Data Processing Addendum

When you use Extra Hands to answer calls, texts, WhatsApp messages or web chat for your own customers, you (the “Customer”, the data controller) have us (“Extra Hands”, The Local Post Media Ltd, the data processor) process personal data on your behalf. This addendum forms part of, and is incorporated into, our Terms of Service and reflects the requirements of Article 28 UK GDPR (and, where it applies to you, Article 28 EU GDPR). Terms defined in UK GDPR have the same meaning here.

Extra Hands processes personal data for as long as your Extra Hands subscription is active, for the purpose of providing the service described in our Terms of Service: answering and routing calls, texts, WhatsApp messages and web chat, transcribing and summarising calls, capturing leads, and booking appointments, strictly on your documented instructions as given through the app’s settings and your use of the service.

The people affected are your customers, prospective customers and other people who contact your business through a channel connected to Extra Hands. The data typically includes:

• Names, phone numbers, and any information a caller or texter volunteers;
• Call audio, transcripts and AI-generated summaries;
• Appointment details and calendar availability;
• Lead and pipeline notes your team adds.

We will:

• Process personal data only on your documented instructions, including about international transfers, unless required to do otherwise by law (in which case we will tell you first, unless the law prohibits it);
• Ensure the people we let access the data are under a duty of confidentiality;
• Implement appropriate technical and organisational security measures, including encryption in transit and at rest, per-tenant database isolation, and signature verification on inbound webhooks;
• Not engage a new sub-processor without giving you the chance to object (see below);
• Help you respond to requests from data subjects exercising their rights, and to your data protection impact assessments and consultations with a supervisory authority, taking into account the information available to us;
• Notify you without undue delay after becoming aware of a personal data breach affecting the data;
• At your choice, delete or return all personal data at the end of the relationship, and delete existing copies unless the law requires us to keep them (this is what happens automatically when you delete your organization or a customer record in the app);
• Make available the information reasonably necessary to demonstrate compliance with this addendum, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable notice.

You give general authorisation for Extra Hands to engage the sub-processors listed in our Privacy Policy (currently Supabase, Vercel, Anthropic, Retell AI, Telnyx, Meta, Google and Whop), each bound by a written contract imposing data protection obligations equivalent to those in this addendum. We will update that list if it changes and, if we add a new sub-processor, give you the opportunity to object on reasonable data protection grounds by writing to privacy@extrahands.io within 14 days; if we cannot resolve your objection, either of us may terminate the affected part of the service.

Where a sub-processor is located outside the UK or EEA, we rely on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses (as applicable), or another lawful transfer mechanism, to protect the transfer.

Liability under this addendum is subject to the limitations set out in our Terms of Service.

For anything relating to this addendum: The Local Post Media Ltd, 128 City Road, London, United Kingdom, EC1V 2NX, privacy@extrahands.io.