First Essential
First Essential UK Customer Data Processing Agreement
Version 0.2 — customer agreement specimen. The standard service descriptions and First Essential operating arrangements below are completed. A deployment is covered only when the accepted order identifies this version and the selected schedules. This specimen is not a signed customer agreement.
Last updated: 9 September 2026
1.Parties, application and definitions
1.1This Data Processing Agreement, including its completed Annexes A to D (the DPA), is between:
- (a)First Essential Holdings Ltd, trading as First Essential UK, registered in England and Wales under company number 15619967, whose registered office is 10 Montague Place, Worthing, West Sussex, BN11 3BG, United Kingdom (we, us or First Essential); and
- (b)the business customer identified in Annex A (you or the Customer).
1.2The Services Agreement is the specific order form or service contract identified in Annex A. This DPA forms part of it only when the parties have accepted the identified DPA version and completed annexes in a binding written agreement, including an electronic agreement. A website specimen or a reference to an uncompleted draft does not itself record that acceptance.
1.3This DPA applies only to the personal data that we process on your behalf in providing the selected Services (Processor Data). You are the controller and we are the processor for that processing. Our particular operations, permitted data and your instructions are recorded in Annex A. Purchasing hardware, using a product name or entering a general commercial relationship does not by itself establish a controller and processor relationship.
1.4If you are acting as processor for another controller, this standard DPA must be adapted and the necessary upstream authority recorded before that processing starts. This DPA does not automatically authorise us to act as your subprocessor.
1.5Data Protection Law means the UK GDPR, the Data Protection Act 2018 and other applicable UK laws concerning personal data, as amended from time to time, including applicable provisions of the Privacy and Electronic Communications Regulations. The terms controller, processor, personal data, processing, data subject and personal data breach have the meanings given in the UK GDPR. A Subprocessor is another processor engaged by us or within our processing chain to process Processor Data for the Customer.
1.6The DPA does not authorise every capability available in a platform. Only the service modules, channels, integrations and processing operations agreed in Annex A are included.
2.Separate controller activities and third-party services
2.1We may separately act as controller for identifiable activities such as administering our business relationship with you, invoicing, accounting and meeting our own legal obligations. Those activities, their data and purposes must be distinguished from Processor Data and explained in our applicable Privacy Policy.
2.2This distinction does not give us general permission to reuse your end customers' records, communications, recordings or other Processor Data for our own marketing, product development or service improvement. Service delivery and security operations carried out on your behalf remain subject to this DPA. A record is not excluded merely because it appears in a support ticket, diagnostic log or incident report.
2.3If a separate use makes us a controller, we must establish and meet the obligations for that use. We will not create that use simply by changing the label applied to Processor Data. This DPA gives no permission to sell Processor Data, build profiles across customers or train or improve general-purpose models using it. Customer-specific model training or fine-tuning is also outside this standard DPA.
2.4A payment provider, telecommunications provider or other third party may have a separate controller role for particular activities. Each relevant role and data flow must be assessed and recorded in Annex A or C. A provider selected and contracted directly by you is not automatically our Subprocessor; a provider we engage to process Processor Data on your behalf is not automatically an independent controller. Our own duties for any disclosure or integration we perform continue to apply.
3.Instructions and the Customer's responsibilities
3.1We will process Processor Data only on your documented instructions, including instructions concerning disclosures and international transfers. The accepted Services Agreement, this DPA, its completed annexes and authorised subsequent written instructions form that record. Instructions may be given through an agreed configuration control or by email if the instruction, its source and its scope can be retained.
3.2Only your authorised contacts listed in Annex A may issue or approve material changes to instructions. Routine use of an agreed service within its documented scope does not authorise new data categories, providers, purposes or countries.
3.3You determine why Processor Data is processed and the permitted purposes. You are responsible for the lawful basis, required privacy information, accuracy and minimisation of the data you provide, the lawfulness of your instructions and any required consent. Where relevant, this includes lawful marketing, call recording, call announcements and communications practices. Consent is required where the applicable law requires it; this clause does not treat consent as the only possible lawful basis for all processing.
3.4We will immediately inform you if, in our opinion, an instruction infringes the UK GDPR or other applicable UK data protection law. We will not carry out the affected instruction while that concern remains unresolved. We will cooperate on a lawful alternative and limit any suspension to what is necessary.
3.5If UK law requires processing other than on your instructions, we will inform you of the requirement before processing, unless the law prohibits that notice on important public interest grounds. We will limit the processing to what the law requires.
3.6Proposed instructions that materially change the agreed service, data or risk must be assessed and documented before implementation. Commercial agreement about additional work does not excuse either party from a duty already imposed by Data Protection Law.
3.7You must ensure that your authorised users follow the agreed instructions, access controls and restrictions, and that information you supply is accurate, relevant and no more than necessary. Keep proportionate records of the lawful basis, required permissions, notices and approvals, and provide relevant evidence on a reasonably justified request through a secure route. Records must follow justified retention rules; this clause does not authorise unrestricted collection or retention.
3.8Before activation and material changes, your authorised contact must confirm the customer-controlled data sources, purposes, business facts, recipients and configured actions against Annex A. You must not enable an unapproved integration, field, recording purpose or destination merely because a platform permits it. Ongoing supervision of your business use remains your responsibility except for work expressly allocated to us or required by law. We remain responsible for our agreed configuration, security and the checks and action required by this DPA, including clause 3.4.
4.Permitted and excluded data
4.1Only the ordinary personal data and data subject categories selected in Annex A are permitted. You must not submit or enable collection of the categories below and must take reasonable precautions within your control to prevent accidental collection:
- (a)special category data, including health data, or criminal conviction and offence data;
- (b)personal data relating to children;
- (c)full payment card numbers, card verification codes, PINs or other sensitive payment authentication data;
- (d)government identification numbers or copies of identity documents; or
- (e)precise geolocation.
4.2This standard DPA does not authorise clinical assessment, symptom collection, medical triage, treatment decisions, biometric identification or decisions based solely on automated processing that produce legal or similarly significant effects. It does not clear a healthcare deployment. Such work requires a separately reviewed scope and cannot begin merely because this DPA has been accepted.
4.3A business operating in a healthcare or other sensitive sector must assess whether even an apparently routine enquiry or booking reveals excluded information. It must not use this standard scope where such information is expected.
4.4If either party discovers excluded or excessive data in the Services, it will notify the other without undue delay. We will restrict further processing to protecting the data, investigating the exposure and carrying out lawful instructions to remove, return or otherwise address it. An accidental receipt does not authorise continued use. Any agreed preventative controls, including form fields and recording settings, must be documented and verified in Annex A.
5.People and confidentiality
5.1We will limit access to Processor Data to people who require it for authorised work. Before access, they must be bound by confidentiality commitments or an appropriate statutory duty of confidentiality.
5.2We will ensure that people acting under our authority process Processor Data only on permitted instructions, unless UK law requires otherwise. We will provide appropriate data protection and security instructions and training for their work.
5.3Confidentiality duties continue after a person's access or engagement ends. Access permissions must be removed when no longer required.
6.Security
6.1We will implement and maintain the technical and organisational measures required by Article 32 of the UK GDPR, appropriate to the risks of the agreed processing. The assessment will consider the nature, scope, context and purposes of processing, the possible impact on individuals, the available technology and implementation costs.
6.2Those measures will address unauthorised access or disclosure, accidental or unlawful loss, destruction or alteration, and the confidentiality, integrity, availability and resilience of relevant systems. They will include, where appropriate to the assessed risk, encryption or pseudonymisation, timely recovery following an incident and regular assessment of security effectiveness.
6.3Annex B must describe the actual measures applying to the selected Services, identify each party's responsibilities and record any material limitations. We will provide information reasonably necessary for you to assess those measures. A provider's marketing statement or certificate alone is not a description of the Customer's implemented configuration.
6.4We will maintain the agreed level of protection during processing. We will assess material changes and notify you where a change would materially affect the protection described in Annex B. We will not treat a commercial service change as permission to fall below our legal duties.
6.5You will manage your own users, endpoints, credentials and instructions as allocated in Annex B. That allocation does not remove our responsibility for the processing and systems we control.
6.6If you become aware of a security incident, exposed credentials, unauthorised access or a material error in the information or settings you control that may affect Processor Data, notify our contact in Annex A without undue delay. Take reasonable steps within your control to contain it, preserve necessary evidence securely and cooperate on correction. An accidental incident does not make every resulting loss yours: responsibility depends on the cause and the parties' applicable duties.
7.Subprocessors
7.1We will not engage a Subprocessor for Processor Data without your prior specific or general written authorisation. Annex C records which authorisation mechanism applies. If general authorisation has not been expressly agreed, specific written authorisation is required.
7.2Before processing begins, we will provide the named, client-specific register in Annex C. It must identify the legal entities, their functions, relevant processing and access countries, permitted data and the applicable onward processing chain. Generic provider categories alone do not complete that register. The register may be supplied through an agreed secure document route, but you must be able to obtain and retain the applicable version.
7.3Before appointment, we will assess whether each Subprocessor provides sufficient guarantees for the required protection. We will bind it by written terms imposing the applicable data protection obligations with an equivalent level of protection, including restrictions on purpose, security, assistance, breaches, deletion, audit and further subprocessors.
7.4Under general authorisation, we will give you written advance notice of intended additions or replacements, the relevant information to assess them, the intended start date and a genuine opportunity to object on data protection grounds. Annex C records the agreed notice period and notification route. Updating a webpage without the agreed notification is not enough.
7.5We will address a timely objection with you before the proposed Subprocessor handles your Processor Data. Where the objection cannot be resolved lawfully, we will agree an alternative arrangement or stop the affected processing. Any resulting change or termination of the affected Service must be documented under the Services Agreement. We will not bypass an unresolved objection by silently routing the same data to a different unapproved provider.
7.6We remain fully liable to you for our Subprocessors' performance of their data protection obligations as required by Article 28(4). A supplier's liability cap or refusal to assist does not reduce that statutory responsibility.
7.7We will ensure that equivalent controls apply to further subprocessors and provide the information needed for your oversight. An affiliate is not exempt from these requirements merely because it belongs to the same business group.
8.Rights requests, assessments and regulatory assistance
8.1Taking account of the nature of processing, we will assist you through appropriate technical and organisational measures, so far as possible, with requests under Chapter III of the UK GDPR. This includes finding relevant Processor Data and carrying out authorised access, correction, restriction, portability, objection or erasure actions where applicable.
8.2If we receive a request or complaint concerning Processor Data, we will pass it to the contact in Annex A without undue delay. We will not decide or issue a substantive response on your behalf unless instructed or required by law. We may acknowledge receipt and identify the appropriate contact.
8.3Taking account of the processing and information available to us, we will assist you with your obligations under Articles 32 to 36, including security assessments, breach notification, data protection impact assessments and prior consultation with the ICO where required.
8.4We will provide relevant information, preserve relevant evidence and explain material limitations in time to support your applicable deadlines. Neither this DPA nor an ordinary support response target extends a legal deadline.
8.5Any charge for additional assistance must be transparently agreed under the Services Agreement. A fee dispute must not prevent or delay assistance that we are already legally required to provide, and you will not be charged for remedying our own breach of this DPA.
9.Personal data breaches
9.1We will notify you without undue delay after becoming aware of a personal data breach affecting Processor Data. We will investigate suspected incidents promptly. Notification will not wait for a final forensic report, supplier confirmation, an assessment of harm to individuals or completion of remedial work once we are aware of the breach.
9.2We will send notice to your breach contact in Annex A using the agreed contact route. The initial notice will contain the information available at that time, including:
- (a)what happened and when, including when we became aware;
- (b)the affected Services, data categories and, where available, approximate numbers of people and records;
- (c)the likely consequences;
- (d)action already taken or proposed to contain the incident and reduce harm; and
- (e)a contact for further information.
9.3We will provide missing information and material updates in phases without undue further delay, preserve relevant evidence and cooperate with reasonable containment and recovery instructions. We will keep a record of the incident and our response.
9.4You remain responsible for deciding and making your required controller notifications to the ICO and affected individuals. We will provide the assistance required by clause 8. This does not prevent a notification that we are independently required by law to make; where lawful, we will inform you before making it.
9.5Any additional contractual notification target must be expressly recorded in Annex A. It does not replace or extend the obligation in clause 9.1.
10.Information, audits and inspections
10.1We will make available all information necessary to demonstrate compliance with Article 28 and will allow and contribute to audits, including inspections, by you or an auditor you appoint.
10.2We may first provide relevant records, independent reports and other assurance material where these meet your information needs. They do not replace your right to an appropriate audit where further verification is necessary.
10.3The parties will agree reasonable practical arrangements to protect confidentiality, system security and other customers' information and to avoid unnecessary disruption. Ordinary audits should be arranged on reasonable notice. Those arrangements must not obstruct urgent investigation of a breach, a regulator's requirements or the exercise of your Article 28 rights.
10.4We will cooperate to verify and address findings. We will obtain the necessary information and cooperation through the Subprocessor chain. A supplier restriction must be resolved as part of our supplier arrangements and is not a blanket exception to this clause.
11.International transfers and access
11.1We will process Processor Data only in the countries and through the entities authorised in Annex C, including remote support and administrative access. A proposed change must follow the documented-instruction and Subprocessor processes where applicable.
11.2A restricted transfer must meet the applicable UK GDPR transfer requirements before it takes place. Annex C must identify the transfer, the responsible initiator, exporter and importer, and the route relied upon. Depending on the actual circumstances, that may be applicable UK adequacy regulations or an appropriate safeguard. A statutory exception must not be used as a routine substitute without a documented assessment that its conditions apply.
11.3Where an appropriate safeguard requires a data protection test, also described as a transfer risk assessment, the responsible party must complete it and implement any necessary additional protections before the transfer. We will provide the information and assistance needed for the transfers we arrange.
11.4Where the route uses the UK International Data Transfer Agreement, or the approved UK Addendum with the applicable EU Standard Contractual Clauses, the correct instrument, parties, modules and completed tables must be incorporated separately. This DPA does not itself execute a transfer instrument. EU Standard Contractual Clauses alone are not a UK transfer mechanism.
11.5A hosting-region label does not establish the location of every recipient or support access, and it does not by itself resolve transfer compliance. Onward transfers and remote access must be included in the assessment.
11.6If a relied-on transfer route ceases to provide the required protection, we will notify you without undue delay, take appropriate protective steps and suspend the affected transfer unless a lawful alternative has been established. We will not continue an unlawful transfer because a service contract remains in force.
12.Retention, return and deletion
12.1During the Services, we will keep Processor Data only for the purposes and periods, or defined deletion triggers, instructed in Annex D. Different schedules may apply to recordings, transcripts, messages, contact records, technical logs and backups. We will not substitute a platform default or a contractual maximum for your agreed instruction.
12.2At the end of the Services involving processing, we will, at your choice, return or securely delete all Processor Data and delete existing copies, unless UK law requires continued storage. Annex D must record the choice, export scope and method, timing and the handling of copies.
12.3Before the end of processing, we will seek your exit instruction. Annex D must include a documented default instruction for the case where you do not make a different choice by the agreed date. No indefinite retention or automatic loss of your right to choose is created by this DPA.
12.4For any data that UK law requires us to retain, we will identify the requirement, data and retention period to you unless prohibited by law. We will limit access and use to that legal requirement and securely delete the data when it no longer applies. This exception is not a general permission to keep the Customer's entire dataset for possible legal claims or commercial convenience.
12.5Where immediate deletion from a backup is not practicable, Annex D must specify a justified deletion cycle and safeguards. Such data must be put beyond ordinary use, protected and deleted as soon as practicable within the agreed cycle. If a backup is restored for recovery, applicable deletion instructions must be reapplied before the restored data is returned to normal use.
12.6We will provide an accurate record of the return or deletion action and identify any data still lawfully retained or awaiting the agreed backup cycle. We will not describe deletion as complete while identified copies remain. Any requested formal certificate, supplier confirmation or additional export service must reflect the verified process recorded in Annex D.
12.7The continuing duties in this DPA apply until Processor Data and its copies have been returned or deleted as required. Ending access to an account is not itself proof of deletion.
13.Priority, liability and duration
13.1For the processing of Processor Data, this DPA takes priority over conflicting data protection provisions in the Services Agreement. A mandatory provision of an applicable transfer instrument takes priority to the extent required by that instrument. Commercial instructions cannot reduce a requirement of Data Protection Law.
13.2The Services Agreement's expressly agreed commercial liability provisions apply only to the extent consistent with Data Protection Law and this DPA. Nothing limits a data subject's statutory rights, a regulator's powers or a responsibility that cannot lawfully be limited. This DPA creates no new financial cap and does not represent that insurance covers a particular risk.
13.3This DPA applies for the period of processing, including permitted retention after the Services end. Confidentiality and other obligations intended to continue survive for as long as relevant.
13.4The governing law and dispute provisions of the identified Services Agreement apply, subject to mandatory law and any applicable transfer instrument. Changes to this DPA or its annexes require a documented agreement or an expressly agreed change process that preserves the required protection.
13.5Any business-customer reimbursement under the accepted Services Agreement, including sections 11.6 and 11.7 of its identified Acceptable Use Policy, applies only to the extent caused by the Customer's or its authorised users' material breach or negligent use and permitted by law. It does not transfer our own breaches, our mandatory Subprocessor responsibility or non-transferable penalties. No amount is recovered twice. Clause 8.5 governs processing-related assistance charges, and a fee dispute cannot delay required assistance. A data subject's compensation rights and any lawful contribution between responsible parties remain unaffected. This clause creates no new indemnity, amount or cap.
Annex A. Customer, contacts and processing instructions
A1. Agreement record
| Item | Instruction or record |
|---|---|
| Customer legal identity, address and order | The customer and order expressly identified in the accepted Services Agreement. The order reference and acceptance record must travel with this schedule |
| DPA and standard annex version | Version 0.2, reviewed 7 September 2026 |
| Customer role | Controller for the selected processing. A customer acting for another controller requires the adaptation in clause 1.4 |
| Processing start and duration | The start and term in the accepted order, followed only by necessary return/deletion under Annex D |
| Deployment identity and selected functions | The named account or tenant and service selection in the order's deployment record; account credentials are never part of this document |
| Customer instruction, privacy and incident contacts | The authorised contacts identified in the accepted order, including its recorded deputy or escalation route |
| First Essential contact | office@firstessential.uk; 020 38 38 06 09; registered office in clause 1 |
| Security and incident lead | Don; David covers when Don is unavailable |
| Support, complaints and operational cover | David and Don, covering each other. Normal support Monday to Friday, 08:00–18:00 UK time; emergency and urgent out-of-hours help subject to availability. No general 24/7 response or resolution guarantee |
| Additional notification target | None introduced by this schedule. Statutory and expressly agreed obligations remain |
| Acceptance route | Email confirmation or an online or physical signature, retaining the accepted order, DPA and selected annex versions. An existing service contract is not proof that this new version was accepted |
A2. Standard service profiles
Only profiles expressly selected in the order apply. Product availability alone does not select every function.
| Profile | Purpose and processing | Data and people | Limits and configuration |
|---|---|---|---|
| First Essential One CRM | Store, organise, retrieve, update and delete ordinary business contacts and enquiries; manage agreed sales, booking and support workflows; export on authorised instruction | Adult prospects, customers, business contacts and authorised users; names, business contact details, enquiry content, sales or booking status, preferences, consent or objection records, user IDs and relevant technical records | Ongoing hosting and activity triggered by the selected workflow. The deployment record identifies its fields, connected channels, integrations and expected scale. No automatic permission for marketing or sensitive data |
| AI Assistant — text | Use customer-approved information and scripts to answer general product or service questions, capture ordinary leads and direct people to bookings | Adult enquirers and users; submitted text, ordinary contact details, approved enquiry references, conversation and technical records | No independent approval, refusal, eligibility, credit or other significant decision. No medical or healthcare use. Summaries are selected separately and are not mandatory. The record identifies chat channels, permitted actions and where conversations enter the CRM |
| Website or portal support | Configure and maintain the agreed website or portal and investigate faults, with access to personal data only as necessary for that work | Authorised users, ordinary enquiry form records and operational logs within the agreed service | Only where ordered; does not authorise unrestricted copying of a customer's database, clinical records, student records or unrelated content |
| AI Assistant — voice | Excluded from activation under this standard completion | No new production authorisation is granted here | The final contract with our third-party voice AI service provider is awaiting signature. The final supplier terms and specific recording, transcript, summary, transfer and deletion settings must be attached before this profile is activated |
| Kiosk or EPOS | Not selected by default | Determined by the actual ordered deployment | Hardware or a platform subscription does not establish camera/microphone use or an EPOS processing chain. Include a separate, verified deployment schedule only if this processing is actually ordered |
| Payment-provider referral | Outside this processor schedule for the provider's independent merchant payment processing | Necessary referral and relationship information follows the actual controller role | Customer contracts directly with its selected payment provider. No card-number or security-code collection is authorised through the AI Assistant or ordinary enquiries |
A3. Flow and instructions
For the ordinary CRM/text profile: a visitor or customer submits an enquiry or message; the supplier-hosted system stores it and carries out the selected workflow; authorised customer users and, where necessary for service delivery, David or Don access it. Replies and booking links use the selected channel. Information is not routinely copied into First Essential email or Drive; login-verification and submitted-form notifications are exceptions. Any customer-specific notification containing form data, attachment or export must be included in its deployment record.
The customer approves its business information, scripts, intended actions, lawful collection and communications instructions. First Essential implements and tests the agreed configuration and remains responsible for its own work. Material changes are recorded through the same authorised email or signed change route; an instruction to add a feature does not silently authorise excluded data or training.
Our standard instructions prohibit using customer content for our own marketing, general-purpose model training or customer-specific fine-tuning. Provider settings and applicable terms must support that instruction. Supplier-hosted delivery is not proof that every optional provider is enabled or that all possible provider uses are disabled.
Annex B. Security and operational measures
The distinction between First Essential's reported practice, the supplier's documented capability and an unverified deployment setting is retained in this schedule.
| Area | Completed standard description | Scope and evidence |
|---|---|---|
| Internal access | David and Don handle UK customer access. Separate logins are used on most systems. Most accounts use 2FA or additional email/phone/authenticator verification | David's confirmations, 7 September 2026. This does not certify universal MFA coverage or every customer's permissions |
| Permissions and customer separation | Access is limited to authorised service work. The selected platform's tenant and user roles are used for the ordered deployment | Supplier capability and actual account permissions are separate; no cross-tenant penetration test is asserted |
| Hosting and transport security | Supplier-managed infrastructure provides the platform's hosting, transport and stored-data controls | Reference the selected supplier's security documentation and its agreed terms. No claim that First Essential itself holds the supplier's certification |
| Confidentiality | Clause 5 requires authorised people to keep Processor Data confidential and restrict their access to permitted work | No invented signed staff undertaking or training certificate is recorded |
| Incident response | Don leads; David covers. Contain access or exposure, record the time and facts, notify the affected customer without undue delay from awareness, investigate and provide updates | Normal support hours do not suspend incident duties. Provider confirmation is not a reason to reset the awareness time |
| AI testing | Test different phrasings of the same question against the approved answer and intended action; check accuracy and consistency | Existing practice reported by David; this document does not fabricate a dated test result for every agent |
| Fault containment | Make the faulty assistant unavailable externally while retaining internal investigation access; inform the customer, correct the cause, add safeguards and retest before reactivation | If repair is impractical, rebuild and remove the obsolete agent to reduce accidental reuse. Hiding an agent must cover its actual external routes |
| Changes and deletion checks | Test new features or integrations; check the visible remaining links and records after deleting an agent or integration | Reported practice. Deleting an agent does not prove complete backend erasure of related contacts or conversations |
| Logs | Use available platform audit and security records for investigation | The CRM supplier documents 60-day audit-log retention. Other application, call and security logs must not be assumed to use the same cycle |
| Recovery | Hosting backup and restore points are reported available. Supplier recovery capabilities vary by record and feature | No universal agent recovery, zero data loss, recovery time or recovery point is promised. Annex D distinguishes contact restoration, agent deletion and infrastructure backups |
| Rights and deletion requests | Identify the customer and affected records, use the relevant platform search/export/delete functions, include notifications or authorised copies, and record limitations and outstanding supplier action | Do not describe removal from the visible interface as a certificate of final deletion |
Annex C. Supplier and transfer schedule
C1. Authorisation
The order must identify the named supplier schedule provided with it and the written authorisation required by clause 7. Names needed for contractual data-processing authorisation can be supplied privately; they need not replace First Essential product branding on marketing pages. This specimen does not pretend that a particular customer has already received or accepted the schedule.
C2. Standard CRM/text supplier profile
| Field | Recorded position |
|---|---|
| Direct service provider | Third-party CRM and text AI platform provider. The legal entity and applicable processing terms are identified in the customer-specific supplier register supplied before processing begins. |
| Function | Supplier-hosted CRM and selected communications / AI Assistant features behind First Essential One |
| Role | Subprocessor when First Essential processes on the business customer's behalf |
| Location evidence | Supplier security documentation identifies United States hosting infrastructure. An EU-only account location is not asserted |
| Underlying infrastructure | Supplier documents Google Cloud and Amazon Web Services. Its full onward list also contains optional feature providers; the deployment record must distinguish the applicable chain from mere catalogue availability |
| Published contract route | July 2026 Addendum, including its UK transfer provisions, subject to evidence of the terms applicable to First Essential's account |
| Transfer record | Record the applicable exporter/importer entities and UK safeguard with the accepted account terms; attach the required transfer assessment. A public DPA link is not evidence that a deployment assessment was completed |
| Change monitoring | Don's technical administration and David's cover must monitor supplier notices and handle the customer notice/authorisation process in clause 7 |
Voice supplier: no production authorisation is added while the final contract with our third-party voice AI service provider remains unsigned. Payment providers, insurers and accountants are not automatically entered as subprocessors for every customer; their roles follow their actual activity. Other website hosts or integrations enter this schedule only for the customer's selected service.
C3. Source record
Provider contract and feature evidence checked 7 September 2026 is recorded in the internal completion record. Account-specific terms, chosen features, any further supplier identities and the corresponding transfer instrument must accompany the particular deployment. This standard profile does not list every optional AI/model provider as enabled.
Annex D. Retention, return and recovery
D1. Standard instructions and supplier behaviour
| Record or process | Instruction / documented behaviour | Limitation |
|---|---|---|
| Active CRM contacts, enquiries and conversations | Retain while needed for the customer's permitted purpose; review on closure, customer instruction and service exit. First Essential uses manual review and platform functions; it has not configured a universal automatic deletion rule | The deployment record specifies the customer's retention criterion and any chosen fixed period. A platform's maximum is not automatically the customer's instruction |
| Deleted CRM contacts | Supplier documents a 60-day restoration window, including associated items described in its contact-restore guide | Separately deleted related records may be excluded. This is a restore window, not an instruction to keep active records for 60 days |
| CRM audit logs | Supplier documents a rolling 60-day period followed by purge | Does not establish retention for every operational or security log |
| Conversation AI agent deletion | Supplier's delete-agent API describes permanent removal of the agent configuration and associated history | Other separately held customer contacts and records must be assessed independently. Do not promise recovery of a deleted agent |
| Database backups | Supplier security documentation describes daily backups with seven days of history | Not a universal final erasure deadline. Its DPA separately addresses isolated archived backups without a single numerical deadline |
| Form notifications, support records and authorised exports | Include actual email contents, attachments and other authorised copies in the search and deletion action | Login verification is different from enquiry content. No routine Drive copy is assumed |
| Voice records | Not activated by this schedule | Final contract and selected retention, soft/hard deletion, export and backup behaviour remain a voice activation dependency |
| Kiosk/EPOS/local-device data | Not selected by this standard profile | Complete only for the actual ordered deployment; independent payment-provider records remain under that provider's arrangement |
D2. End-of-service procedure
The Customer chooses return followed by deletion, or deletion without return, as required by clause 12. Its written instruction and the practical export/deletion plan are retained with the order. Before service exit, First Essential identifies the records, available export format, secure recipient, necessary access window and applicable supplier deletion route. Extra transition work and charges require the agreement described in the Terms; mandatory duties are not conditional on buying extra support.
Record active deletion separately from contact-restoration expiry and backup isolation. Report remaining copies, the reason they remain and the applicable deletion cycle; ask the supplier to complete any action unavailable in the interface. Do not treat cancellation of First Essential's entire supplier agency account as the route for deleting one customer's data. Do not give a deletion certificate stating that all copies are erased while identified recoverable or archived copies remain.
A fixed final backend/backup deadline, a customer-specific export deadline and legal retention exceptions may be stated only where supported by that deployment's contract and verified capability. No arbitrary 14-day, 30-day, 90-day or 24-month erasure promise is introduced here.