Data Processing Agreement

When Automyxor handles personal data for a client, for example the names and phone numbers of the client's customers for appointment reminders, the client is the controller and Automyxor is the processor. Before Automyxor touches any of that data, both sides sign the Automyxor Services Agreement. Its Schedule 3 is a data processing agreement that meets Article 28 of the UK GDPR. The signed agreement is what governs; this page summarises its main terms.

What Automyxor commits to

• Uses the data only on the client's documented instructions, and tells the client if an instruction appears to break data protection law.
• Keeps the data confidential, and limits access to people who need it and are bound by confidentiality.
• Does not put the client's personal data into AI tools.
• Protects the data with the security measures listed in Annex A of the agreement.
• Tells the client within 48 hours of becoming aware of a personal data breach affecting their data, and helps with what follows.
• Helps the client answer requests from people using their data protection rights, and with impact assessments where needed.
• Returns or deletes the data within 30 days of the work ending, unless the law requires it to be kept.
• Allows one audit a year on 30 days' notice, and provides the information needed to show compliance.

Sub-processors

The current list is in Annex B of the agreement. Automyxor gives 14 days' notice before adding a sub-processor, and the client can object.

Health data

Some clients, such as clinics, hold health data about their patients, and even an appointment list can reveal it. That is special category data. Automyxor only handles it where the signed agreement covers it and the client has a lawful basis and a condition for processing it.

Questions: [email protected]