Data processing agreement
This data processing agreement (“DPA”) forms part of the terms of service between ZII Ltd (“processor”, “we”) and the business using Oscar (“controller”, “you”). It applies whenever we process personal data on your behalf. It is written to meet Article 28 of the UK GDPR and EU GDPR, and the service-provider requirements of US state privacy laws such as the CCPA.
1. What we process
| Subject matter | Answering, recording, transcribing and summarising calls to your business; texting callers; booking; alerting your team. |
|---|---|
| People | Your callers and customers; your staff and team members. |
| Data | Names, phone numbers, addresses, call recordings and transcripts, the details callers give, booking details, and team contact details. You must not set Oscar up to collect special category data or health records. |
| Duration | For the term of the agreement, then deletion as set out in section 8. |
2. Your instructions
We process personal data only on your documented instructions: these terms, your published setup and your settings in Oscar. If we believe an instruction breaks data protection law, we’ll tell you. We won’t sell your data, use it for our own purposes, or combine it with data from other customers, except to provide, secure and improve the service in ways the law allows for processors and service providers. Aggregated or de-identified information that no longer identifies anyone is not personal data under this DPA.
3. Your responsibilities
You are responsible for having a lawful basis to forward calls to us and for the notices your callers receive. Oscar’s greeting always includes a recording notice, and he says he is a virtual receptionist when asked.
4. Confidentiality and security
Everyone at ZII who can access your data is bound by confidentiality. We keep appropriate technical and organisational measures, including encryption in transit, encrypted storage of connection credentials, access limited by role, separation of each business’s data, and daily backups.
5. Sub-processors
You authorise the sub-processors listed in our privacy policy. We’ll give at least 30 days’ notice before adding or replacing one, and you may object on reasonable grounds; if we can’t resolve it, you can end the service and get a refund of fees paid for the period after the change. We impose the same data protection obligations on each sub-processor and remain responsible for them.
6. International transfers
Data is hosted in the United States. Where data protected by UK or EU law is transferred, we rely on the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an adequacy decision such as the UK–US data bridge.
7. Helping you
- Requests from people: you can find, export and delete a caller’s data in Oscar. If a request comes to us, we’ll pass it to you and help you answer it.
- Breaches: we’ll tell you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting your data, with what we know and what we’re doing about it.
- Assessments: we’ll give you the information you reasonably need for a data protection impact assessment or a regulator’s questions.
8. Deletion
Recordings and transcripts are deleted at the end of the retention period you set. When the agreement ends, we delete your data within 60 days, unless the law requires us to keep it, after giving you the chance to export it. Backups roll off within 14 days of deletion.
9. Audits
We’ll make available the information needed to show we meet this DPA. Once a year, on 30 days’ notice, you may audit our compliance, at your cost and in a way that doesn’t disrupt the service or expose other customers’ data. A recent independent security report, where we have one, can be used instead.
10. Liability and precedence
The liability limits in the terms of service apply to this DPA, and the two together are the only basis for any claim between us about personal data. If this DPA and the terms conflict on data protection, this DPA wins.
11. Transfer
If the terms of service are transferred to a company in our group or to a successor, as section 9 of the terms allows, this DPA transfers with them, and that company becomes the processor under it.
Who we are
Oscar is provided by ZII Ltd, a company registered in England and Wales (company number 05989125). Our registered office is Orchard Dene, Heath Road, Boughton Monchelsea, Maidstone, Kent, ME17 4JN. Questions about these terms or your data: [email protected]. Anything else: contact us.