Data Processing Agreement

1. Overview and structure

This Data Processing Agreement ("DPA") forms part of the agreement between the Customer and Future Laboratories LTD, company number 17047436, trading as Trinity, a company registered in England and Wales with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, and registered with the Information Commissioner's Office under registration number ZC131206 ("Trinity", "we", "us"). That agreement consists of the Trinity Terms of Service and any separate written agreement signed by both parties that incorporates or refers to this DPA (together, the "Agreement").

This DPA governs the Processing of Customer Personal Data by Trinity in the course of providing the Service. It is designed to satisfy Article 28 of the UK GDPR and applies whenever Trinity acts as a Processor on the Customer's behalf. Capitalised terms used but not defined in this DPA have the meanings given in the Agreement or in Section 10 (Definitions).

If this DPA and the Agreement conflict on the Processing of Personal Data, this DPA prevails.

2. Roles and details of the processing

For Customer Personal Data, Trinity acts as a Processor on the Customer's behalf, and the Customer acts as the Controller.

Trinity processes Authorised User account data (such as login details, role and billing contacts), and personal data about people who visit its website or ask it for a demo or free trial, as an independent Controller under its Privacy Policy. That data is not Customer Personal Data and this DPA does not apply to it.

The details of the Processing are:

3. Trinity's obligations as Processor

When acting as a Processor on the Customer's behalf, Trinity will:

3.1 Processing only on documented instructions

Process Customer Personal Data only on the Customer's documented instructions. These include the Agreement, this DPA, the set-up the Customer approves, and configuration choices and requests made by the Customer and its Authorised Users through the dashboard or Trinity Assistant. If applicable law requires Trinity to Process Customer Personal Data in any other way, Trinity will tell the Customer of that requirement before Processing, unless the law prohibits this on important grounds of public interest. Trinity will tell the Customer if, in its opinion, an instruction breaks Data Protection Law.

3.2 Confidentiality

Ensure that everyone Trinity authorises to Process Customer Personal Data has access only where they need it and is bound to keep it confidential, whether by written agreement or by statutory duty.

3.3 Security measures

Implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The measures in place at the date of this DPA are described in Annex B.

3.4 Assistance with data subject requests

Taking into account the nature of the Processing, assist the Customer by appropriate technical and organisational measures, where possible, to respond to requests from Data Subjects exercising their rights under Data Protection Law (access, rectification, erasure, restriction, portability and objection). If Trinity receives such a request directly and it relates to Customer Personal Data, Trinity will tell the Customer without undue delay and, unless the law prevents it or the Customer instructs otherwise, refer the Data Subject to the Customer.

3.5 Requests from public authorities

Tell the Customer about any legally binding request Trinity receives from a court, regulator, law enforcement agency or other public authority to disclose Customer Personal Data, unless the law prohibits this.

3.6 Breach notification

If Trinity becomes aware of a Data Incident affecting Customer Personal Data, including one at a Sub-processor, Trinity will notify the Customer without undue delay, and in any event within 72 hours of first becoming aware of it (whether by its own detection or by notice from a Sub-processor). The notification will describe, as far as known at the time, the nature of the incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed to address it.

Trinity may give an initial notification with the information then known and will provide more as it becomes available, to help the Customer meet its own obligations under Articles 33 and 34 of the UK GDPR.

3.7 Impact assessments

Provide reasonable assistance to the Customer, taking into account the nature of the Processing and the information available to Trinity, with data protection impact assessments and any prior consultation with the Information Commissioner's Office.

3.8 Return or deletion

When the Agreement ends, and at the Customer's choice, return or delete all Customer Personal Data and delete existing copies, unless the law requires Trinity to keep it. The Customer may ask for a copy of its Customer Data within 30 days after the Agreement ends. Trinity will complete deletion within 30 days after that period or after a written deletion request, whichever is sooner. Where the Customer deletes its account from the dashboard, the data it deletes is removed from Trinity's live systems immediately. In every case, copies in backups are overwritten on their normal cycle and are not restored in the meantime except for disaster recovery.

3.9 Audit rights

Make available to the Customer the information necessary to demonstrate compliance with Article 28 of the UK GDPR, and allow for and contribute to audits by the Customer or an independent auditor agreed by both parties, no more than once per calendar year and on at least 30 days' prior written notice. Trinity may meet audit requests by providing relevant certifications, penetration test summaries, or written answers to a security questionnaire of reasonable scope. Information provided under this section is Trinity's confidential information.

3.10 No training on Customer Personal Data

Not use Customer Data (including Customer Personal Data, Outputs and Derived Data) to train, retrain or fine-tune any machine-learning model. Trinity engages AI Sub-processors on terms under which they do not use Customer Personal Data to train their models and do not keep it after processing it for Trinity.

3.11 No biometric identification

Not use voice recordings for biometric identification of Data Subjects or create persistent voiceprints or voice templates. Speech-to-text transcription and labelling of speakers within a single call do not, in Trinity's assessment, amount to processing for the purpose of uniquely identifying a natural person under Article 9 of the UK GDPR.

4. Sub-processors

The Customer gives Trinity general written authorisation to engage Sub-processors within the categories listed in Annex A. Trinity keeps a current list of the named Sub-processors in each category, with their processing locations and transfer mechanisms, and will provide it to the Customer on request to legal@trinityapp.ai. Trinity will:

• enter into a written agreement with each Sub-processor that imposes data protection obligations no less protective than those in this DPA;
• remain liable to the Customer for the acts and omissions of each Sub-processor as if they were Trinity's own;
• tell the Customer about any intended addition or replacement of a Sub-processor at least 30 days in advance, by email to the Customer's account administrators, giving the Sub-processor's name, what it will do and where it will process data.

The Customer may object to a proposed change on reasonable data protection grounds by writing to legal@trinityapp.ai within the 30-day notice period. If the Customer does not object in that period, the change is treated as authorised. During the notice period, Trinity will not use the proposed Sub-processor to Process the Customer's Personal Data.

If the Customer objects, Trinity will work in good faith to find a solution acceptable to both parties, for example by not using that Sub-processor for the Customer's data or by using an alternative. If no solution is agreed within 30 days of the objection, the Customer may end the Agreement by written notice, and Trinity will refund any fees the Customer has paid for the period after it ends.

5. International data transfers

Trinity's core infrastructure, including its application database, call recording storage and logs, is hosted in the European Union. Where a Sub-processor offers UK or EU processing regions that meet the Service's needs, Trinity uses them. Transfers of Customer Personal Data to the European Economic Area rely on the UK adequacy regulations for the EEA.

Some Sub-processors, including some AI voice, speech and language model providers, process Customer Personal Data in the United States. For some AI voice agents, this includes live call audio.

Transfer mechanisms. Where a Sub-processor processes Customer Personal Data in a country that is not covered by UK adequacy regulations, Trinity ensures the transfer is made under one of the following, in this order of reliance: (a) where the Sub-processor is a US organisation with an active certification to the UK Extension to the EU-US Data Privacy Framework covering the relevant data, the Data Protection (Adequacy) (United States of America) Regulations 2023; and (b) in all other cases, and as a fallback if (a) ceases to apply, the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018, as incorporated in the Sub-processor's data processing terms, supported by a transfer risk assessment. Trinity will provide the mechanism used for each named Sub-processor on written request to legal@trinityapp.ai.

The Customer authorises the transfers described in this section where they are necessary to provide the Service.

6. Customer's obligations as Controller

The Customer will:

• give Trinity only instructions that are lawful under Data Protection Law;
• ensure it has an appropriate legal basis for the Processing of Customer Personal Data under the Agreement, including for recording, transcribing and analysing calls and messages;
• give Data Subjects all required information, including about AI and call recording, through the greetings and messages it approves and its own privacy notice, and obtain any consent required by Data Protection Law or PECR;
• for outbound calls, texts and emails, have any consent PECR requires and screen call lists against the Telephone Preference Service and Corporate Telephone Preference Service where required;
• promptly remove Authorised Users, and phone numbers linked to Trinity Assistant, that should no longer have access to the Service;
• not configure the Service in a way that would cause Trinity to Process Personal Data outside the scope described in this DPA.

7. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, including section 19 (Limitation of liability) of the Terms of Service.

Neither party limits any liability that cannot lawfully be limited. Nothing in this DPA or the Agreement limits any liability either party may have directly to a Data Subject under Article 82 of the UK GDPR.

8. Term and termination

This DPA takes effect when the Customer accepts the Agreement or starts using the Service, whichever is earlier, and remains in force for the duration of the Agreement and any period needed to complete return or deletion of Customer Personal Data under Section 3.8.

Obligations of confidentiality, security and data protection that by their nature are meant to continue survive the end of this DPA.

9. Governing law and jurisdiction

This DPA and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) are governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, except that either party may seek urgent interim or injunctive relief in any competent court to protect its rights.

10. Definitions

Capitalised terms used but not defined in this DPA have the meanings given in the Agreement. In this DPA:

• "Customer Data" means all data that the Customer, its Authorised Users or its customers provide to or through the Service, or that Trinity collects or receives on the Customer's behalf in providing it, including calls, call recordings, transcripts, SMS messages, emails, WhatsApp messages, customer and booking records, documents the Customer uploads, and data from systems the Customer connects.
• "Customer Personal Data" means Personal Data within Customer Data that Trinity Processes on the Customer's behalf as a Processor.
• "Data Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data in Trinity's or its Sub-processors' possession or control.
• "Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), and any other privacy or data protection law that applies to the Processing.
• "Derived Data" means aggregated analytics generated from Customer Data.
• "Outputs" means results Trinity's AI produces from Customer Data, including transcripts, summaries, analyses, categorisations and reports.
• "Personal Data" has the meaning given in the UK GDPR.
• "Processor", "Controller", "Data Subject" and "Processing" have the meanings given in the UK GDPR.
• "Service" has the meaning given in the Terms of Service.
• "Sub-processor" means a third party engaged by Trinity to Process Customer Personal Data on Trinity's behalf in connection with the Service.
• "UK GDPR" means the General Data Protection Regulation ((EU) 2016/679) as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended from time to time, including by the Data (Use and Access) Act 2025.

Annex A: Sub-processor categories

Trinity engages Sub-processors within the categories below to provide the Service. Each is bound by a written agreement as described in Section 4. The named list for each category, with processing locations and transfer mechanisms, is available to the Customer on request to legal@trinityapp.ai.

Annex B: Technical and organisational measures

Trinity maintains the following technical and organisational measures to protect Customer Personal Data. Trinity may change them over time, provided the overall level of security is not reduced.

• Encryption of data in transit (TLS) and at rest, as applied by Trinity's hosting Sub-processors.
• Least-privilege access: production systems and Customer Data are available only to people who need them, and access is removed when it is no longer needed.
• Two-factor authentication on production systems wherever the provider supports it.
• Logging of the Service's operation for security and fault-finding. Operational and audit logs are kept for up to one year, unless needed longer for a security investigation or legal compliance.
• Incident response covering detection, containment and Customer notification within the timeline in Section 3.6.
• Backups of Customer Data maintained by Trinity's hosting Sub-processors.
• Confidentiality obligations for everyone with access to Customer Personal Data, and code review for changes to the Service.