Data Processing Addendum

This Data Processing Addendum sets out the controller and processor responsibilities between By5 and each Customer where Customer-controlled personal data is processed through the By5 platform.

In this Addendum, "By5" means By5 Ltd.

This document should be read together with the By5 Privacy Policy, Commercial Licence & Platform Terms, Cookies & Telemetry Notice, Subprocessor List and any applicable order form, proposal or service agreement.

1. Roles

The Customer is controller for personal data relating to its own customers, leads, enquiries, communications, job records, media, attachments and business operations where the Customer determines the purposes and means of processing.

By5 acts as processor where it stores, routes, classifies, summarises, exports or otherwise handles Customer-controlled personal data on the Customer's behalf through the platform.

By5 may act as controller for personal data processed for its own account administration, billing, onboarding, support, platform security, legal compliance, service management and product improvement purposes.

2. Processing Scope

Processing may include capture and routing of communications from approved channels such as email, web forms, WhatsApp and any later approved channels.

Processing may also include enquiry sorting, classification, summarisation, thread management, attachment handling, workflow assistance, quote-preparation support, exports and related platform operations.

By5 does not use identifiable or pseudonymised Customer-controlled personal data to train shared AI models. Where an AI provider processes such data to deliver a requested platform function, that processing remains limited to service delivery under the applicable provider and subprocessor terms.

Authentication, audit logs, usage monitoring, operational telemetry and authorised support access may also be processed where required to secure, operate, support and improve the service.

3. Customer Instructions and Responsibilities

The Customer is responsible for configuring lawful communications, providing required privacy notices, obtaining any required permissions or consents, maintaining accurate Customer account information and ensuring that its use of By5 complies with applicable data protection, marketing, cookie and communications laws.

The Customer must not instruct By5 to process personal data in a way that is unlawful, discriminatory, deceptive, unsafe or otherwise impermissible.

The Customer remains responsible for the content, accuracy and lawfulness of personal data submitted to or processed through the platform by the Customer, its authorised users or its connected channels.

4. Security Principles

By5 will use reasonable technical and organisational measures designed to protect personal data against unauthorised access, accidental or unlawful destruction, loss, alteration, disclosure, misuse or unlawful processing.

Such measures may include access controls, authentication controls, role-based permissions, system monitoring, security logging, provider security controls, operational procedures and staff or contractor confidentiality obligations.

Customer-facing automation should remain disclosed and reviewable where appropriate, and Customers should maintain suitable human review, escalation and handover processes for customer-facing communications.

5. Subprocessors and Transfers

By5 may use subprocessors to deliver hosting, messaging, email, AI-assisted functionality, support, storage, billing, authentication and related platform operations.

By5 shall take reasonable steps to appoint subprocessors that are appropriate for the relevant service and to require subprocessors to process personal data under contractual, confidentiality, security and data protection obligations.

Personal data may be processed or stored in the United Kingdom, the European Economic Area, the United States or other jurisdictions depending on provider infrastructure and service configuration. Where required, By5 shall use appropriate transfer safeguards.

6. Assistance, Retention and Deletion

By5 will provide reasonable assistance for deletion, export, correction or rights-response workflows where required by applicable law and where technically and commercially practical.

Customers remain responsible for their own privacy notices, lawful basis, customer relationship decisions and data subject rights handling where they determine the purposes and means of processing.

Normal application access ends with the applicable trial or paid service period. During the following 30 days, By5 will provide an operator-assisted return of Customer-controlled personal data on a verified Customer request. This return window does not preserve normal login or self-service application access.

Subject to narrow legal, tax, security, fraud-prevention, audit or dispute-resolution holds, active application copies of Customer-controlled personal data will be deleted or anonymised by day 60 after normal access ends. Backup copies expire through the normal backup cycle within 90 days and will not be restored for ordinary service use after deletion from active systems.