Data Processing Agreement
This Data Processing Agreement ("DPA") is incorporated into and forms part of the Terms of Service between TradeBoost AI Ltd ("we", "us", "Processor") and any agency, business, or individual ("you", "Controller") that uses the PipeIQ, Aria, or AnnualService service (each a "Service").
1. Parties and Definitions
Data Controller: The agency or business that signs up to and uses PipeIQ (you). You determine the purposes and means of processing personal data of your contacts.
Data Processor: TradeBoost AI Ltd, trading as PipeIQ — Company No. 17227850, England & Wales. ICO Registration: ZC164080. We process personal data on your behalf, strictly on your instructions.
"Personal Data", "Processing", "Data Subject", "Controller", and "Processor" have the meanings given in the UK GDPR and Data Protection Act 2018.
2. Scope and Purpose of Processing
We process personal data on your behalf solely to provide the relevant Service (PipeIQ, Aria, or AnnualService), including:
- Storing contact lists (name, mobile number, postcode) that you upload
- Sending outbound SMS campaigns, nurture sequences, and re-booking reminders on your instruction
- Receiving and logging inbound SMS replies
- Recording opt-out / STOP requests and maintaining a suppression list
- Providing TPS/CTPS screening results for your contact lists
- Logging campaign activity for your compliance audit trail
- Answering inbound phone calls and generating spoken responses (Aria only)
- Booking confirmed appointments to your calendar (Aria only)
We will not process the personal data for any other purpose, and we will not sell, share, or use it for our own marketing.
3. Your Obligations as Controller
You confirm that:
- You have a lawful basis under UK GDPR for processing each contact's data (e.g. legitimate interests for B2B, explicit consent for B2C marketing SMS)
- For B2C marketing SMS, you hold explicit, specific, informed consent from each recipient and can evidence it
- You have complied with PECR Regulation 22 (consent for electronic marketing) for all contacts you upload
- You will not upload data obtained from a third-party data broker without verifying the consent chain meets UK GDPR standards
- You will honour STOP / opt-out requests immediately — the platform records these automatically
4. Our Obligations as Processor (Article 28 UK GDPR)
We will:
- Process personal data only on your documented instructions
- Ensure all personnel with access to personal data are bound by confidentiality obligations
- Implement appropriate technical and organisational security measures (encrypted data at rest and in transit, access controls, audit logging)
- Notify you without undue delay if we become aware of a personal data breach affecting your contacts
- Assist you in responding to Data Subject requests (access, erasure, rectification) — submit these to app.pipeiq.co.uk/dsar
- Make available all information necessary to demonstrate compliance with Article 28
- Delete or return all personal data on termination of service
5. Sub-Processors
We use the following sub-processors to deliver the service. Each is engaged under a contract containing equivalent data protection obligations:
| Sub-Processor | Role | Location |
|---|---|---|
| Supabase Inc. | Database hosting (contacts, campaigns, audit logs) | EU (Ireland) |
| Twilio Inc. | SMS carrier (sending and receiving SMS) | US (with SCCs) |
| aql — trading name of (AQ) Networks Limited, Co. No. 04250076 | SMS carrier — alternative UK network route for sending and receiving SMS, including virtual mobile and geographic reply numbers. Data processed: recipient phone number and message content. Article 28 terms are being put in place; PipeIQ will not route Controller personal data over this carrier until they are executed. | UK (Leeds LS10 1JQ) |
| I Want That Ltd (TPS Services), Co. No. 07314202 | TPS/CTPS register screening before every campaign dispatch. Only the phone number is transmitted — no names, emails or other personal data. Signed Data Sharing Agreement in place. | UK (London) |
| 3G Telecommunications Limited (hlrlookup.com) | Mobile number reachability screening (HLR lookup) before dispatch, so undeliverable numbers are removed from a list. Only the phone number is transmitted. | UK |
| Anthropic PBC | AI generation of SMS message variants. Data processed: campaign name, client type and message tone. No contact personal data is sent. | US (with SCCs) |
| Deepgram, Inc. | Speech-to-text transcription for the Aria voice-call assistant feature. Data processed: caller's spoken words, transcribed in real time during the call. Deepgram offers a Data Processing Agreement with Standard Contractual Clauses on request; we have not yet executed one and are progressing this while continuing to operate the service. | US (with SCCs) |
| Anthropic PBC (Aria voice feature) | Real-time conversational AI generating Aria's spoken replies during voice calls. Data processed: caller's spoken words (as transcribed) and call context. Distinct from the SMS-copy use above, which sends no contact personal data. This currently runs on a standard individual-tier account rather than a dedicated commercial API agreement; we are upgrading to a commercial agreement with Article 28 terms in due course. | US (with SCCs) |
| Google LLC (Aria voice & calendar) | Text-to-speech voice output for Aria's spoken replies is provided by Twilio's built-in voice engine, under Twilio's own sub-processor terms — no direct PipeIQ-Google relationship arises for this. Calendar booking of confirmed appointments (caller name, phone number, appointment details) uses a direct Google Calendar API integration, covered by Google's standard API Terms of Service and Cloud Data Processing Addendum, which apply automatically on use. | US (with SCCs) |
| Telegram | Internal alert messages to TradeBoost's own team for call follow-up, or as a fallback if the automated voice line fails. Data processed: caller's phone number and a link to the call recording. Telegram does not offer a Data Processing Agreement to any customer; used only for our own internal alerting, not for processing on the Controller's behalf. | International — see Telegram's privacy policy |
| Stripe Inc. | Payment processing for subscription billing. No contact data is sent to Stripe. | US (with SCCs) |
| Twilio SendGrid | Transactional email (account, billing and system notifications) | US (with SCCs) |
| Vercel Inc. | Application hosting and delivery | US (with SCCs) |
| Google Cloud (GCP) | Voice AI server hosting | US (with SCCs) |
| GitHub, Inc. (Microsoft) | Off-site disaster-recovery backup — nightly database copy held in a private repository. Storage only, no processing. | US (with SCCs) |
We will notify you of any intended changes to sub-processors (additions or replacements) with reasonable notice. You may object in writing to hello@pipeiq.co.uk.
6. International Transfers
Some sub-processors are located outside the UK. Where personal data is transferred outside the UK we rely on the UK International Data Transfer Agreement (IDTA) or equivalent UK adequacy mechanisms. Transfers to US-based processors (Twilio, Vercel, Google Cloud, GitHub, Anthropic, Deepgram, Stripe, Twilio SendGrid) are covered by Standard Contractual Clauses addended with UK IDTAs. Our UK-based sub-processors (aql, TPS Services, 3G Telecommunications) involve no international transfer.
7. Security Measures
- All data encrypted in transit (TLS 1.2+) and at rest (AES-256)
- Access to personal data restricted to authorised personnel only, with role-based access controls
- API authentication via JWT tokens with short expiry
- Audit logging of all data access and campaign dispatch events
- Automatic STOP/opt-out enforcement at the platform level
8. Data Retention
Contact data is retained for as long as your account is active. On account termination, all personal data will be deleted within 30 days unless you request earlier deletion. Suppression lists (opt-outs) are retained indefinitely to honour STOP requests.
9. Data Subject Rights
To submit a Data Subject Access Request or request erasure/rectification, use our self-service portal: app.pipeiq.co.uk/dsar or email hello@pipeiq.co.uk.
10. Governing Law
This DPA is governed by the laws of England and Wales. Any disputes will be subject to the exclusive jurisdiction of the courts of England and Wales.
11. Contact
TradeBoost AI Ltd (trading as PipeIQ)
ICO Registration: ZC164080
Email: hello@pipeiq.co.uk
Company No. 17227850 (England & Wales)