Legal

Data Processing Agreement

PiK Management Services · Last updated: 13 September 2026

This Data Processing Agreement ("DPA") applies where PiK Management Services ("Processor", "we") processes personal data on behalf of a client ("Controller", "you") in the course of providing its services. It forms part of, and is subject to, our Terms of Service.

Under UK GDPR, when we handle personal data belonging to your customers on your instruction, you are the data controller and we are your data processor. This DPA sets out each party's obligations.

1. Roles

You are the Controller of the personal data processed under the service. We are the Processor and act only on your documented instructions, which include the configuration and scope agreed at setup and your ongoing use of the service.

2. Subject matter and details of processing

Item	Detail
Subject matter	Provision of AI-assisted communications, booking, research and administrative services
Duration	For the term of the service engagement
Nature & purpose	Reading, drafting, replying to, organising and routing messages, bookings and admin on the Controller's behalf
Types of data	Contact details, message content, booking details, and other business-communication data provided through connected accounts
Categories of data subject	The Controller's customers, enquirers, staff and contacts

3. Our obligations as Processor

Process personal data only on your documented instructions, unless required by law.
Ensure persons authorised to process the data are bound by confidentiality.
Implement appropriate technical and organisational security measures.
Assist you, where reasonably possible, in responding to data subject requests and in meeting your security, breach-notification and impact-assessment obligations.
Notify you without undue delay on becoming aware of a personal data breach affecting your data.
On termination, delete or return personal data as you direct, unless retention is legally required.
Make available information reasonably necessary to demonstrate compliance with this DPA.

4. Sub-processors

You authorise us to engage sub-processors to deliver the service. We will maintain a list of sub-processors and ensure they are bound by data protection obligations no less protective than those in this DPA. Our current key sub-processors include:

Anthropic — AI language model processing
Google — AI language model / embedding processing
DigitalOcean — server hosting / infrastructure
Microsoft — email and calendar services, where connected

We will give you reasonable notice of any intended change to sub-processors so you may object on reasonable data protection grounds.

5. International transfers

Some sub-processors may process data outside the UK/EEA. Where they do, we rely on appropriate safeguards recognised under UK data protection law (such as the UK International Data Transfer Agreement or an adequacy decision).

6. Security measures

Access to connected accounts limited to what the service requires.
Credentials and data held on secured, access-controlled infrastructure.
Ability for you to revoke access to any connected account at any time.
Separation of one client's data and context from another's.

7. Data subject rights and breaches

If we receive a request or complaint from one of your data subjects, we will forward it to you and not respond directly unless you instruct us to. We will assist you in fulfilling your obligations under UK GDPR in relation to such requests and to any personal data breach.

8. Deletion and return

On termination of the service, we will, at your choice, delete or return the personal data we hold on your behalf within a reasonable period, and delete existing copies unless legally required to retain them.

9. General

This DPA is governed by the laws of England and Wales. In the event of conflict between this DPA and the Terms of Service on data protection matters, this DPA prevails.

10. Contact

PiK Management Services
Email: pikmanagementservices@outlook.com