Data Processing Agreement

Effective Date: 25 October 2026

1. Parties

This Data Processing Agreement forms part of the service agreement between:

Controller: The business Customer identified in the applicable Ota AI agreement.

Processor: Africa Giant Limited, trading as Ota AI, company number 12330281.

This Agreement applies where Ota AI processes personal data on the Customer's behalf.

2. Scope and Duration

Processing concerns the provision of AI receptionist services during the Customer's service relationship and any applicable return or deletion period.

3. Processing Activities

Processing may include:

• Receiving and handling telephone calls.
• Transcribing conversations where enabled.
• Collecting caller contact and enquiry information.
• Generating AI responses and summaries.
• Storing and displaying records in authorised dashboards.
• Transmitting information to authorised integrations.
• Deleting or returning information under agreed instructions.

4. Data Subjects

Individuals may include:

• Existing and prospective customers of the Controller.
• Business callers.
• Employees and representatives.
• Other individuals who contact the Controller.

5. Personal Data Categories

Data may include names, telephone numbers, email addresses, enquiries, appointment information, recordings, transcripts and other information supplied during calls.

Special-category data should not be intentionally collected unless appropriate legal conditions and safeguards are established.

6. Controller Responsibilities

The Controller must:

1. Establish lawful grounds for processing.
2. Provide appropriate privacy and recording notices.
3. Ensure instructions are lawful.
4. Determine suitable retention periods.
5. Respond to data-subject rights requests.
6. Conduct any required data protection impact assessments.
7. Meet applicable telecommunications and sector-specific obligations.

7. Processor Responsibilities

Africa Giant Limited shall:

1. Process personal data only on documented Controller instructions, unless required otherwise by applicable law.
2. Ensure authorised personnel are subject to confidentiality obligations.
3. Implement appropriate technical and organisational security measures.
4. Assist with data-subject rights requests.
5. Assist with security incidents, impact assessments and relevant regulatory consultations.
6. Make available information reasonably necessary to demonstrate compliance.
7. Permit and contribute to appropriate audits and inspections.
8. Notify the Controller if an instruction appears to infringe applicable data protection law.
9. Delete or return personal data at the end of services, at the Controller's choice, unless retention is legally required.

8. Security Measures

Appropriate security measures shall be selected according to processing risks.

They may include:

• Role-based access controls.
• Authentication.
• Tenant separation.
• Encryption in transit.
• Appropriate protection of stored data.
• Restricted administrative access.
• Security logging and monitoring.
• Backup and recovery measures.
• Secure software development.
• Access restrictions for call recordings and transcripts.

The actual production measures must be documented and verified.

9. Subprocessors

The Controller grants general authorisation for the Processor to engage subprocessors required to provide the contracted service.

The Processor shall maintain a current subprocessor list and inform the Controller of intended additions or replacements, allowing an opportunity to object on reasonable data protection grounds.

Subprocessors shall be bound by appropriate data protection obligations.

The Processor remains responsible for subprocessor performance as required by applicable law.

10. International Transfers

Restricted transfers outside the UK shall use an applicable lawful transfer mechanism, together with any required additional safeguards.

11. Personal Data Breaches

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting data processed on the Controller's behalf.

The Processor shall provide reasonably available information concerning the incident, its likely consequences and remedial measures.

The Processor shall provide reasonable assistance with applicable breach notification obligations.

12. Data Subject Requests

The Processor shall assist the Controller, taking account of the nature of processing and information available, in responding to applicable data-subject requests.

The Processor shall not independently make substantive decisions on Controller-data requests unless authorised or legally required.

13. Return and Deletion

At the end of the service relationship, the Processor shall, at the Controller's choice, delete or return personal data unless applicable law requires retention.

The agreed retention schedule shall address active records, recordings, transcripts and backup copies.

14. Audits

The Processor shall make available information reasonably necessary to demonstrate compliance with this Agreement.

Audit arrangements shall protect confidentiality, security and other customers' information.

15. Liability

Liability is governed by applicable law and the service agreement, except where limitation is unlawful.

Nothing in this Agreement restricts the statutory rights of individuals or the powers of competent supervisory authorities.

16. Governing Law

This Agreement is governed by the laws of England and Wales, subject to applicable data protection law.

17. Contact and Identification

Africa Giant Limited trading as Ota AI
Company number: 12330281
Registered in England and Wales
Email: support@otaai.co.uk
Website: https://otaai.co.uk

This Agreement applies when incorporated into an accepted Ota AI service agreement or otherwise agreed between the parties.