Isara Data Processing Agreement
This Data Processing Agreement (hereinafter referred to as “DPA”) is executed by and between Isara Systems Ltd, a company registered in England and Wales (company number 17091101) whose registered office is at 5-23 Old Street, London EC1V 9HL (the provider of the “Isara” service under the Terms of Service, hereinafter “Isara” or “Processor”), and the Client (hereinafter “Controller”).
In this DPA, Isara and the Client are each referred to as a “Party” and jointly as the “Parties.” Regarding the processing activities undertaken in connection with the Isara service (the “Services”), Isara acts as a Processor on behalf of the Client, who acts as the Controller of the personal data.
1. General Data Processing Terms
1.1 Role of the Parties: Where Isara processes personal data (“Personal Data”) on behalf of the Client in the course of providing the Services, it does so as a Processor for the Client and undertakes to comply with the EU General Data Protection Regulation, the UK GDPR and the Data Protection Act 2018, and, where applicable, the US State Privacy Laws in clause 10 (together, “Data Protection Laws”), and the provisions of this DPA, in accordance with and for the purposes of Article 28 of the GDPR and the UK GDPR.
1.2 Compliance with Instructions and Law: Isara undertakes to carry out the processing of Personal Data only in accordance with the obligations imposed by Data Protection Laws, this DPA, and the documented instructions of the Controller. The Processor shall immediately inform the Controller if, in its opinion, an instruction from the Controller infringes Data Protection Laws.
1.3 Documentation of Instructions: The Controller’s initial instructions to the Processor regarding data processing are reflected in this DPA. Any additional or alternate instructions must be agreed upon in writing (including electronic form) in advance, and the Processor will ensure all such instructions are documented and followed.
1.4 Controller’s Authorizations and Responsibilities: The Controller warrants that it has all necessary authority and legal basis to provide the Personal Data to the Processor and to instruct the Processor to perform the processing described in this DPA. The Controller is responsible for ensuring that any required notices have been provided to, and any necessary consents obtained from, data subjects for the processing of their Personal Data by the Processor as described herein. Where the Controller uses the Services to monitor or evaluate its own personnel (for example, support agents), the Controller is responsible for establishing a lawful basis for that processing, informing the personnel concerned, and completing any consultation, negotiation or approval required by employment law or collective agreements (including with works councils or trade unions) before such processing begins. If the Controller cannot lawfully use agent-level monitoring, the parties may agree in an Order Form to disable the agent-monitoring features for the Controller’s account.
2. Details of Processing
2.1 The Parties acknowledge and agree that the processing of Personal Data by the Processor under this DPA shall cover the following aspects, in accordance with Article 28(3) of the GDPR and the UK GDPR:
2.2 Subject-Matter: The Processor’s provision of the Isara customer support conversation analytics and monitoring Services to the Controller, as described in and governed by the applicable Terms of Service.
2.3 Duration of Processing: Personal Data will be processed by the Processor only for as long as necessary to fulfill the purposes of the Services. By default, the Processor will not retain any Personal Data obtained through the Services for more than 60 days from the date of its collection or generation, unless otherwise expressly instructed by the Controller or required by law. The Controller may issue instructions at any time for deletion or return of Personal Data (including prior to termination of the Services), and the Processor will promptly comply with such instructions.
2.4 Nature and Purpose of Processing: The Processor will retrieve and analyze customer support communications and related data on behalf of the Controller in order to provide the functionalities of the Isara Service. This includes collecting support ticket and conversation data from the Controller’s integrated helpdesk platforms (such as Zendesk, Intercom, HubSpot, Salesforce, or similar systems), and performing automated processing — including natural language processing and large language model inference — on the text of those communications to generate useful insights for the Controller. Such insights include, for example, sentiment or frustration indicators, conversation summaries, suggested tags or categorizations, and recommended actions or training opportunities for support agents. All processing is carried out for the purpose of helping the Controller monitor and improve its customer support services and customer satisfaction and, as instructed in clause 7A, to create Anonymised Data. The Processor will not process Personal Data for any other purpose. The Processor uses pre-trained machine learning models (large language models accessed through the sub-processors listed in Annex 1, under terms that bar the provider from using the data to train or improve its models) to analyze the data. The Processor will not use the Controller’s Personal Data, including prompts built from it and outputs generated from it, to train, fine-tune or improve any AI model. Anonymised Data may be used only as set out in clause 7A.
2.5 Type of Personal Data: The Personal Data processed via the Services includes information contained in or related to customer support interactions. Depending on how the Controller uses the Isara Service, the data may include: identification and contact information of individuals (such as names, email addresses, phone numbers, or user IDs of the Controller’s customers and support agents); the content of support communications (for example, the text of emails, chats, or ticket messages between the Controller’s customers and support staff, which may contain personal information provided by those parties); metadata and identifiers associated with support conversations (such as ticket numbers or conversation IDs, timestamps, and any internal references which, if directly linked to individuals, are treated as personal data); and any additional personal data that the Controller chooses to import or provide for analysis through the Service (for instance, personal data that might be contained in customer documentation or knowledge base articles the Controller integrates with Isara for context). The Processor will treat any personal data within the Controller’s uploaded documentation or knowledge base as Personal Data under this DPA and will process it only for the Controller’s purposes as instructed. Depending on the Controller’s configuration, the Services may also generate inferences about individuals’ health or vulnerability, such as indicators of gambling-related harm, addiction, or emotional or mental distress. Such inferences may be special category data under Article 9 of the GDPR and UK GDPR, and are subject to clause 2.7.
2.6 Categories of Data Subjects: The categories of data subjects include the individuals who interact via the support communications processed by the Service. This typically encompasses the Controller’s end-users or customers who initiate support requests or are the subject of support tickets, and the Controller’s support agents or employees who correspond with those customers through the helpdesk platform. Accordingly, both the Controller’s customers and its support personnel (and any other individuals whose personal data is contained in the support exchanges or related documentation) are data subjects under this DPA.
2.7 Special Category Data: The Controller is responsible for identifying a valid condition under Article 9 of the GDPR and UK GDPR (and, where applicable, Schedule 1 of the Data Protection Act 2018) before instructing the Processor to generate or process special category data, for any data protection impact assessment required, and for any appropriate policy document required for that processing. The Processor will: (a) process such data only to provide those insights to the Controller; (b) restrict access to it to personnel who need it to operate the Services; (c) never include it in Anonymised Data used for benchmarks; and (d) on the Controller’s written request, disable vulnerability and health-related detection for its account. The Services do not provide any function to select, filter or list individuals on the basis of special category data, consistent with restrictions such as chapter 17 section 10 of the Swedish Gambling Act (2018:1138).
3. Processing on Documented Instructions Only
The Processor, including any person acting under the Processor’s authority who has access to Personal Data, shall process the Personal Data only on documented instructions from the Controller (as set forth in this DPA and Terms of Service (TOS) or as subsequently provided in writing) and solely for the purpose of performing the Services for the Controller. The Processor shall not process the Personal Data for any other purpose or in any other manner unless required to do so by applicable law (in which case Processor will inform the Controller of that legal requirement prior to processing, unless the law prohibits such notice). For the avoidance of doubt, any data, analytics, tags, summaries or other insights generated by the Processor from the Controller’s Personal Data are considered part of the Controller’s Personal Data and shall be used and disclosed by the Processor only as directed by the Controller and for the purposes of providing the Services. The Processor will not disclose Personal Data, or any analytics, tags, summaries or other insights derived from it, to any other client of the Processor.
4. Confidentiality and Personnel
The Processor warrants that it has appointed employees or authorized contractors to process Personal Data strictly on a need-to-know basis and only to the extent necessary for the provision of the Services, in accordance with this DPA and the TOS. The Processor shall ensure that all such persons authorized to process Personal Data are under appropriate contractual or statutory confidentiality obligations. They must be bound to keep the Personal Data (and any other confidential information of the Controller they may encounter) confidential and are required to undergo training on data protection and privacy principles relevant to their duties.
5. Security Measures
5.1 The Processor shall implement and maintain all appropriate technical and organizational security measures required by Article 32 of the GDPR and UK GDPR (and equivalent provisions of other applicable data protection laws) to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. Such measures include, among others, access controls, encryption of data in transit and at rest, and pseudonymization or anonymization of Personal Data where appropriate.
5.2 In the event of a personal data breach (security incident) affecting Personal Data processed by the Processor on behalf of the Controller, the Processor will notify the Controller without undue delay, and in any event within 48 hours of becoming aware of it. The notice will describe, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. The Processor will provide further information as it becomes available, and will take all necessary and appropriate corrective actions to mitigate the breach. The Processor will further cooperate with the Controller in investigating the breach and fulfilling any obligations to notify affected individuals or supervisory authorities, as required by law.
5.3 On request, the Processor will provide its current security documentation, including any third-party certifications or audit reports it holds and a description of its technical and organisational measures.
6. Assistance to Controller
The Processor shall assist the Controller in ensuring compliance with the Controller’s obligations under applicable data protection laws, taking into account the nature of the processing and the information available to the Processor. This includes reasonably assisting with: (a) responses to data subjects’ requests to exercise their rights (such as access, rectification, erasure, restriction, objection, or data portability requests) with respect to Personal Data processed by the Processor; (b) the Controller’s obligation to implement appropriate security measures and to notify personal data breaches to supervisory authorities and/or data subjects; (c) where necessary, conducting data protection impact assessments (DPIAs) and consulting with supervisory authorities in relation to processing performed by the Processor; and (d) handling any inquiries or complaints received from public authorities (such as a Data Protection Authority) regarding the processing of Personal Data under this DPA.
7. Return or Deletion of Data
Upon termination of the Services, upon fulfillment of all processing purposes, or at any time upon the Controller’s request, the Processor will return to the Controller (or a third party designated by the Controller) all Personal Data, and delete or securely destroy all copies of Personal Data in its systems and files, unless applicable law requires the Processor to retain certain data. Upon termination of the Services, including the expiration of any subscription or free trial, Personal Data will be automatically deleted within sixty (60) days unless the Controller requests its return or deletion. In no case will the Processor retain Personal Data longer than necessary for the purposes of processing, except to the extent that applicable law obligates the Processor to retain copies for a longer period (for example, to comply with tax, accounting, or archiving laws). If such legal retention requirements apply, the Processor will continue to protect the confidentiality of the Personal Data and will not actively process it for any other purpose.
7A. Anonymised Data
The Controller instructs the Processor to create Anonymised Data from Personal Data processed under this DPA. The Processor may use Anonymised Data only to: (a) develop, train, improve and maintain its models, algorithms and service features; and (b) produce aggregated statistics and benchmarks combining data from at least five controllers, which the Processor may publish. “Anonymised Data” means data irreversibly anonymised in accordance with Data Protection Laws and recognised industry practice, so that no natural person, and not the Controller, can be identified directly or indirectly. Removing direct identifiers alone does not produce Anonymised Data. The Processor will not sell Anonymised Data and will apply technical measures, including testing, designed to prevent any model trained on Anonymised Data from reproducing text or other content from Personal Data.
8. Audits
The Processor shall make available to the Controller all information necessary to demonstrate the Processor’s compliance with its obligations under this DPA and applicable data protection laws. Upon reasonable request, the Processor will provide documentation or certificates describing the security measures and relevant internal practices. In the event that such documentation is not sufficient for the Controller to verify Processor’s compliance, the Controller is entitled to audit the Processor’s processing of Personal Data. The Controller (or its mandated auditor, provided any external auditor is bound by appropriate confidentiality obligations) may conduct an on-site inspection of the Processor’s relevant facilities and systems, solely to the extent necessary to evaluate such compliance. Any audit must be conducted with reasonable prior notice (at least 30 business days) to the Processor, during normal business hours, and in a manner that does not unreasonably interfere with the Processor’s operations. The Parties shall mutually agree on the scope and timing of the audit and shall cooperate in good faith to minimize disruption and expense.
9. Sub-processors
9.1 The Controller gives general authorisation for the Processor to engage the sub-processors listed in Annex 1, as published at www.isara.ai/sub-processors and updated in accordance with this clause 9. The Processor will give the Controller at least 30 days’ notice of any intended addition or replacement of a sub-processor. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the affected Services and receive a refund of prepaid fees for the remainder of the term.
9.2 Whenever the Processor engages a sub-processor to process Personal Data, the Processor shall do so via a written contract that imposes on the sub-processor the same level of data protection obligations as those imposed on the Processor under this DPA. The Processor remains fully liable to the Controller for the sub-processor’s performance of its obligations.
International Data Transfers
The Processor stores and processes Personal Data in the region assigned to the Controller’s account: the United States for Controllers based in the United States, and the UK or EEA for Controllers based in the UK or EEA. The Processor will not transfer Personal Data outside that region except as set out below. If at any time the Processor or any sub-processor intends to transfer or access Personal Data from a country outside of the EEA or UK that is not recognized as providing adequate protection, the Processor shall ensure that a valid transfer mechanism is in place to lawfully facilitate that transfer in compliance with GDPR Chapter V and UK GDPR Chapter V. Such mechanisms may include, as applicable, the execution of the European Commission’s Standard Contractual Clauses (SCCs) or other transfer tools approved by the EU (or the UK International Data Transfer Agreement/Addendum, for UK transfers), or reliance on an applicable derogation under Article 49 GDPR if appropriate.
10. US State Privacy Law Terms
The following terms apply to the Processor’s handling of Personal Data when and to the extent such data is subject to U.S. State privacy laws (such as the California Consumer Privacy Act (CCPA) as amended by the CPRA, the Virginia Consumer Data Protection Act (VCDPA), and other similar state privacy laws – collectively, “US State Privacy Laws”):
Service Provider/Processor Status: With respect to any Personal Data subject to US State Privacy Laws that the Processor processes on behalf of the Controller via the Isara Service, the Processor agrees that it is acting as a “service provider” or “processor” (as those terms are defined in applicable law) for the Controller. The Processor will process such Personal Data in compliance with all applicable requirements of the US State Privacy Laws and solely for the limited and specified purposes set forth in this DPA and the TOS, and in accordance with the Controller’s instructions. The Processor certifies that it understands the restrictions of this DPA and will comply with them.
No Selling or Additional Use: The Processor shall not: (a) retain, use, disclose, or otherwise process Personal Data subject to US State Privacy Laws for any purpose other than the specific purposes of performing the Services for the Controller as described in this DPA or as otherwise permitted by US State Privacy Laws; (b) “sell” or “share” such Personal Data (as those terms are defined in applicable US State Privacy Laws) to or with any third party; or (c) retain, use, disclose, or otherwise process such Personal Data outside of the direct business relationship between the Processor and the Controller. In particular, the Processor will not combine such Personal Data with personal information it receives from other clients or from its own interactions, except as permitted under relevant US State Privacy Laws. The Processor acknowledges that it is prohibited from using Personal Data for cross-context behavioral advertising or profiling in furtherance of decisions about natural persons to the extent such use is restricted by law.
Notification of Inability to Comply: The Processor shall notify the Controller without undue delay if the Processor determines that it can no longer meet its obligations under this Section (the US State Privacy Law Terms) or under any US State Privacy Laws. Upon such notice, or if the Controller otherwise reasonably believes that the Processor cannot carry out its obligations in accordance with applicable law, the Controller may direct the Processor to cease processing the affected data and take appropriate steps to remediate and address any unauthorized processing. The Parties will work together in good faith to reasonably resolve the issue; if compliance cannot be achieved, the Controller may terminate the portion of Services involving the affected Personal Data, notwithstanding any contrary term in the TOS.
Deidentified Data: To the extent the Controller provides de-identified data to the Processor, or the Processor derives deidentified data from Personal Data (as “deidentified” is defined in US State Privacy Laws), the Processor shall (a) implement technical and organizational measures to ensure that the deidentified data cannot be associated with or re-identified to any individual or household; (b) commit to maintain and use such data only in a de-identified form and not to attempt to re-identify the data, except as needed to test and improve the Processor’s de-identification techniques in compliance with US State Privacy Laws; and (c) contractually obligate any recipient of deidentified data (including any sub-processor or contractor) to comply with the requirements of this section. The Processor will not disclose deidentified data to any third party, except aggregated benchmarks published under clause 7A or disclosures to sub-processors bound by equivalent obligations.
11. Precedence and Governing Law
If this DPA conflicts with the Terms of Service or any Order Form, this DPA prevails in relation to the processing of Personal Data. This DPA is governed by the laws of England and Wales, except that any Standard Contractual Clauses incorporated into it are governed by the law they specify.
Annex 1: Sub-processors
The current list of sub-processors, with the services they provide and where they process Personal Data, is published at www.isara.ai/sub-processors.