Draft Data Processing Agreement

Roles depend on how the service is used and are not fixed in advance. Where Mohammad Asif, trading as PublicVoiceShield determines the purposes of processing — for example account administration and service security — it acts as controller. Where your organisation submits posts, discussions and decisions, your organisation will usually be the controller and Mohammad Asif, trading as PublicVoiceShield acts as processor on its documented instructions. Each party must confirm its own role.

The processor processes personal data only on the documented instructions of the controller, including as to international transfers, unless required otherwise by law.

Personnel authorised to process personal data are bound by an appropriate duty of confidentiality.

The processor implements appropriate technical and organisational measures, including access control, organisation-level data isolation, secret management and append-only audit records. See the Security overview.

The controller gives general authorisation for the subprocessors listed on the Subprocessors page: Lovable / Lovable Cloud; OpenAI. The processor will notify the controller of intended changes and give a reasonable opportunity to object.

Where personal data is transferred outside the United Kingdom, an appropriate transfer mechanism (such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses) must be in place, supported by a transfer risk assessment.

The processor notifies the controller without undue delay after becoming aware of a personal data breach and provides reasonable information to support the controller's own obligations.

The processor provides reasonable assistance with data subject rights requests, data protection impact assessments and consultations with the supervisory authority.

On termination, the processor deletes or returns personal data at the controller's choice, subject to legal retention obligations and the backup lifecycle.

The processor makes available information reasonably necessary to demonstrate compliance and contributes to audits on reasonable notice, subject to confidentiality.

Data subjects

• Authorised users of the customer organisation.
• Individuals whose public comments are included in submitted discussions.
• Individuals mentioned within submitted content.

Categories of personal data

• Account and organisation details: name, work email, role, membership status.
• Authentication and security records.
• Submitted posts and discussion text, including author labels.
• AI analyses, scores, categories and suggested replies.
• Human decisions, edited replies and internal notes.
• Technical data such as IP address and device details, where collected by the hosting provider.

Special-category data

Not requested and not required. Customers are instructed not to submit special-category or criminal-offence data unless necessary, authorised and supported by an appropriate lawful condition.

Duration

For the term of the service agreement, subject to the Data Retention Policy.

Controller: ____________________ Date: ____________
Processor: Mohammad Asif, trading as PublicVoiceShield Date: ____________