Data Processing Addendum

This Addendum applies where Learnly Ventures Inc, trading as Inyoke, processes personal data on a customer’s behalf. It forms part of the Terms of Service and takes precedence over them on the subject of data protection.

1. Roles

For personal data contained in Customer Data, the customer is the controller (or, under US state privacy laws, the business) and Inyoke is the processor (or service provider). Where the customer is itself a processor for another controller, Inyoke is a sub-processor and the customer confirms it has authority to appoint one.

Inyoke is an independent controller for its own account, billing and website data. That processing is governed by the Privacy Policy, not this Addendum.

2. Processing on documented instructions

We will process personal data only on the customer’s documented instructions, which comprise the Terms, this Addendum, the configuration the customer chooses in the product, and any further written instruction the parties agree. We will tell the customer if we believe an instruction infringes applicable data protection law, and may suspend the affected processing.

We will not sell personal data, share it for cross-context behavioural advertising, retain, use or disclose it outside the direct business relationship, or combine it with data from other sources except as permitted by applicable law. We certify that we understand and will comply with these restrictions.

3. Confidentiality of personnel

Personnel authorised to process personal data are bound by confidentiality obligations, receive appropriate training, and are granted access on a least-privilege, need-to-know basis.

4. Security

We implement and maintain the technical and organisational measures set out in Annex II, appropriate to the risk. We may update them provided the level of protection is not materially reduced.

5. Personal data breach

We will notify the customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting their personal data. The notice will describe the nature of the breach, the categories and approximate volume of data and data subjects affected so far as known, the likely consequences, and the measures taken or proposed. We will cooperate reasonably with the customer’s own notification obligations. Notice is not an acknowledgement of fault.

6. Sub-processors

The customer gives general authorisation for us to engage sub-processors to help provide the Services. A current list, with the role each performs, is available on request to support@inyoke.com. We impose data protection obligations on each that are no less protective than this Addendum, and we remain liable for their performance.

We will give at least 30 days’ notice before adding or replacing a sub-processor, by email to the account’s administrative contact. The customer may object on reasonable data protection grounds within that period; if we cannot resolve the objection, the customer may terminate the affected Services without penalty for the unused portion of any prepaid term.

7. Automated processing and model providers

Some features apply machine learning to Customer Data. Speech recognition for call transcription runs on infrastructure we operate, and audio is not sent to a third-party transcription service. Message classification and assistant features use third-party model providers engaged as sub-processors under section 6; those providers are contractually restricted from using the content to train their models.

We do not use Customer Data to train models that serve any other customer, and we do not train general-purpose models on it.

8. Data subject requests

The product gives the customer the ability to access, correct, export and delete records directly. Where a data subject contacts us instead, we will not respond on the customer’s behalf except as legally required, and will refer them to the customer or pass the request on where we can identify the account. We will provide reasonable assistance if the customer cannot fulfil a request through the product.

9. Assessments and consultation

Taking into account the nature of processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and prior consultations with a supervisory authority.

10. Return and deletion

On termination, we make Customer Data available for export for 30 days. After that we delete it, subject to backup rotation and any retention required by law. Backups are overwritten in the ordinary cycle. Where deletion is not immediately possible, we continue to protect the data and isolate it from further processing.

11. Audits

We will make available the information reasonably necessary to demonstrate compliance with this Addendum, and will respond to reasonable security questionnaires no more than once a year unless a supervisory authority requires otherwise or a breach has occurred. Where an on-site audit is legally required, the parties will agree scope, timing and cost in advance, subject to reasonable confidentiality and security conditions.

12. International transfers

We process personal data in the United States. Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland, the parties incorporate the European Commission’s Standard Contractual Clauses (Module Two, controller to processor, or Module Three where the customer is a processor), together with the UK International Data Transfer Addendum where applicable. Annex I and Annex II below serve as the corresponding annexes. In the event of conflict, the Clauses prevail.

13. Liability

Each party’s liability under this Addendum is subject to the limitations and exclusions in the Terms of Service, except where applicable data protection law does not permit that.

Annex I — Details of processing

• Subject matter. Provision of a CRM, outbound dialing, messaging and reporting platform.
• Duration. The subscription term, plus the export and deletion periods in section 10.
• Nature and purpose. Storage, organisation, retrieval, transmission, transcription, classification, analysis and deletion, to operate the Services for the customer.
• Categories of data subjects.The customer’s personnel and authorised users; the customer’s leads, prospects, policyholders and other contacts.
• Categories of personal data. Identifiers such as name, telephone number, email and postal address; account and role data; professional licensing details of users; communications content including call audio where enabled, transcripts, message content and notes; interaction metadata such as call times, outcomes, dispositions and consent and do-not-call status; and commercial data such as quotes, policies and commissions.
• Sensitive data. Not required by the Services. Customers determine what they submit, and are responsible for any additional safeguards their own data demands.
• Frequency. Continuous, for the duration of the subscription.

Annex II — Technical and organisational measures

• Tenant isolation.Every agency’s data is separated by tenant, enforced in the data-access layer rather than left to individual queries, so a query that omits the tenant scope fails rather than returning another customer’s rows.
• Access control. Role-based permissions down to the field, with separate axes for what a user can see and what a user can do. Administrative capability is granted by area.
• Encryption. TLS for data in transit. Provider credentials and other secrets are encrypted at rest with AES-256-GCM. Passwords are stored using a modern one-way hash.
• Session management. Server-validated sessions with a single active session per account, so a new sign-in ends the previous one.
• Audit logging. Privileged and compliance-relevant actions are logged, including an audit record for every dial attempt and its screening outcome.
• Segregation of duties. Machine-to-machine ingress is authenticated with per-tenant secrets and resolves the owning tenant before any data is written.
• Resilience. Managed database hosting with point-in-time recovery; the telephony layer holds no durable customer data.
• Personnel. Confidentiality obligations, least-privilege access, and prompt revocation on role change or departure.

Contact

Questions about this Addendum, or requests for a countersigned copy, go to support@inyoke.com.