Data Processing Terms

This document sets out the terms on which FirstFront processes personal data on your behalf. You are the controller. FirstFront is the processor.

Where the law requires it, you have appointed us under Article 28 of the UK GDPR and the EU GDPR, or under the equivalent provision of the applicable local regime — PIPEDA in Canada, the Privacy Acts in Australia and New Zealand, and applicable US state law.

This document applies to clients in the United Kingdom, the European Union and EEA, the United States, Canada, Australia and New Zealand. It is the same document for every region and takes precedence over any conflicting term elsewhere in our materials.

We apply the GDPR standard as a baseline everywhere. Where a local regime gives stronger protection to a particular category of data or individual, we will apply the local standard to that processing on request.

Only on your documented instructions, and only to deliver the services you have bought. Processing includes:

• Hosting, storing and transmitting your data and your clients' data
• Operating workflows, automations and audit trails you configure
• Voice and message delivery you initiate through the platform
• AI-assisted qualification, scheduling and drafting for you to review
• Support, diagnostics and security logging

You warrant that you hold the necessary rights, consents and notices to place personal data with us, including any client data you route through the platform.

You are responsible for the accuracy of the data you provide and for the lawfulness of your collection of it. We do not assess whether your collection is lawful.

You must not use the platform to process data in breach of any applicable law.

We maintain a written security programme covering:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 with managed key rotation)
• Role-based access control on least privilege, with MFA enforced for all staff
• Annual independent penetration testing
• Security awareness training for all personnel handling data
• Documented incident response and escalation procedures

You grant us permission to use the sub-processors listed on our security page. We give you at least 30 days' notice before adding or replacing one, and if you object on reasonable data-protection grounds we will work with you to resolve it.

We remain fully liable for the performance of each sub-processor's obligations.

Underlying delivery-layer and model providers are identified in full during due diligence and in our sub-processor register available under NDA.

Personal data may be processed outside your own jurisdiction. We will not begin a cross-border transfer of your data until a lawful mechanism is in place.

From the UK or EEA, we rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on EU Standard Contractual Clauses or the UK International Data Transfer Agreement.

From Canada, we rely on PIPEDA accountability provisions and contractual safeguards, and we assess jurisdictional risk before any transfer to a third country.

From Australia, we will not transfer personal information offshore without your consent, as Australian Privacy Principle APP 8 requires.

From New Zealand, we apply the same standard and notify you of any transfer that would move data outside your jurisdiction.

From the United States, we rely on state and federal law, contractual safeguards and the transfer mechanism appropriate to the destination.

Details of the mechanism applicable to your specific data are provided on request, and we will provide a completed transfer impact assessment where your regime requires one.

We will notify you without undue delay and in any case within 72 hours of becoming aware of a personal data breach affecting your data.

The notification will describe the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed.

We will not notify regulators on your behalf unless you instruct us to, but we will cooperate fully with any notification you are required to make.

Taking into account the nature of the processing, we will assist you — by appropriate technical and organisational measures, insofar as is possible — in responding to requests from individuals.

The rights that apply depend on jurisdiction. Access, correction, deletion, restriction and portability apply in the UK and EEA and, with variations, in Canada, Australia and New Zealand. California residents additionally have the rights to know, to delete, to correct and to opt out of sale or sharing; we do not sell personal information, and we do not share it for cross-context behavioural advertising.

Where an individual asks us directly about your data, we will notify you without undue delay and will not respond except on your instructions.

We will make available all information reasonably necessary to demonstrate compliance with Article 28, including our current written security programme and, on reasonable notice, a summary penetration test report.

You may audit us, or appoint an independent auditor to act on your behalf, once in any twelve-month period on at least 30 days' written notice.

Audits take place during business hours and avoid disruption to other customers. If an audit reveals a material breach by us, we will bear the reasonable cost of that audit.

On termination we will, at your choice, return or delete your personal data within 14 days of your request, and will securely delete any remaining copies within 30 days.

We may retain a minimal record where retention is required by law, which will be isolated from active systems and used only for that purpose.

Liability under this document is subject to the limitation of liability in our terms of service, which apply equally to claims made under this document.

Nothing in this clause limits a mandatory consumer protection provision, statutory remedy or regulatory enforcement power available to you or to a supervisory authority in your jurisdiction.

We will notify you by email before a material change to this document takes effect, and will not apply it retroactively to your current term.