This Data Processing Agreement (DPA) applies when Lyndon Mukandavire trading as Cailub ("Cailub", the processor) processes personal data on behalf of a business customer (the controller) in providing services, for example through a chatbot, website enquiry form or automation. It forms part of the Terms and Conditions for those services.
Cailub is a trading name of Lyndon Mukandavire, a sole trader based in the United Kingdom at 60 Stockport Road, Manchester, M12 6AL, United Kingdom. Cailub processes personal data as a UK-established processor under the UK GDPR, and this DPA is governed by the law of England and Wales. Where a customer is subject to another data protection law, the Market Supplement for its country sets out the additional terms that apply.
1. Subject matter and duration
Cailub processes personal data only to provide the services described in the customer’s order, for the duration of those services and any agreed period afterwards needed to return or delete the data.
2. Nature and purpose of processing
Hosting, storing, retrieving, analysing and transmitting personal data in order to operate websites, AI chatbots, assistants, agents and authorised automation, and to provide support. With the add-ons, this also includes booking appointments into the customer’s own Google Calendar and letting the customer’s authorised team read and reply to chats when a visitor asks to speak to a person. With AI Phone & SMS, this also includes answering and making phone calls with an AI voice agent, transcribing and (where the customer switches it on) recording calls, transferring calls to the customer’s team, and sending and receiving text messages on the customer’s behalf.
3. Categories of data subjects and personal data
Data subjects: the customer’s website visitors, chatbot users, enquirers, customers, staff and other individuals whose information the customer chooses to process through Cailub.
Personal data: contact details, conversation and message content, enquiry details, booking information, technical identifiers and any other information the customer configures the service to collect. Special category data must not be processed unless separately agreed in writing.
With AI Phone & SMS: callers’ and recipients’ phone numbers, call audio, transcripts, summaries, messages taken, call recordings (only where switched on), text message content and delivery status, and records of marketing consent and opt-outs.
4. Processor obligations
Cailub will:
- Process personal data only on the customer’s documented instructions, unless required by law (in which case it will tell the customer unless legally prohibited).
- Ensure that anyone authorised to process the data is bound by confidentiality.
- Implement appropriate technical and organisational security measures.
- Engage subprocessors only under the conditions in this DPA.
- Help the customer respond to data subject requests, taking into account the nature of the processing.
- Help the customer meet its obligations on security, breach notification, data protection impact assessments and consultation with the regulator.
- At the customer’s choice, delete or return personal data at the end of the services, unless law requires storage. Chatbot data is deleted automatically 30 days after the chatbot subscription ends; the customer can export it from the dashboard before then.
- Make available the information needed to demonstrate compliance and allow for, and contribute to, reasonable audits.
- Tell the customer immediately if an instruction appears to infringe data protection law.
5. Subprocessors
The customer gives general authorisation for Cailub to use the subprocessors listed in the Subprocessor Register. Cailub will give notice of intended additions or replacements so the customer can object on reasonable grounds.
Cailub will put data protection obligations on each subprocessor that are equivalent to those in this DPA and remains responsible to the customer for their performance.
6. Personal data breaches
Cailub will notify the customer without undue delay after becoming aware of a personal data breach affecting customer personal data, and will provide the information reasonably available to help the customer meet its own notification obligations.
7. International transfers
Where customer personal data is transferred outside the country it comes from, Cailub will make sure an appropriate transfer mechanism is in place. The annex for the customer’s market applies in addition to this agreement. The route used for each provider is shown in the Subprocessor Register once verified.
| Market | Transfer annex |
|---|---|
| United Kingdom | UK adequacy regulations (including the UK-US data bridge for certified providers), or the UK International Data Transfer Agreement or UK Addendum. |
| European Union | EU adequacy decision for the UK for transfers to Cailub; for onward transfers, the provider’s EU-US Data Privacy Framework certification or the EU Standard Contractual Clauses (processor-to-processor module). |
| United States | State-law service-provider terms: processing only on documented instructions, purpose limitation, no sale or sharing, no combining with other data except as permitted, deletion or return on exit, subprocessor controls, assistance, audit, and treating deidentified data as deidentified. |
| Canada | Contractual protection comparable to PIPEDA and applicable provincial law, with notice that data may be processed outside Canada. Quebec terms will be added if Quebec is supported. |
| Australia | Contractual steps so overseas recipients handle personal information consistently with the Australian Privacy Principles (APP 8). |
| United Arab Emirates | Transfer terms under Federal Decree-Law No. 45 of 2021. Being confirmed and will be completed before UAE customer data is processed. |
8. Customer obligations
The customer is responsible for having a lawful basis for the processing, giving appropriate privacy information to its data subjects, obtaining any required consent, setting retention periods and giving lawful instructions.
The customer decides which of its staff can read and reply to chats, keeps their sign-in details secure, and removes people who no longer need access. Bookings written into the customer’s own Google Calendar are the customer’s records: Cailub’s retention periods do not delete them there.
For AI Phone & SMS, the customer is responsible for: telling callers about call recording where required (the agent also announces it); having a lawful basis, and for marketing texts the consent required in each recipient’s country, before adding someone as a marketing contact; recording accurately where and how consent was given; only asking the agent to call people who requested a call or who are existing customers expecting it; and the accuracy of the business address and documents it provides for phone numbers.
9. Executed agreements
Business customers who need a signed copy of this DPA can request one from cailub.solutions@gmail.com.