Data Processing Summary for Clients

Last updated: [Date]

When you use our software to contact your own customers, we handle some of their information for you. This summary explains how, in plain English.

In plain English

For information about your customers and contacts, you decide why and how it is used. We process it on your behalf and follow your instructions.
We keep it confidential, secure it, and use it only to provide the services.
We use trusted service providers (sub-processors), and stay responsible for them.
We help you answer privacy requests, and delete or return your data when you leave.
This is a summary. A full data processing agreement is available on request [Confirm].

Contents

Purpose of this summary
Roles
What we process
Our commitments
Your responsibilities
Security
Sub-processors
Helping with requests and legal duties
Data incidents
Return and deletion
International transfers
US state laws and a full agreement
Contact

1Purpose of this summary

This Data Processing Summary explains how Business Profile Pro (“BPP”), operated by [Legal entity name], handles personal information that our clients (“you”) put into or collect through our services, such as your customers’ and leads’ contact details, messages, chat and call transcripts and recordings, bookings, and form submissions (“Client Data”). It forms part of our Terms and Conditions. How we handle your own information (as our client) is in our Privacy Policy.

2Roles

For Client Data, you are the business (the “controller” or under some laws the “business”) and we are your service provider (the “processor”). You decide what Client Data to collect and why. We process it on your behalf to provide the services. For information we collect for our own purposes, such as your account, billing and our website analytics, we are responsible for that information, as described in our Privacy Policy.

3What we process

Subject matter and duration: providing the services you subscribe to, for as long as your account is active, plus the short period we need to wind it down.
Types of information: names, phone numbers, email addresses, addresses, appointment details, messages and chat logs, call recordings and transcripts, form answers, review requests and responses, and anything else you or your customers enter.
People concerned: your customers, leads, prospects, and your own staff.
Purpose: hosting and delivering your CRM, messaging, calls, booking, forms, reviews, websites, AI bots and related features.

[Owner: confirm that this list matches the services you provide.]

4Our commitments

We will:

process Client Data only to provide the services and follow your documented instructions, including as given by your use of the services, unless the law requires otherwise;
not sell Client Data, and not share it for cross-context behavioral advertising;
not keep, use or disclose Client Data outside our direct business relationship with you or for any other purpose than providing the services, except as the law allows;
make sure our people who access Client Data are bound by confidentiality;
protect Client Data with appropriate technical and organizational security measures (see section 6);
tell you if we believe an instruction breaks the law; and
give you the information reasonably needed to show that we are meeting these commitments.

5Your responsibilities

You must have the right to give us Client Data and to have us process it, including lawful consent to text, email or call people, and to record calls where you choose to.
You must give your customers any notices the law requires, including notice that you use service providers, and that chats or calls are recorded or handled by AI.
You must keep your account secure and tell us if you suspect a breach.
You must not put sensitive information, such as government IDs, full payment card numbers or health information, into the services unless we have agreed in writing.

6Security

We use reasonable measures designed to protect Client Data, which may include encryption in transit, access controls and logging, separation of customer accounts, secure hosting, backups, and staff training. [Confirm and list only measures that are actually in place. Do not claim certifications that BPP does not hold.] No system is perfectly secure.

7Sub-processors

You agree that we may use sub-processors to help deliver the services. These fall into these categories: our software platform and its technology providers; cloud hosting and storage; payment processing (Stripe); email and text message delivery; telephone carriers and voice services; AI service providers; analytics and support tools. [Confirm: a current list of sub-processors with their purpose and location, or a link to it.]

We have written agreements with sub-processors that require them to protect information appropriately, and we are responsible for their performance of these duties. We will tell you about changes to our sub-processors by [method: confirm] and, where the law or your agreement gives you the right, you may object before the change takes effect.

8Helping with requests and legal duties

Customer requests. If a person asks us directly for access to, correction or deletion of their Client Data, we will direct them to you unless the law requires us to answer. We will give you reasonable help to respond to such requests, through tools in your account or by contacting [legal@email]. We may charge for help that takes unusual effort [Confirm].
Legal requests. If we receive a legal demand for Client Data, we will tell you unless we are not allowed to, and will share only what we are legally required to.
Impact assessments and audits. We will give reasonable help with privacy assessments and regulator inquiries. We may answer reasonable audit questions in writing instead of on-site audits [Confirm].

9Data incidents

If we become aware of a security incident that leads to unauthorized access to or loss of Client Data, we will notify you without undue delay [Confirm timeframe, for example within 72 hours], tell you what we know, and help you meet your own notice duties.

10Return and deletion

When the services end, you can export your Client Data [Confirm export method and the period you give to do so]. After that, we will delete or de-identify Client Data within [30 to 90 days: confirm], unless the law requires us to keep it. Backups are deleted on their regular cycle.

11International transfers

We store and process Client Data in the United States and in other places where our providers operate. [Confirm: if you serve clients in the UK or EU, add transfer terms such as Standard Contractual Clauses and the UK Addendum, with an attorney.]

12US state laws and a full agreement

This summary is meant to meet the service provider terms that US state privacy laws, such as the California Consumer Privacy Act, require in contracts with service providers. If you need a full signed data processing agreement, for example for a larger business, regulated industry or EU/UK customers, please contact us at [legal@email]. [Confirm whether a full DPA will be offered.]

13Contact

Questions? Contact [Legal entity name], [Address], [legal@email].

Questions about this document?

Business Profile Pro is a marketing agency for local businesses. Questions about this document? Email [legal@email] or contact us.