Data Processing Addendum

1. Roles

You are the controller of your customers’ personal data: it is your business relationship, your lawful basis, and your decision what to collect and why.

RingPost is the processor. We process that data only to provide the Service and only on your documented instructions, which, in practice, are the settings, knowledge and configuration in your account, plus this addendum and the Terms.

We never sell your customers’ data, never use it to advertise to them, and never use it to train an AI model of our own.

2. What we process, and about whom

Data subjects: your customers and prospective customers, and any staff you add to your account.

Categories of data: names; phone numbers; email addresses; social media handles; the full content of calls, texts and messages exchanged with your business, including recordings and transcripts of calls; appointment history; notes and preferences recorded during a conversation; and reviews left about your business.

Special category data: we do not ask for it, and the Service is not designed to hold it. A customer may nevertheless volunteer health information in a message to a clinic or a gym. Where that happens it is stored as ordinary message content, and it is your responsibility as controller to ensure you have a lawful basis for holding it.

3. Purpose and duration

We process this data to answer your customers, take and manage bookings, send confirmations and reminders, maintain your customer records, draft review replies, and produce the analytics you see in your dashboard. Processing continues for as long as your account is active, plus the retention period in section 7.

4. Sub-processors

We use specialist providers to deliver the Service: for AI replies, images and video, phone calls and SMS, messaging, email, calendar sync, reviews, social publishing, payments and hosting. Each is bound by terms no less protective than this addendum, and each receives only the data needed for its function. The current list is available on request through our contact page.

We will give you at least 30 days’ notice before adding or replacing a sub-processor. If you object on reasonable data-protection grounds and we cannot offer an alternative, you may terminate without penalty and receive a pro-rata refund of any prepaid monthly fee.

5. International transfers

Some of these providers are outside your country, many in the United States. Where personal data originating in the UK, EEA or another jurisdiction with transfer restrictions is sent to them, that transfer relies on the Standard Contractual Clauses or an equivalent approved mechanism in the provider’s own terms.

6. Security

• Data is encrypted in transit, and at rest by our hosting and database providers.
• Every record belonging to a business is tagged with that business and isolated at the database level, so one customer’s data is not reachable from another’s account even in the event of an application bug.
• Access credentials for connected accounts are stored encrypted, never in plain text.
• Access to production data is limited to the people who need it to operate the Service, and is logged.

7. Retention and deletion

While your account is active we keep your data for as long as you need it. On termination we will, at your choice, export your data to you in a machine-readable format or delete it.

Unless you ask us to delete sooner, data is retained for 60 days after termination (long enough to change your mind or complete an export) and is then deleted from live systems. Backups age out within a further 30 days. We may retain records we are legally required to keep, such as invoices, for the period the law requires.

8. Helping you answer your customers

If one of your customers asks you for a copy of their data, asks you to correct it, or asks you to delete it, we will help you do so within a reasonable time and at no charge. Your dashboard already lets you find a customer and see everything held about them; where a request needs more than that, use our contact page.

9. Personal data breaches

If we become aware of a breach affecting your customers’ personal data we will notify you without undue delay and in any event within 72 hours of becoming aware, with what we know: what happened, which data and roughly how many people are affected, what we are doing about it, and what we suggest you do. As controller, any notification to a regulator or to affected individuals is yours to make; we will give you what you need to make it.

10. Audit

On reasonable written notice, and no more than once a year unless a regulator requires otherwise, we will provide the information reasonably necessary to demonstrate our compliance with this addendum.

11. Calls, recordings and AI disclosure

Calls handled by the Service may be recorded and transcribed. Consent to record and the disclosure that a caller is speaking to an AI are covered separately in our Call Recording and AI Disclosure statement, which you should read alongside this document.

12. Priority

Where this addendum conflicts with the Terms of Service on the processing of personal data, this addendum governs.