Data Processing Agreement

This Data Processing Agreement (“DPA”) is between Blackwellen Limited, trading as ClientTurn (company number 16482166, registered office 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom) (“we”, the processor), and the business that holds a ClientTurn workspace (“you”, the controller). It is the contract required by Article 28(3) of the UK GDPR.

It forms part of the Terms of Service (clause 16) and is accepted when you accept those terms. It sets out the same commitments as section 7 of our Privacy Policy in one standalone document, with the annexes a procurement or security review asks for. If you need a countersigned copy for your records, write to legal@clientturn.com.

“UK GDPR”, “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings in the UK GDPR and the Data Protection Act 2018. “Customer Personal Data” means personal data we process on your behalf in providing the service, as described in Annex 1. “Sub-processor” means a third party we engage to process Customer Personal Data.

For Customer Personal Data you are the controller and we are your processor. You decide which leads and contacts are processed, why, and which channels, rules and integrations are used.

For the account data of your own users (sign-in, billing, support) we are an independent controller, as described in the Privacy Policy. This DPA does not apply to that data.

Where you take a payment through a quote or invoice link, you are the merchant of record through your own payment provider account; ClientTurn sends the link and reads the payment result for you.

We process Customer Personal Data only on your documented instructions. Your instructions are this DPA, the Terms, and the configuration you set in the product (sources, questions, rules, channels, integrations and retention settings).

If the law requires us to process it otherwise, we will tell you first unless the law forbids it. We will tell you if we believe an instruction infringes data protection law.

You are responsible for having a lawful basis, for the transparency information you give data subjects, and for complying with PECR when you use the service to send electronic marketing.

Everyone we authorise to process Customer Personal Data is bound by a duty of confidence and has access only as far as their role needs.

We implement the technical and organisational measures in Annex 2, which are appropriate to the risk under Article 32. We may change them to keep pace with threats and technology, but will not reduce the overall level of protection.

You give general written authorisation for us to engage the sub-processors listed in Annex 3 and on our sub-processor register, which is the current list.

• We give at least 30 days’ notice by email before a new sub-processor starts processing Customer Personal Data, and update the register at the same time.
• You may object on reasonable data protection grounds within the notice period by writing to legal@clientturn.com. If we cannot resolve it, you may end the affected part of the service and receive a pro-rata refund of prepaid fees for it.
• Each sub-processor is bound by written terms no less protective than this DPA, and we remain liable to you for its performance.
• We do not use data brokers or paid contact-enrichment vendors.

The primary database is in London (eu-west-2). Where a sub-processor processes Customer Personal Data outside the United Kingdom, we rely on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses (or the International Data Transfer Agreement), supported by a transfer risk assessment. Annex 3 gives the location of each.

Retell AI (the optional AI voice agent) processes and stores call data in the United States (Amazon Web Services US regions). The transfer relies on the UK International Data Transfer Agreement or the Standard Contractual Clauses with the UK Addendum, under Retell AI's data processing agreement.

We help you answer requests from data subjects through the product (search, export, suppression, anonymisation and deletion tools, and the privacy request inbox in Settings), and by responding to reasonable requests for further help. If a request reaches us directly we pass it to you without undue delay and do not answer it ourselves unless you ask us to.

We notify you without undue delay, and in any event within 24 hours of becoming aware, of a personal data breach affecting Customer Personal Data. The notice gives what we know at that point: the nature of the breach, the categories and approximate numbers of people and records, the likely consequences, and what we are doing about it. We follow up as we learn more.

We will help you meet your own obligations to notify the ICO within 72 hours and, where the risk is high, the people affected.

Taking into account the nature of the processing and the information available to us, we assist you with data protection impact assessments and any prior consultation with the ICO. Our security questionnaire answers and data-flow description are available on request.

For 30 days after your subscription ends you may export your data using the export tools, or ask us for a machine-readable copy free of charge. After that, and in any event within 90 days, we delete or irreversibly anonymise Customer Personal Data, except records the law requires us to keep and minimised suppression records kept only so that someone who opted out is not contacted again. Deleted data leaves our encrypted backups as they expire.

We make available the information needed to demonstrate compliance with this DPA, starting with this document, the sub-processor register and our security questionnaire answers. Where that is not enough, you (or an independent auditor bound by confidentiality) may audit on at least 30 days’ notice, no more than once in any 12 months except after a personal data breach, during business hours and without access to other customers’ data. Each party bears its own costs.

Each party’s liability under this DPA is subject to the limits in clause 20 of the Terms, except where the law does not allow it to be limited. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails.

This DPA lasts as long as we process Customer Personal Data for you. We may update it to reflect changes in law or in the service; we will give at least 30 days’ notice of any change that reduces your protection. The version and date at the top of this page identify the text in force.

Blackwellen Limited is registered with the Information Commissioner’s Office, registration number ZC160806. Data protection questions and notices under this DPA go to legal@clientturn.com.

Subject matter

Provision of the ClientTurn service: receiving leads, instant follow-up, deterministic qualification, booking, quoting and invoicing links, optional AI voice calls, and reporting.

Duration

The customer's subscription, plus the exit and deletion period in section 12.

Nature and purpose

Collecting, recording, organising, storing, retrieving, transmitting, analysing, restricting and erasing personal data so the customer can respond to, qualify and convert its own enquiries and prospects.

Categories of data subject

The customer's prospective and existing clients and their staff (leads and contacts), people who sign or pay a quote, and the customer's own authorised users.

Types of personal data

Name, business email address, phone number supplied on a lead form, job title and company, lead form answers, message and email content, qualification answers, booking details, quote and invoice details (including signer name, email, IP address and user agent), call metadata, transcripts and, where enabled, recordings, and campaign attribution identifiers.

Special category data

None intended. The product does not ask for it and customers must not collect it through the service. Any volunteered in a free-text reply is held only as part of that message.

Frequency

Continuous, for as long as the customer uses the service.

The current list, with the personal data each can see and the transfer mechanism relied on, is on the sub-processor register. At the date of this version: