Scope
These data protection terms ("DPA") form part of the agreement between Clodia and each business customer. They apply when Clodia processes personal data on the customer's behalf in providing the Clodia service, such as caller details, call audio, transcripts and summaries. They are written to meet Article 28 of the UK GDPR and the processor obligations of the UAE Federal Decree-Law No. 45 of 2021 (PDPL).
Roles
The customer is the controller of personal data processed in its workspace and on its phone lines. Clodia is the processor. Where Clodia decides the purposes of processing itself, such as for account administration and billing, Clodia is a controller and our privacy policy applies.
Details of processing
| Item | Detail |
|---|---|
| Subject matter | Answering calls, capturing requests and preparing next steps for the customer |
| Duration | The term of the agreement, plus the deletion period below |
| Data subjects | The customer's callers, residents, clients, staff and contractors |
| Data categories | Names, phone numbers, email addresses, addresses or unit references, call audio (streamed, not stored as a recording by default), transcripts, summaries and request details |
| Special category data | Not intended. Customers should configure their playbook so Clodia does not collect it unless strictly necessary |
Our commitments as processor
- Instructions. We process personal data only on the customer's documented instructions, including the playbook and settings it configures, unless the law requires otherwise. We will tell the customer if we believe an instruction breaks data protection law.
- Confidentiality. Everyone authorised to process the data is bound by confidentiality.
- Security. We apply the measures described below and keep them under review.
- Subprocessors. The customer gives general authorisation to the subprocessors on our subprocessors page. We will give at least 30 days' notice of a new subprocessor, during which the customer may object on reasonable data protection grounds. We impose equivalent data protection terms on each subprocessor and remain responsible for them.
- Assistance. We help the customer respond to requests from individuals and meet its obligations on security, breach notification, impact assessments and consultation with regulators.
- Breaches. We notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data, with the information it needs to meet its own reporting duties.
- Deletion. When the agreement ends, the customer may export its data for 30 days. We then delete it, including from active systems, within 90 days, unless the law requires us to keep it. Backups age out on their normal cycle.
- Audit. We make available the information needed to show compliance with this DPA and allow reasonable audits, on at least 30 days' notice, no more than once a year unless a regulator requires it or there has been a breach.
Security measures
- Encryption in transit (TLS) for the website, the workspace, telephony and provider connections.
- Tenant isolation: every database query is scoped to the customer's workspace.
- Provider credentials and API keys are kept on the server and never sent to browsers.
- Passwords are stored as salted hashes. Workspace sessions use secure, HTTP-only cookies.
- Administrator access is restricted and protected by separate authentication.
- Rate limits and origin checks on public endpoints to resist abuse.
- Consequential actions, such as spending or dispatch, require approval under the customer's rules.
- Hosting on reputable cloud providers with physical and infrastructure security.
International transfers
Where a subprocessor processes personal data outside the UK or UAE, we put an appropriate transfer mechanism in place: UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the safeguards permitted under the PDPL.
Customer responsibilities
The customer ensures it has a lawful basis for the processing it instructs, gives callers the notices required by law (including that they are speaking with an AI assistant and about any transcription), and configures its playbook accordingly.
Order of precedence
If this DPA conflicts with the terms of service on the processing of personal data, this DPA prevails. A signed copy is available on request from legal@clodiahq.com.