Data Processing Agreement (DPA)

This Data Processing Agreement (DPA) forms part of the imabi Live Desk Terms of Service and any Order Form between imabi Ltd and the Customer. It applies wherever imabi processes personal data on the Customer's behalf in providing the Service.

1. Roles of the parties

The Customer is the Controller of personal data processed through the Service. imabi Ltd ("imabi") acts as Processor, processing that personal data only on the Customer's documented instructions.

2. Definitions

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and any other applicable data protection legislation. "Personal Data", "Controller", "Processor", "Data Subject", "Processing" and "Personal Data Breach" have the meanings given in Data Protection Law. "Sub-processor" means any third party engaged by imabi to process Personal Data on the Customer's behalf. Capitalised terms not defined here have the meanings given in the Terms of Service.

3. Subject matter, duration, nature and purpose

imabi processes Personal Data to provide the Live Desk Service for the duration of the Subscription Term and any post-termination period set out in Section 8. The nature, purpose, categories of data and Data Subjects are described in Annex 1.

4. Processor obligations

4.1 imabi will process Personal Data only on the Customer's documented instructions, including as set out in the Terms and this DPA, unless required to do otherwise by law, in which case imabi will inform the Customer unless the law prohibits it.

4.2 imabi will ensure that anyone authorised to process Personal Data is subject to a duty of confidentiality.

4.3 imabi will implement appropriate technical and organisational measures to protect Personal Data, as described in Annex 2.

4.4 imabi will engage Sub-processors only in accordance with Section 5.

4.5 imabi will, taking into account the nature of the processing, assist the Customer by appropriate measures in responding to requests from Data Subjects exercising their rights.

4.6 imabi will assist the Customer in meeting its obligations relating to security, breach notification, data protection impact assessments and prior consultation with the regulator, taking into account the information available to imabi.

4.7 imabi will delete or return Personal Data at the end of the provision of the Service in accordance with Section 8.

4.8 imabi will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and allow for audits in accordance with Section 9.

4.9 imabi will promptly inform the Customer if, in its opinion, an instruction infringes Data Protection Law.

5. Sub-processors

5.1 The Customer gives imabi general authorisation to engage the categories of Sub-processor listed in Annex 3.

5.2 imabi will give the Customer at least 30 days' notice of any intended addition or replacement of a Sub-processor. The Customer may object on reasonable data protection grounds within that period; the parties will then discuss in good faith, and if no resolution is reached the Customer may terminate the affected part of the Service.

5.3 imabi will impose on each Sub-processor data protection obligations no less protective than those in this DPA, and remains responsible for its Sub-processors' performance of those obligations.

6. International transfers

Primary hosting and database storage of Personal Data is located in the UK. Other Sub-processor categories may process Personal Data outside the UK/EEA; this is pending verification. Where any such transfer takes place, imabi will ensure an appropriate transfer mechanism recognised under Data Protection Law (such as an adequacy regulation or the UK International Data Transfer Agreement/Addendum) is put in place.

7. Personal data breaches

imabi will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include the information reasonably available to imabi to help the Customer meet its own obligations, and imabi will take reasonable steps to contain and remedy the breach.

8. Return and deletion of data

On termination, the Customer may request an export of its Personal Data within 30 days. After that period imabi will delete or anonymise the Personal Data, unless retention is required by law. Retention during the Subscription Term follows the Terms of Service, including automatic removal of reporter contact details, message conversations and device identifiers 12 months after a report's resolution.

9. Audit rights

The Customer may audit imabi's compliance with this DPA, on reasonable notice and during normal business hours, once in any 12-month period, or more often where a Personal Data Breach is reasonably suspected. imabi may first satisfy an audit request by providing relevant documentation, certifications or reports.

10. Security measures

imabi will maintain the technical and organisational security measures set out in Annex 2 and may update them provided the overall level of protection is not reduced.

11. Liability

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms of Service.

12. Term and governing law

This DPA remains in effect for as long as imabi processes Personal Data on the Customer's behalf. It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1 — Details of processing

Annex 2 — Security measures

• Encryption of data in transit (TLS) and at rest.

• Role-based access controls (administrator, operator, viewer) enforced at the database level, with row-level security separating each Customer's data.

• Server-side role checks on staff actions, including replies to reporters and AI-assisted features.

• Staff accounts are created by self-serve sign-up (administrators) or by administrator invitation; no account is created without sign-in credentials.

• Public report form: submissions pass through a server-side route with input validation, spam traps and rate limiting; only a one-way hash of the network address is stored and it is deleted after 30 days; the public cannot write to the database directly.

• Rate limiting on AI-assisted features.

• Automated daily retention job removing reporter contact details, message conversations and device identifiers 12 months after resolution, and deleting operational logs on a rolling basis.

• Logging and monitoring of service activity.

• Staff confidentiality obligations and access on a need-to-know basis.

Annex 3 — Sub-processors