Data Processing Agreement

This Data Processing Agreement (DPA) describes how Batra.ai processes personal data on your behalf when we provide services — in particular AI and ongoing managed services. It supplements our Privacy Policy and forms part of our Service Agreement.

1. Roles

Where we process personal data that you control (for example your customers’ details handled by an AI assistant we run for you), you are the data controller and we are the data processor. Each party complies with UK GDPR and the Data Protection Act 2018.

2. What we process

The personal data and data subjects depend on the service — typically the contact details and enquiry content of the people who interact with your systems, plus your own account details. We process only what is needed to deliver the agreed service.

3. Purpose and instructions

We process personal data only to provide the services, and only on your documented instructions (including the agreed service configuration), unless the law requires otherwise. People with access to the data are bound by confidentiality.

4. Security

We apply appropriate technical and organisational measures to protect personal data — including encryption in transit, access controls, least-privilege access, and secure, reputable hosting providers.

5. Sub-processors

We use a small number of reputable sub-processors (for example hosting, email, payment and AI platform providers), each bound by a data processing agreement and processing data only on documented instructions. We will tell you of any intended change to our sub-processors and give you the chance to object.

6. Assisting with your obligations

We assist you, so far as reasonably possible, in responding to data-subject requests (access, correction, erasure, portability) and in meeting your security, breach-notification and impact-assessment duties.

7. International transfers

Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place (such as an adequacy decision or standard contractual clauses).

8. Retention and deletion

We keep personal data only for as long as needed to provide the service, and — at your choice — delete or return it within 30 days of the end of the service, except where the law requires us to keep it.

9. Breach notification

If we become aware of a personal-data breach affecting your data, we will notify you without undue delay and provide the information you reasonably need to meet your own notification duties.

Contact us

If you have any questions, please contact us: