Processor terms for customer communication data handled through Handlet
Effective date:
Last updated:
Handlet Data Processing Addendum
This Data Processing Addendum ("DPA") applies where HANDLET LIMITED ("Handlet", "we", "us") processes personal data on behalf of a business customer through the Handlet service.
This DPA forms part of the Terms of Service. It is intended to meet UK GDPR Article 28 and, where the EU GDPR applies to the same processing, EU GDPR Article 28 controller-to-processor contract requirements. References to "GDPR" in this DPA mean the UK GDPR and, where applicable, the EU GDPR.
If this DPA conflicts with the Terms on the protection or processing of customer personal data, this DPA takes priority. Defined terms have the meanings given in UK data protection law (and, where the EU GDPR applies, the corresponding EU GDPR terms) unless the context requires otherwise.
Handlet currently offers the service to businesses established in the UK.
1. Roles
For account, billing, security, support, and platform administration data, Handlet is usually a controller.
For customer communication data that a business customer brings into Handlet, the business customer is usually the controller and Handlet is the processor. This may include message content, customer contact details, connected-channel metadata, job or quote details, review content, call transcripts, call recordings, call summaries, call outcomes, and call metadata.
Handlet is also the processor for records the customer instructs Handlet to hold in its workspace about the customer's own business, including: durable copies of job records from a business system the customer connects; job records asserted by the customer's own users; payments the customer's end customers made against a job or quote; and acquisition data describing how an enquiry reached the customer's business (see § 4a).
AI Assistance: Handlet uses AI for intent recognition and, where enabled, drafts, summaries, quote support, social content and call assistance. AI output can be wrong and should be checked before use. Learn More
Where the customer connects a third-party platform using the customer's own account, for example a CRM, Google Ads, Google Search Console, or Google Analytics, that platform is not a Handlet subprocessor. Its relationship is with the customer, under its own terms, and Handlet accesses it on the customer's instruction.
The business customer is responsible for ensuring that it has a lawful basis for processing its customers' personal data and for providing any required privacy notices, AI voice-assistant notices, call-recording notices, marketing notices, and opt-out mechanisms.
2. Processing Details
Item
Details
Subject matter
Providing the Handlet platform and related support, security, automation, AI-assistance, messaging, and call-agent features.
Duration
The term of the customer's Handlet account plus any retention period described in the Terms, Privacy Policy, retention tables, or required by law.
Nature of processing
Collection, ingestion, storage, hosting, retrieval, display, organisation, classification, summarisation, drafting, sending or preparing communications, transcription, recording storage, analysis, deletion, and support access where required.
Purpose
To provide Handlet features requested or configured by the customer, create insights for that customer's own workspace, keep the service secure and reliable, support the customer, and meet legal or compliance obligations.
Data subjects
Customer's customers, leads, contacts, callers, staff, contractors, account users, and other people who communicate with the customer's business.
Personal data categories
Names, contact details, message content, attachments, message metadata, job or quote information, review content, call audio, call transcripts, call metadata, call outcomes, technical identifiers, audit data, and support records. Also: job and service history records (status, dates, service type, value, free-text notes, and provenance) including durable copies of records from a connected business system; end-customer payment records (amount, date, method, reference, notes); and acquisition data (advertising click identifiers, campaign and creative identifiers, UTM parameters, landing and referrer hosts, consent state, and attribution lifecycle fields).
Special category or criminal offence data
Not intentionally requested by Handlet. If it appears in connected communications, Handlet processes it only as needed to provide the service and under the customer's instructions.
3. Customer Instructions
Handlet will process customer communication data only on documented instructions from the customer. Those instructions include:
this DPA;
the Terms of Service;
the customer's use of product settings and connected integrations;
support requests submitted by the customer; and
any written instructions agreed between Handlet and the customer.
Handlet will tell the customer if, in our opinion, an instruction infringes applicable data protection law, unless the law prevents us from doing so.
Handlet may create operational statistics and account-bounded derived outputs where needed to provide the service under the customer's instructions.
Handlet will not use identifiable customer communication data for its own cross-customer model improvement, external benchmarking, partner insight products, or another independently determined purpose unless the customer has explicitly authorised that separate processing. Where Handlet independently determines the purpose and means of processing personal data, Handlet acts as controller for that processing and will identify an applicable lawful basis and provide the transparency required by data protection law.
Creating anonymised information from customer personal data for a separate Handlet purpose is itself processing. Handlet will therefore not use processor data to create cross-customer benchmarks, external examples, partner products, or cross-customer model improvements unless that source processing is covered by the customer's separate, explicit instruction or authorisation. Once information has lawfully been rendered irreversibly anonymous, it is no longer personal data. Pseudonymised data remains personal data and is not treated as anonymous.
4. Confidentiality
Handlet will ensure that people authorised to process personal data are subject to appropriate confidentiality obligations.
4a. Connected Business Systems and Acquisition Platforms
This section applies where the customer connects a third-party system or platform to Handlet using the customer's own account or credentials.
4a.1 Instruction to keep durable copies
By connecting a business system such as a CRM or job-management system, and by using the features that depend on it, the customer instructs Handlet to keep a durable copy of the records Handlet supports from that system inside the customer's workspace, so that history, reporting, and assistant features remain available independently of the third party's availability and retention.
Handlet will:
retain each copy under the retention rules published in the Privacy Policy and the customer's deletion controls, and not under the source system's retention rules;
label each record with the system it came from, its identifier in that system, and whether the record was copied from a connected system or asserted by one of the customer's own users;
delete copies when the workspace is deleted, when the linked end-customer profile is deleted, or on the customer's deletion request under § 9; and
use records copied from a connected system only to provide and improve features within the originating workspace.
Handlet will not:
treat deletion or amendment of a record in the source system as an automatic instruction to delete or amend Handlet's copy, the customer must use Handlet's controls or the deletion process in § 9;
present a copied record as if the customer had confirmed it, or a customer-asserted record as if it came from the connected system; or
write Handlet-derived revenue attribution or commercial intelligence back into a connected CRM or advertising platform.
4a.2 Acquisition and advertising measurement
Where the customer enables lead-source measurement or connects an advertising, search, or analytics platform, Handlet processes acquisition data as the customer's processor. This includes advertising click identifiers, campaign and creative identifiers, UTM parameters, landing and referrer hosts, the consent state supplied with the enquiry, and attribution lifecycle fields.
The customer is the controller for measurement carried out on the customer's own website and in the customer's own platform accounts. The customer is responsible for:
obtaining and recording valid consent before information is stored on, or read from, a visitor's device on the customer's website, including under the Privacy and Electronic Communications Regulations and any consent requirements the platform imposes for UK, EEA, and Swiss end users;
the notice it gives visitors and end customers; and
complying with the terms and API terms of each platform it connects.
Handlet records the consent state supplied with each captured enquiry and does not obtain consent on the customer's behalf. Where the consent state is unknown, Handlet does not retain advertising click identifiers or free-text utm_term / utm_content values for that enquiry until a resolved consent state (granted or not_required) is supplied. Handlet never treats unknown as consent.
Handlet restricts advertising click identifiers (gclid, gbraid, wbraid, fbclid), the free-text UTM values (utm_term, utm_content), and landing-handoff tokens to its privileged service role; ordinary workspace users have no read access to those fields and see attribution outcomes and campaign labels instead. Handlet retains those identifiers only until the attribution lookback window expires or erasure is requested, whichever is first. A scheduled lookback drain and account-deletion / rights-flow callers enforce that erasure path.
4a.3 Google Ads API and Google API data
Where the customer connects Google Ads, Google Search Console, or Google Analytics, the following apply.
Limited Use. Handlet's use and transfer of information received from Google APIs, and of any data aggregated, anonymised, or derived from it, adheres to the Google API Services User Data Policy, including the Limited Use requirements. Such data is used only to provide or improve user-facing Handlet features in the workspace that granted access. It is not transferred to advertising platforms, data brokers, or information resellers; not used for serving, retargeting, or personalising advertising; not used to develop, train, or improve generalised artificial-intelligence or machine-learning models; and not included in any cross-customer benchmark, insight product, or external example. Handlet does not transfer Google API data between workspaces.
Data protection confirmation for Google Ads API use. The Google Ads API Terms and Conditions require the API client and the advertiser to confirm their data-protection positions in respect of personal data processed under the API. For processing carried out through Handlet's current production scope (reading, storing, analysing and combining advertising and customer data to provide advertising analytics, attribution, reporting, insights, intelligence and recommendations), the parties record that the customer acts as controller for its own Google Ads account data and advertising data, and Handlet acts as the customer's processor under this DPA. Google's relationship with the advertiser remains governed separately by Google's applicable terms. Handlet may make sophisticated technical and analytical decisions about how it processes data, but the customer determines the business purpose: running and improving the customer's advertising and business performance. This characterisation reflects Handlet's current product scope as recorded by management. Future features that would enable customers to instruct Handlet to optimise or execute paid-media actions (spend, bids, channels) based on CAC, ROAS, or CLTV would require separate review before enablement and may require an updated characterisation in this section.
No personally identifying uploads. Handlet does not send hashed emails, phone numbers, names, or addresses to advertising platforms, and does not use customer-matching or enhanced-conversion features. Offline conversion uploads to the customer's own Google Ads account contain only a click identifier, conversion action, timestamp, time zone, order reference, value, and currency.
Observed data only in platform write paths. Handlet does not write inferred, repaired, or modelled attribution states into an advertising or analytics platform.
No re-identification. Handlet does not attempt to re-identify search queries that Google has withheld or anonymised at source, and does not join advertising click identifiers into any cross-site identity graph.
4a.4 Adding a platform or a write path
Handlet will update its Subprocessors register and give the notice required by § 6 before adding a new connected advertising, search, or analytics platform, or before adding a write path to such a platform, for example a tracking pixel, conversions API call, audience upload, or measurement-protocol event.
5. Security
Handlet will use appropriate technical and organisational measures designed to protect personal data, taking into account the nature of the data, the risks of processing, the state of the art, implementation costs, and the service context.
These measures may include access controls, tenant-scoped permissions, encryption in transit, secure hosting, operational logging, audit records, role-based access, monitoring, and incident-response procedures.
6. Subprocessors
The customer gives Handlet general authorisation to use subprocessors needed to provide and support the service.
Handlet maintains a current list of active subprocessors at Handlet Subprocessors. Under the customer's general written authorisation, Handlet will give customers at least 30 days' prior written notice before an intended addition or replacement of a subprocessor that will process customer communication data, unless an urgent security, legal, or service-continuity issue makes that period impracticable. In an urgent case, Handlet will give notice as soon as reasonably possible.
During the notice period, the customer may object on reasonable data-protection grounds by contacting [email protected]. Handlet will work in good faith to address the objection, including by considering a commercially reasonable configuration change or alternative. If the parties cannot resolve the objection, the customer may terminate the affected service before the new subprocessor begins processing that customer's data.
Handlet will impose data protection obligations on each subprocessor that give materially equivalent protection for the relevant processing. Handlet remains responsible to the customer for the performance of its subprocessors' processor obligations.
7. Assistance
Taking into account the nature of the processing and information available to Handlet, we will provide reasonable assistance with:
data subject access, correction, deletion, objection, restriction, portability, and related requests;
security obligations under UK GDPR Article 32;
personal data breach obligations under UK GDPR Articles 33 and 34;
data protection impact assessments under UK GDPR Article 35; and
prior consultation with a supervisory authority under UK GDPR Article 36, where applicable.
The customer remains responsible for deciding how to respond to requests from its own customers unless Handlet is independently required by law to respond.
8. Personal Data Breaches
Handlet will notify the customer without undue delay after becoming aware of a personal data breach affecting customer communication data processed by Handlet as processor.
The notice will include information reasonably available to Handlet to help the customer meet its own breach-assessment and notification obligations.
Where reasonably available, the notice will describe the nature of the breach, affected data and data subjects, likely consequences, containment or remediation measures, and a contact for follow-up. Information may be supplied in phases where it is not all available at the same time.
9. Deletion and Return
At the customer's choice, Handlet will delete or return customer communication data after the end of the relevant services and delete existing copies, unless UK law requires Handlet to retain specified data. The customer should communicate its choice before termination or within 30 days afterwards. If no choice is received, Handlet may delete the data in accordance with its documented retention process.
Deletion from backups may follow documented technical backup cycles. Until overwritten or deleted, backup copies will remain protected, isolated from ordinary use, and processed only where needed for restoration, security, or compliance with law. Handlet may retain limited records that it processes as controller where required for tax, security, complaint handling, legal claims, or regulatory accountability. Primary-store deletion or redaction of customer communication data is immediate in Handlet's database; copies may remain recoverable from infrastructure backups (including Supabase point-in-time recovery and daily backups) until those backup windows expire, as recorded in Handlet's operational retention schedule.
Durable copies from connected systems. Deleting or amending a record in a connected business system is not by itself an instruction to Handlet. Handlet deletes its copy when the workspace is deleted, when the linked end-customer profile is deleted, or on the customer's deletion request under this section. Disconnecting the connected system removes Handlet's access and its stored credentials but does not delete records already copied into the workspace.
Acquisition data. Advertising click identifiers, free-text UTM values, and landing paths are erased when the enquiry's attribution lookback window expires or on erasure request, whichever is first; the touchpoint is then marked as erased. Non-identifying campaign and creative labels and platform performance metrics are purged on platform disconnect or workspace deletion. Search Console and Google Analytics caches are short-lived and are deleted when the connection is removed. Platform connection credentials are deleted immediately on revocation or removal.
The current retention criteria for processor data are set out in the Privacy Policy and How we process personal data. Where call-agent recording is enabled, call recording audio defaults to 90 days unless the workspace configures another valid period, keeps a specific recording, or disables recording. Call transcript text, summaries, outcomes, and related call metadata default to 24 months (730 days) unless the workspace configures another valid period or keeps a specific transcript; after that period Handlet automatically redacts transcript text and related call insights from primary storage. Recording audio and transcript text follow separate retention windows. Voice and telephony subprocessors (including Vapi) may retain provider-side recordings or transcripts under their own retention unless manually erased through Handlet's documented erasure paths.
10. Audits and Compliance Information
Handlet will make all information reasonably necessary to demonstrate compliance with UK GDPR Article 28 available to the customer. This may include summaries of security measures, subprocessor information, relevant audit records, policies, or written responses to reasonable security and privacy questions.
Handlet will allow for and contribute to audits, including inspections, conducted by the customer or an independent auditor mandated by the customer. Audits must be reasonable, proportionate, subject to appropriate confidentiality and security controls, and designed to avoid unnecessary disruption or access to another customer's data. Unless a personal data breach or substantiated compliance concern justifies otherwise, the parties will ordinarily use current third-party reports and written evidence before requiring an on-site inspection.
11. International Transfers
Where processing involves international transfers, Handlet will use appropriate transfer safeguards such as adequacy decisions, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, Standard Contractual Clauses where appropriate, or another lawful transfer mechanism.
Handlet will conduct or obtain an appropriate transfer-risk assessment where required and will implement supplementary measures where reasonably necessary. The customer authorises transfers required to provide enabled features subject to these safeguards and the current subprocessor register. Handlet does not promise that all processing will remain in the UK unless a signed order form expressly provides otherwise.
12. Benchmarking
Handlet does not sell customer communication data, messages, call recordings or transcripts, customer contact details, CRM records, identifiable business or end-customer profiles, or pseudonymised datasets presented as anonymous data.
Cross-customer benchmarking and learning are off by default. Handlet will only use the customer's data for them if the customer opts in through its workspace settings, as described in section 3.6 of the Privacy Policy. The customer can withdraw at any time. Data from Google APIs and records copied from a connected CRM are excluded even if the customer opts in.
13. Customer Responsibilities
The customer is responsible for:
having a lawful basis for processing personal data it brings into Handlet;
giving required privacy notices to its customers, callers, staff, and contacts;
complying with electronic marketing, AI voice-assistant disclosure, call-recording, telecoms, and sector-specific rules that apply to its business;
giving any required notice that communications may be analysed to provide insights for its own workspace and, if it opts in, for cross-customer benchmarking;
ensuring connected channels and Auto-Send settings are configured lawfully;
complying with the terms and API terms of each business system or acquisition platform it connects, including restrictions on storing, deriving from, exporting, and displaying that platform's data;
telling its own customers that records about them may be copied from a connected system into Handlet and retained under Handlet's retention rules;
obtaining and recording valid consent before advertising or analytics identifiers are set on, or read from, a visitor's device on its own website, and giving visitors the required notice;
keeping account access limited to authorised users; and
avoiding unnecessary special category or criminal offence data, including in free-text job notes and payment notes.
The processing details in section 2, the customer's enabled product settings and integrations, support requests, and written instructions accepted by Handlet form the documented processing instructions. Processing is continuous or as initiated by the customer during the service term. The frequency depends on feature use and connected-channel activity.
Connecting a business system or acquisition platform, and using the features that depend on it, is a documented instruction to carry out the processing described in section 4a, including keeping durable copies of the supported records from that system in the customer's workspace.
Schedule 2: Technical and Organisational Measures
Handlet's measures include, as appropriate to the service and risk:
logical tenant isolation using account-scoped database controls and row-level security;
role-based access, least-privilege administration, and protected support access;
encryption in transit using HTTPS/TLS and provider-managed encryption at rest;
authentication controls, secure credential storage, and multi-factor authentication for privileged administration where configured;
audit logging and restricted access to compliance and security records;
data minimisation, including minimising or redacting personal data on Handlet's own infrastructure before certain AI processing;
secure development review, dependency maintenance, testing, and controlled deployment;
monitoring, incident response, backup, restoration, and continuity measures provided by Handlet and its infrastructure providers;
retention and deletion controls, including workspace deletion workflows and configurable call-recording retention; and
confidentiality obligations for authorised personnel, and subprocessor obligations as set out in § 6.
These measures may evolve to address changes in risk, technology, and the service, provided the overall level of protection is not materially reduced.
Schedule 3: Liability and General Terms
Liability arising under this DPA is subject to the liability provisions in the Terms unless mandatory data protection law requires otherwise. Nothing in this DPA limits a data subject's rights or a supervisory authority's powers.
Schedule 4: Subprocessors
Authorised subprocessors are those listed at Handlet Subprocessors, as updated under § 6. The customer’s general written authorisation covers those subprocessors and any replacement notified under § 6. The customer may ask [email protected] for more information about any subprocessor.
Schedule 5: AI and model subprocessors
Where the customer enables AI-assisted features (drafting, classification, summarisation, voice assistant / Call Agent, or similar):
Handlet may use the AI, voice and telephony providers listed on our Subprocessors page.
Those providers process prompts, message excerpts, transcripts, call audio or summaries as Handlet’s subprocessors for the customer’s data, subject to § 6 of this DPA.
Handlet will not use identifiable customer communication data to train generalised models for Handlet’s own cross-customer products unless the customer gives a separate explicit instruction.
Significant automated or AI-supported decisions that Handlet records for accountability (model or rule identifier, input category, outcome, human override, timestamp, account) are available to the customer on request and, where product surfaces disclose automated decision-making, in-product.
Schedule 6: International transfers
Transfers outside the UK (and, where EU GDPR applies, outside the EEA) must be covered by one of the following:
UK adequacy regulations or EU adequacy decisions, where available;
the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses;
EU Standard Contractual Clauses (where EU GDPR applies); or
another lawful transfer mechanism.
The customer authorises transfers needed to operate enabled features, subject to § 11. Handlet does not promise that all processing stays in the UK unless a signed order form says so.
Schedule 7: Breach, audit, and deletion (summary)
Topic
DPA section
Customer expectation
Personal data breach
§ 8
Notice without undue delay with available facts
Audits / compliance information
§ 10
Written evidence first; proportionate inspections
Deletion / return
§ 9
Delete or return after end of services; backup windows apply
Assistance with data-subject rights
§ 7
Reasonable assistance; customer decides response to its end customers
Appendix A, Source references (non-contractual)
These links support diligence; they are not additional customer terms: