Data Processing Agreement

This Agreement is made between:

(1) RECEPTIKO AI LTD, a company registered in England and Wales under company number 17272011, whose registered office is at 14 Pierson Road, Windsor, SL4 5RQ ("the Processor", "we", "us"); and

(2) [CLIENT LEGAL NAME], [company number / sole trader] of [ADDRESS] ("the Controller", "you").

Each a "party" and together "the parties".

Effective date: ______________________

This Agreement is supplemental to, and forms part of, the agreement between the parties ("the Services Agreement") under which Receptiko AI Ltd provides the Receptiko telephone assistant service ("the Services"). Unless the parties have signed a separate services agreement, the Services Agreement is Receptiko AI Ltd’s Terms of Service as accepted by the Controller and amended from time to time in accordance with their terms (currently published at receptiko.ai/terms). Where this Agreement conflicts with the Services Agreement on the subject of personal data, this Agreement prevails, except that clause 13.2 applies to all liability under or in connection with this Agreement.

1. Definitions and roles

1.1 In this Agreement, "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given to them in the UK GDPR.

1.2 "Data Protection Law" means the UK GDPR (as defined in section 3(10) of the Data Protection Act 2018), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426) (PECR), and any successor or amending legislation.

1.3 The parties acknowledge that, for the personal data described in Schedule 1, the Controller is the controller and Receptiko AI Ltd is the processor. Receptiko AI Ltd is a separate controller in respect of its own business contacts and billing records, which fall outside this Agreement.

1.4 If Receptiko AI Ltd determines the purposes and means of any processing, it acts as a controller in respect of that processing and accepts the obligations of a controller under Data Protection Law.

1.5 "Supervisory authority" means the Information Commission (known as the ICO) or any other authority with power to regulate the processing of the personal data.

2. Processing on documented instructions

2.1 Receptiko AI Ltd shall process personal data only on the Controller’s documented instructions, including in relation to any transfer of personal data outside the United Kingdom, unless required to do otherwise by domestic law to which Receptiko AI Ltd is subject. Where the law requires other processing, Receptiko AI Ltd shall inform the Controller before processing unless the law prohibits it on important grounds of public interest.

2.2 This Agreement, together with the Controller’s configuration choices recorded during onboarding (services, prices, durations, opening hours, call handling rules and message routing), constitutes the Controller’s documented instructions.

2.3 Receptiko AI Ltd shall immediately inform the Controller if, in its opinion, an instruction infringes Data Protection Law. Receptiko AI Ltd may suspend the affected processing until the instruction is confirmed, amended or withdrawn.

2.4 Receptiko AI Ltd shall not sell personal data, nor use it for its own marketing, nor use it to train or improve artificial intelligence or machine learning models, and shall not permit any sub-processor to use the content of any call (including any recording or transcript, and anything said by the caller or the assistant), whether or not in de-identified form, to train or improve artificial intelligence or machine learning models or to improve the sub-processor’s own products or services. Before any personal data is processed under this Agreement, Receptiko AI Ltd shall apply, or require the relevant sub-processor to apply, any setting that a sub-processor makes available to exclude personal data from any such use (including Vapi’s Zero Data Retention setting), and shall keep each such setting applied for as long as it processes personal data under this Agreement. Configuring and testing the Services for the Controller is not training or improving a model. The Controller acknowledges that, with Vapi’s Zero Data Retention setting applied, Vapi keeps call metadata (such as call and assistant identifiers, call type and status, start and end times, cost and the telephony call reference, but not the content of the call or the caller’s telephone number), which Vapi uses in accordance with its own terms.

3. Confidentiality

3.1 Receptiko AI Ltd shall ensure that any person authorised to process the personal data is subject to a duty of confidentiality, whether by contract or by statute, and that access is limited to those who need it to provide the Services.

4. Security

4.1 Receptiko AI Ltd shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR. The measures in place at the date of this Agreement are set out in Schedule 3.

4.2 Receptiko AI Ltd may update those measures provided the level of protection is not reduced.

5. Sub-processors

5.1 The Controller gives general written authorisation for Receptiko AI Ltd to engage the sub-processors listed in Part 1 of Schedule 2, and for those sub-processors to engage the further sub-processors described in Part 2 of Schedule 2.

5.2 Receptiko AI Ltd shall give the Controller at least 14 days’ written notice before adding or replacing a sub-processor in Part 1 of Schedule 2. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the Services on written notice without penalty, and shall be refunded any fees paid in advance for the unused period.

5.3 Receptiko AI Ltd shall impose on each sub-processor data protection obligations no less protective than those in this Agreement, and, subject to clause 13.2, remains fully liable to the Controller for the performance of each sub-processor.

5.4 Receptiko AI Ltd shall ensure that each sub-processor in Part 1 of Schedule 2 that engages another sub-processor to process the Controller’s personal data does so only under a written contract that imposes data protection obligations no less protective than those in this Agreement.

5.5 Receptiko AI Ltd shall subscribe to any notification service that a sub-processor in Part 1 of Schedule 2 offers for changes to its own sub-processors, and shall notify the Controller in writing of any intended addition or replacement of a sub-processor in Part 2 of Schedule 2 within 2 working days (excluding weekends and bank holidays in England) after Receptiko AI Ltd is notified of it, and where possible before the change takes effect. The Controller may object on reasonable data protection grounds within 14 days of Receptiko AI Ltd’s notice. If the parties cannot resolve the objection, the Controller may terminate the Services as set out in clause 5.2.

5.6 A service that the Controller connects to the Services under its own agreement with the provider of that service, such as the Controller’s own Google Calendar, is not a sub-processor of Receptiko AI Ltd. The provider of that service processes the personal data held in it under the Controller’s own agreement with that provider.

6. Assistance to the Controller

6.1 Taking into account the nature of the processing, Receptiko AI Ltd shall assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling the Controller’s obligation to respond to requests to exercise data subject rights, and in responding to complaints made to the Controller under section 164A of the Data Protection Act 2018.

6.2 Receptiko AI Ltd shall promptly notify the Controller if it receives a request or complaint directly from a data subject relating to the Controller’s personal data, and shall not respond to it except on the Controller’s instructions or as required by law.

6.3 Receptiko AI Ltd provides the Controller with self-service means to export the personal data it holds, and to delete an individual record, so that the Controller can meet access, rectification, erasure and portability requests without delay.

6.4 Receptiko AI Ltd shall assist the Controller in complying with its obligations under Articles 32 to 36 of the UK GDPR (security, breach notification and data protection impact assessments), taking into account the nature of the processing and the information available to it.

7. Personal data breaches

7.1 Receptiko AI Ltd shall notify the Controller without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting the Controller’s personal data.

7.2 The notification shall describe, so far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the information is not all available at once, it may be provided in phases without further undue delay.

7.3 Receptiko AI Ltd shall not notify a supervisory authority or any data subject on the Controller’s behalf unless the Controller instructs it to do so, or the law requires it.

8. Deletion and return

8.1 When the Services end for any reason (including at the end of a pilot), and at the Controller’s choice, Receptiko AI Ltd shall delete or return all personal data processed on the Controller’s behalf, and delete existing copies, unless required by domestic law to retain it.

8.2 Unless the Controller instructs otherwise in writing within 30 days of termination, Receptiko AI Ltd shall provide the Controller with an export of its customer records and then delete the data within 60 days of termination.

8.3 Backups are overwritten on a rolling cycle and are deleted in the ordinary course within 35 days.

9. Information and audit

9.1 Receptiko AI Ltd shall make available to the Controller all information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR.

9.2 Receptiko AI Ltd shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor it mandates. Audits shall take place on at least 30 days’ written notice (or such shorter notice as is reasonable where a personal data breach has occurred or a supervisory authority requires it), no more than once in any 12-month period unless a personal data breach has occurred or a supervisory authority requires it, during business hours, and in a manner that does not disrupt the Services. The Controller shall bear its own costs.

9.3 Receptiko AI Ltd may respond to an audit request first by providing documents and information, including any certification or independent audit report (such as a SOC 2 report) of a relevant sub-processor where the sub-processor permits Receptiko AI Ltd to share it. If the Controller reasonably considers that this is not enough to demonstrate compliance, the audit shall proceed under clause 9.2. An audit or inspection of a sub-processor is limited to the audit rights that the sub-processor makes available to Receptiko AI Ltd.

9.4 The Controller shall ensure that any auditor it mandates is bound by a duty of confidentiality and is not a competitor of Receptiko AI Ltd.

10. International transfers

10.1 Some sub-processors listed in Schedule 2 process personal data outside the United Kingdom. Where they do, Receptiko AI Ltd shall ensure the transfer is covered by regulations approving the transfer under Article 45A of the UK GDPR (including, for a recipient certified to it, the UK Extension to the EU-US Data Privacy Framework), or by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses together with any supplementary measures required for the data protection test in Article 46 of the UK GDPR to be met.

10.2 The Controller authorises such transfers for the purpose of providing the Services.

10.3 The transfer safeguard relied on for each sub-processor in Part 1 of Schedule 2 is stated in that Schedule. Where a transfer relies on the UK International Data Transfer Agreement or the UK Addendum, Receptiko AI Ltd shall keep a record of its assessment that the data protection test is met and make it available to the Controller on request.

11. Call transcripts

11.1 The Services transcribe telephone calls so that bookings and messages can be handled accurately and faults investigated. Calls are not recorded: the audio of a call is processed only while the call is in progress, and no recording is kept. Transcripts are personal data processed on the Controller’s behalf.

11.2 The Controller is responsible for informing its own customers that calls are answered by an AI assistant and transcribed, and for including this in its own privacy notice.

11.3 Receptiko AI Ltd shall set up the assistant so that, at the start of each call, it tells the caller that they are speaking to an AI assistant, that a written transcript of the call is kept, and how to find the Controller’s privacy notice. Receptiko AI Ltd may agree the exact wording with the Controller, but shall not remove those statements.

12. Marketing messages

12.1 Where the Services send text messages to the Controller’s customers, the Controller is responsible for ensuring a lawful basis under PECR and the UK GDPR, including the soft opt-in conditions where relied upon.

12.2 Receptiko AI Ltd shall record whether each customer has consented to receive messages, and shall honour an opt-out without undue delay once notified.

12.3 The Controller shall not instruct Receptiko AI Ltd to send automated marketing calls, which require prior consent under PECR.

13. Liability, term and general

13.1 This Agreement takes effect on the earlier of the effective date and the date on which the Controller first uses the Services (including any free pilot), and continues for as long as Receptiko AI Ltd processes personal data on the Controller’s behalf. Where the Controller has accepted the Services Agreement online, this Agreement binds the parties from that date without being signed.

13.2 Each party’s liability under or in connection with this Agreement is subject to the limitations and exclusions of liability set out in the Services Agreement, and any liability of Receptiko AI Ltd under or in connection with this Agreement counts towards, and is not in addition to, the overall limit of its liability in the Services Agreement, save that nothing in this Agreement or the Services Agreement limits or excludes liability which cannot lawfully be limited or excluded, or affects the rights of any person under Article 82 of the UK GDPR.

13.3 This Agreement and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation shall be governed by and construed in accordance with the law of England and Wales.

13.4 Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with this Agreement or its subject matter or formation.

Signatures

Signed for and on behalf of RECEPTIKO AI LTD

Signature: ______________________________ Date: ______________

Name: __________________________________ Position: ____________

Signed for and on behalf of the Controller

Signature: ______________________________ Date: ______________

Name: __________________________________ Position: ____________

Schedule 1 — Details of the processing

Retention: calls are not recorded. Call transcripts are deleted automatically after 90 days. Customer records for the term of the Services and then as set out in clause 8. Deleted data may remain in backups for up to 35 days, as set out in clause 8.3. The Controller may instruct shorter periods in writing.

Schedule 2 — Authorised sub-processors

Current as at the effective date. The Controller will be given notice of any change, as set out in clauses 5.2 and 5.5.

Part 1 — Sub-processors engaged by Receptiko AI Ltd

Part 2 — Further sub-processors

Receptiko AI Ltd does not contract with the providers below directly: Vapi engages them to provide its platform. Each sub-processor in Part 1 may also engage the further sub-processors on the list it publishes (Vapi at security.vapi.ai, Twilio at twilio.com/legal/sub-processors and Railway at trust.railway.com).

Part 3 — Services the Controller connects

Google (Calendar API): Receptiko AI Ltd reads and writes the Controller’s appointment calendar with the Controller’s authorisation. Google holds that calendar under the Controller’s own agreement with Google and is not a sub-processor of Receptiko AI Ltd (see clause 5.6).

Schedule 3 — Technical and organisational measures

Access control

• Access to systems holding personal data is limited to the director of Receptiko AI Ltd.

• Administrative interfaces are protected by a secret key that is not published and is rotated if exposure is suspected.

• No shared accounts; no customer data is held on personal devices beyond what is necessary to provide support.

Credentials and secrets

• API keys, tokens and database credentials are stored as encrypted environment variables in the hosting platform and are never committed to source control.

• Each client’s data is separated by a client identifier; a request without a valid identifier is refused rather than defaulted.

Data in transit and at rest

• All connections between systems use TLS.

• The database is hosted on managed infrastructure with encryption at rest and automated backups.

Minimisation

• Only the fields needed to make and manage a booking are collected.

• The assistant is instructed not to request health, payment or identity information, and cannot take card details.

• Vapi’s Zero Data Retention setting is enabled, so that Vapi keeps no call content after a call ends. Call transcripts are delivered to, and held only in, Receptiko AI Ltd’s own database. Vapi keeps call metadata, which does not include the content of the call or the caller’s telephone number, after a call ends.

Deletion

• An individual customer record can be deleted on request, with deletion taking effect immediately.

• Calls are not recorded. Call transcripts are deleted automatically on the retention cycle in Schedule 1.

Monitoring and resilience

• Application logs are reviewed for errors; failures that could affect a booking are alerted rather than silently discarded.

• Bookings are written to the Controller’s own calendar, so the Controller retains an independent copy of its appointments at all times.

Organisational

• Receptiko AI Ltd is registered with the Information Commission (known as the ICO), registration number ZC249463.

• Sub-processors are chosen from established providers that publish their own data protection terms.

• This Schedule is reviewed at least annually and whenever the architecture changes materially.