Data Processing Addendum

TrueLink 365 processes personal data to provide the Service for as long as the Terms are in force, and then deletes or returns it as described in section 8.

Operating the AI Assistant, capturing and storing leads, scheduling bookings, sending follow-up email on the Client's instructions, and hosting the Client's site where Website Care applies.

• —Data subjects: the Client's website visitors, chat users, and leads.
• —Personal data: identifiers such as name and email, phone number where provided, message and conversation content, form submissions, booking details, and technical data such as IP address.
• —The Client will not use the Service to process special-category data or children's data.

TrueLink 365 processes personal data only on the Client's documented instructions, which are given by the Client's configuration and use of the Service and by these terms, unless law requires otherwise, in which case TrueLink 365 will inform the Client where permitted.

TrueLink 365 ensures that people authorised to process the data are under a duty of confidentiality, and maintains technical and organisational measures appropriate to the risk, including encryption in transit, hashed credentials, access control on a need-to-know basis, and use of reputable infrastructure providers.

• —Taking into account the nature of processing, TrueLink 365 assists the Client with responding to data-subject requests, including by providing portal tools to search, export, and delete conversations and leads.
• —TrueLink 365 assists the Client with security, breach notification, and data protection impact assessments as required by Articles 32 to 36 of the GDPR.
• —TrueLink 365 notifies the Client without undue delay after becoming aware of a personal-data breach affecting the Client's data.

The Client authorises TrueLink 365 to engage the sub-processors listed at /legal/subprocessors. TrueLink 365 imposes data-protection obligations on each sub-processor comparable to those in this Addendum, and remains liable for their performance. TrueLink 365 will update that page before adding or replacing a sub-processor; the Client may object on reasonable data-protection grounds within 30 days, and if the parties cannot resolve the objection the Client may terminate the affected part of the Service.

On termination of the Terms, or earlier at the Client's request, TrueLink 365 deletes or returns the personal data it processes for the Client within 90 days, except where storage is required by law. Routine backups are overwritten on a rolling basis within 90 days.

Where personal data is transferred out of the EEA or the UK, TrueLink 365 relies on an approved transfer mechanism, such as the Standard Contractual Clauses, together with the data processing agreements of the sub-processors involved.

TrueLink 365 makes available information reasonably necessary to demonstrate compliance with this Addendum. On reasonable written request, and no more than once a year unless required by a supervisory authority, TrueLink 365 will respond to a reasonable audit questionnaire.

If this Addendum conflicts with the Terms on the processing of personal data on the Client's behalf, this Addendum prevails. To request a countersigned copy, email legal@truelink365.com.