Data Processing Agreement

You do not need to sign anything separately: this agreement applies automatically from the moment you start using Holp to process personal data. If your procurement process needs a countersigned copy, email [email protected] and we will send one.

In this document, “you” means the Holp customer, “we” and “Holp” mean Holp Ltd, and the terms “controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” carry the meanings given to them in UK GDPR.

Who is what

For conversations between your assistant and your website visitors, and for the knowledge content you upload, you are the controller and Holp is your processor. You decide what the assistant knows, how long conversations are kept and who on your team reads them. We process that data only on your instructions.

Separately, we are a controller in our own right for your account, billing and support records. That processing is not covered by this agreement; it is covered by the privacy policy.

Your instructions

Your documented instructions are: this agreement, the subscriber terms, and the settings and configuration you choose inside the product, including the retention window you set on each assistant. We will not process personal data for any other purpose. If we think an instruction breaches data protection law, we will tell you promptly and may pause that processing until it is resolved.

How long it lasts

This agreement starts when you first use Holp to process personal data and runs for as long as we hold personal data on your behalf, which is a little longer than your subscription because of the deletion windows in section 8.

Article 28(3) requires this to be set out specifically rather than described in general terms, so here it is.

We will:

• Process personal data only on your documented instructions, including for transfers out of the UK, unless the law requires otherwise, in which case we will tell you first unless the law prohibits it.
• Make sure everyone we authorise to process your data is under a duty of confidentiality, and that access is limited to those who need it to do their job.
• Put in place the security measures in section 5, as required by Article 32.
• Respect the sub-processor conditions in section 4.
• Help you respond to data subjects who exercise their rights, taking into account the nature of the processing. In practice you can find, export and delete conversations yourself from the Conversations screen, and where you cannot, we will do it for you.
• Help you meet your own obligations under Articles 32 to 36: security, breach notification, data protection impact assessments and prior consultation with the ICO.
• Delete or return personal data at the end of the agreement, as set out in section 8.
• Make available the information you need to demonstrate compliance, and submit to audits, as set out in section 9.

We will not sell your data, share it for advertising, or use it to train AI models. Neither will the AI providers: we hold zero data retention terms with them.

You give us general authorisation to use the sub-processors listed below. Each is bound by written terms that are no less protective than this agreement, and we remain fully liable to you for what they do.

Changing the list

We will give you at least 30 days’ notice by email before adding or replacing a sub-processor that handles personal data on your behalf. Within those 30 days you may object on reasonable data protection grounds. We will work with you to find a way round it, and if we cannot, you may terminate the affected part of the service without penalty and we will refund the unused portion of what you have paid.

Taking into account the state of the art, the cost of implementation, and the risk to the people whose data this is, we maintain the following technical and organisational measures.

We review these measures periodically and may improve them, but we will not reduce the overall level of security during the term of this agreement.

If a personal data breach affects data we process for you, we will tell you without undue delay, and in any event within 48 hours of becoming aware of it.

We will tell you what we know at the time: what happened, which categories of data and roughly how many people are affected, what the likely consequences are, and what we are doing about it. Where we cannot give you everything at once, we will send it in stages rather than wait until the picture is complete.

Deciding whether to notify the ICO or the affected individuals is your call as controller, and the clock on your own 72-hour obligation is yours to manage. We will give you the information you need to make that decision and to make the notification.

We will not make a public statement identifying you in connection with a breach without discussing it with you first, unless the law requires it.

Everything we store in the platform is hosted in the United Kingdom. The transfers out of the UK are the ones you can see in the sub-processor table in section 4, and they happen because the AI models, the search index and some supporting services are operated abroad.

For those transfers we rely on the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment covering the safeguards each provider has in place. If a transfer mechanism we rely on is invalidated, we will work with you on a replacement without undue delay, and if there is not one, you may terminate the affected part of the service.

While your account is open

You control retention. Conversations can be deleted at any time from the dashboard, and each assistant can be given a retention window: keep conversations forever, or for 30, 60 or 90 days, six months, one year or two years. Conversations left idle for longer than the window you choose are permanently deleted overnight, transcripts, notes and analytics links included. Leads a visitor has given you stay in your Leads list, since deleting those is a separate decision and we will not make it for you.

When you leave

You can export your conversations and leads from the Conversations screen at any time, and we would encourage you to do that before you close an account.

When this agreement ends, we will delete the personal data we hold on your behalf: from live systems within 30 days, and from backups within 90 days. If you would rather have it returned than deleted, tell us within 30 days of closing the account and we will provide it in a machine-readable format.

The exception is anything we are required by law to keep, such as billing records, which we retain for six years for tax purposes. Those records are held under the privacy policy, as controller, not under this agreement.

Once deleted it is gone, and we cannot recover it for you.

We will make available to you the information reasonably needed to demonstrate that we are meeting our obligations under Article 28. In most cases that means answering a security questionnaire, which we are happy to do.

Beyond that, you may audit us once in any twelve-month period, on at least 30 days’ written notice, during business hours, in a way that does not disrupt the service or expose another customer’s data. You may use an independent auditor provided they are not a competitor of ours and they sign a confidentiality undertaking. You bear the cost of the audit, unless it finds a material breach of this agreement, in which case we bear it.

Where we hold a relevant third-party certification or report, we may offer that first, and you will accept it if it reasonably answers the question.

An additional audit may be carried out if the ICO requires it, or following a personal data breach affecting your data.

As controller, it is on you to:

• Have a lawful basis for the conversations your assistant holds and for any leads you capture.
• Mention the chat in your own privacy notice, and say that a processor handles it.
• Tell your visitors what the chat stores on their device, so they can find it in your cookie notice.
• Answer requests from your visitors about their data. If one comes to us, we will refer them to you and tell you it happened.
• Not upload personal data into the assistant’s knowledge that has no business being there, and not use the chat to collect special category data.
• Keep your own account access under control, since anyone you invite can read the conversations.

You confirm that your instructions to us comply with data protection law, and that you have the authority to give them.

Precedence

This agreement forms part of the subscriber terms. Where our documents disagree, this is the order of precedence, highest first:

1. any order form or enterprise agreement we have both signed;
2. this data processing agreement, on anything to do with data protection;
3. the subscriber terms;
4. the terms of use.

So this agreement wins on data protection, and the commercial documents win on everything else.

Liability

Liability under this agreement is subject to the limits and exclusions in the subscriber terms, and the cap there applies across those terms, the terms of use and this agreement taken together rather than separately to each. Nothing here limits either side’s liability to a data subject, or the ICO’s ability to act against either of us.

Changes

We may update this agreement to reflect a change in the law, in the service, or in our sub-processors. For anything that materially affects your rights we will give you at least 30 days’ notice by email.

Governing law

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Contact

Last updated: 24 August 2026.

Related

• Privacy policy
• Subscriber terms
• Terms of use
• Cookie policy