full agreement below governs.
1. Scope & roles
This Data Processing Agreement ("DPA") forms part of the Terms between INFRAGENT AI LIMITED (company number 17291063) (the "Processor") and the business using the platform (the "Controller"). It applies whenever we process your customers' personal data on your behalf. It is the contract required by Article 28 of the UK GDPR (and EU GDPR where it applies) and, for India, the valid contract between a Data Fiduciary (you) and a Data Processor (us) required by section 8(2) of the Digital Personal Data Protection Act 2023. You remain responsible for having a lawful basis - or, in India, valid consent or a legitimate use - for the data you ask us to process, and for giving your customers the notices the law requires.
2. What we process
Processing means receiving, storing, analysing and responding to customer communications across your connected channels (WhatsApp, Instagram, Facebook, website chat) and operating bookings, CRM, campaigns and automations - solely to provide the platform, for the duration of your subscription. Data subjects are your customers, prospects and callers; data includes names, contact details and handles, message and call content, booking/enquiry details, and technical metadata. You must not direct us to process special-category data unless your lawful basis supports it.
3. Our obligations as processor
We process personal data only on your documented instructions (expressed through your platform configuration); ensure our personnel are bound by confidentiality; apply the security measures in section 5; assist you with data-subject requests and your own compliance; and make available the information reasonably needed to demonstrate compliance.
4. Sub-processors
You authorise the sub-processors listed in section 6 of our Privacy Policy (with what each does and where): Supabase, Hetzner, Vercel, OpenAI, Google, Resend, Stripe, Razorpay, Meta, Cloudflare and, if you use voice, Twilio. Each is bound by a written contract with data-protection obligations equivalent to this DPA, and we remain responsible for them. We give at least 14 days' notice by email before adding or replacing a sub-processor that handles your customers' data; if you object on reasonable data-protection grounds and we can't resolve it, you may end the affected service without penalty.
5. Security & international transfers
We apply appropriate technical and organisational measures, including: encryption in transit (TLS) and at rest; separate application-level encryption, with a per-business key, of your connected channels' access tokens; a check on every request that data belongs to the business asking for it; signature-verified webhooks; two-factor authentication for our admin tools; and restricted, need-to-know access for our staff, who are bound by confidentiality. Primary hosting is in the EU (Germany); transfers outside the UK/EEA rely on the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses, and transfers of Indian data follow section 16 of the DPDP Act.
6. Data-subject requests & breaches
The platform lets you search, export, correct and delete customer data directly, satisfying most requests without us. Where our assistance is needed, we act on your instruction within 7 days, and we redirect data subjects who contact us directly back to you. If we become aware of a personal data breach affecting your data, we notify you without undue delay with what we know - what happened, the data and people affected, likely consequences, and what we are doing - so you can meet your own duties (72 hours to the ICO under UK GDPR; notice to the Data Protection Board and affected people under the DPDP Act). We keep a record of every breach.
7. Deletion, return & audit
You can export your data any time during the subscription. When your subscription ends we keep your data for your plan's grace period (Trial 30 days, Starter 90, Growth 120, Pro and Enterprise 365) so you can return or export it, then delete it; if you instruct us to delete it sooner (Settings → Security → Privacy & your data → Delete account), we do so within one month. We keep only what the law requires. Backups expire on a rolling schedule and are never used to restore deleted data. We provide compliance documentation on request and, where that's insufficient for a legal requirement, will cooperate with an audit on reasonable notice, during business hours, up to once a year, under confidentiality.
8. Liability & precedence
Liability under this DPA is subject to the limits in the Terms. Where this DPA conflicts with the Terms, this DPA prevails for data-protection matters. Enterprise customers may request a countersigned DPA with custom annexes via support@infragentai.com.
© 2026 INFRAGENT AI LIMITED · Registered in England & Wales, company number 17291063. All rights reserved.