Data Processing Addendum

For enquiry data supplied by visitors to a participating business's AI assistant, that business generally acts as controller and the DeskHub247 operator as processor. Before the planned UK limited company exists, this draft assumes the processor will be an individual trading as DeskHub247, subject to confirming whether the service is instead operated by an unincorporated partnership. The individual's full legal name, actual business establishment, address for service and jurisdiction must be confirmed before signing or incorporating this addendum. The operator is based in Qatar, so UK representative requirements and transfer safeguards require assessment. 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ is only an intended future registered office of a proposed UK company, not the current processor's legal address. Contact: info@gptelevate.com.

Processing should be limited to documented instructions given through the service configuration, agreed service terms or written instructions from the controller, unless applicable law requires otherwise.

The processing concerns customer enquiries received through a business's website widget, hosted mini-site or link, for the term of its use of DeskHub247 and any approved retention period. Data subjects include visitors and prospective customers. Data can include names, contact numbers, messages, job descriptions, preferred callback details and conversation metadata.

The purpose is to answer and organise enquiries for the controller and, where configured, deliver notifications to authorised business contacts. Special-category or high-risk personal data should not be intentionally requested through ordinary service enquiries.

The final agreement must require confidentiality obligations for authorised personnel, appropriate technical and organisational security measures, access restrictions, reasonable incident response and support for the controller's compliance duties. Security details should reflect measures actually implemented, rather than unsupported certifications.

Potential sub-processors include Supabase, Lovable, Cloudflare and OpenAI API for core infrastructure, and Resend or Meta when notification features are enabled. The final addendum needs a verified, maintained sub-processor list, prior authorisation and notice of material changes, relevant contracts, and a means for the controller to object where required by law.

International transfers must use an applicable lawful mechanism and safeguards. This draft does not certify data residency or specify unverified transfer instruments.

Before the first paid customer, assess the need for a UK representative under UK GDPR Article 27, and document the controller/processor relationship and any international transfers from UK businesses to providers outside the UK. The current intended future registered office address is not a substitute for an authorised representative.

The processor should assist the controller, as reasonably possible, with access, rectification, erasure and other rights requests, with incident investigation and notifications, and with data protection impact assessments where relevant. Incident reporting timelines and contact points must be defined in the final agreement.

At the end of processing, the final agreement must offer the controller a legally compliant choice of return or deletion of personal data, subject to lawful retention and practical backup procedures. It must also set proportionate information and audit rights and duties to support Article 28 compliance.

This is a working draft for legal review only. It is not an executed data processing agreement. Before activation, the operator must verify identity, lawful transfer mechanisms, sub-processor terms, security schedule, retention processes, audit arrangements and conflict with the Terms of Service.