Data processing agreement
Version 1.0 · Effective 24 October 2026
This agreement forms part of every contract, proposal or order under which PTC Byte Labs processes personal data on a client's behalf. It applies automatically when the client accepts our proposal or terms. A signed copy is available on request from hello@ptcbytelabs.com.
1. Parties and roles
This Data Processing Agreement ("DPA") is between the client named in the relevant proposal or order (the "Client", acting as controller) and PTC (Professional Training Consultants) Ltd, trading as PTC Byte Labs, company number 12250234, 49 Orchard Grove, Harrow, HA3 9QR ("we", "us", acting as processor).
It is made to meet the requirements of Article 28 of the UK GDPR and the Data Protection Act 2018 (together, "Data Protection Law"). Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meanings given in Data Protection Law.
2. Details of the processing
| Subject matter | Providing the services described in the Client's proposal, such as websites, AI assistants (call, chat and WhatsApp), automation, CRM and custom software. |
|---|---|
| Duration | For the term of the services, plus any period needed to return or delete data under section 10. |
| Nature and purpose | Hosting, storing, collecting, recording, organising, analysing, transmitting and deleting personal data, only to provide, support and improve the services for the Client. |
| Types of personal data | Contact details (names, phone numbers, email addresses), enquiry and booking details, call recordings and transcripts, chat and message content, and CRM records. Any other types will be set out in the proposal. |
| Categories of data subjects | The Client's customers, prospective customers, website visitors, callers and staff. |
The Client must not instruct us to process special category data or criminal offence data unless this is agreed in writing, with any extra safeguards that are needed.
3. Client responsibilities
The Client is responsible for having a lawful basis for the processing, for giving data subjects the privacy information they need (including telling callers when they are speaking to an AI assistant or being recorded, where required), and for making sure its instructions to us comply with Data Protection Law.
4. Our obligations
We will:
- process personal data only on the Client's documented instructions, including this DPA and the proposal, unless the law requires otherwise (in which case we will tell the Client first, unless the law forbids this);
- tell the Client promptly if we believe an instruction breaks Data Protection Law;
- make sure everyone who processes the personal data is bound by a duty of confidentiality;
- put in place appropriate technical and organisational security measures, as described in section 5;
- follow the conditions for using sub-processors in section 6;
- help the Client, as far as reasonably possible, to respond to requests from data subjects exercising their rights;
- help the Client meet its obligations on security, breach notification, data protection impact assessments and consultation with the ICO; and
- keep a record of our processing activities on the Client's behalf.
5. Security
Our measures include encrypted connections (TLS) and encryption at rest offered by our hosting providers; role-based access limited to people who need it; multi-factor authentication on administrative accounts; separate credentials for each client system; regular software updates; backups where included in the service; and secure deletion when data is no longer needed.
6. Sub-processors
The Client gives general authorisation for us to use sub-processors to deliver the services. Our standard sub-processors are:
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, security, email routing | Global (UK/EU where available) |
| Google LLC | Email, documents and cloud services | UK/EU/US |
| Brevo (Sendinblue SAS) | Email delivery | EU |
| AI, voice and telephony providers named in the proposal | Speech, language and call handling for AI assistants | As stated in the proposal |
| Vetted delivery partners | Design, development and support | UK and India |
We will give the Client at least 14 days' notice by email before adding or replacing a sub-processor. The Client may object on reasonable data protection grounds, and the parties will discuss the objection in good faith. We will impose data protection terms on every sub-processor that are no less protective than this DPA, and we remain responsible to the Client for their performance.
7. International transfers
We will not transfer personal data outside the UK unless the transfer is covered by UK adequacy regulations, or protected by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures that are needed.
8. Personal data breaches
We will notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Client's data. We will provide the information reasonably available to us to help the Client meet its own reporting duties, and take reasonable steps to contain and fix the breach.
9. Audits and information
We will make available the information reasonably needed to show that we comply with this DPA. On reasonable notice, and no more than once a year (unless there has been a breach or a regulator requires it), we will allow audits by the Client or an independent auditor bound by confidentiality, at the Client's cost.
10. Return and deletion
When the services end, we will, at the Client's choice, return the personal data in a commonly used format or delete it, within 30 days, unless the law requires us to keep it. Backups will be deleted on their normal schedule.
11. Liability, priority and law
Each party's liability under this DPA is subject to the limits in the main agreement, except where the law does not allow liability to be limited. If this DPA conflicts with the main agreement on the processing of personal data, this DPA takes priority. This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Contact
Data protection questions: hello@ptcbytelabs.com · +44 7404 397993