Data processing addendum

1. Parties and scope

This addendum applies where Ross Gallagher trading as Omnirexis, of Bartle House, 9 Oxford Court, Manchester M2 3WQ (“we”), processes personal data on behalf of a business client (“you”) when providing our services. You are the controller and we are the processor of that personal data.

This addendum forms part of our terms and conditions or of the proposal or quote agreed with you. It does not apply to personal data we hold as a controller, which is covered by our privacy policy.

2. Details of the processing

• Subject matter: providing our automation, enquiry follow-up, content and software services to you.
• Duration: for as long as we provide the services, and then as set out in section 9.
• Nature and purpose: collecting, storing, organising, retrieving and sending personal data so the services work as agreed with you.
• Types of personal data: contact and enquiry details (such as names, email addresses, phone numbers and messages) and any data you upload to or connect with our services.
• Data subjects: your customers and leads.

3. Your instructions

We process the personal data only on your documented instructions, including these terms, the proposal and how you configure the services, unless the law requires otherwise. If the law requires us to process it in another way, we will tell you first unless the law forbids that. We will tell you if we think an instruction breaks data protection law.

4. Confidentiality and security

Anyone we authorise to process the personal data is bound by a duty of confidentiality. We take appropriate technical and organisational measures to protect it, as required by Article 32 of the UK GDPR.

5. Sub-processors

You give us general authorisation to use sub-processors. We will tell you before we add or replace a sub-processor, so you can object. We put data protection terms in place with each sub-processor that give the same protection as this addendum, and we remain responsible to you for their work. Our current sub-processors are:

• Vercel Inc. (United States): website and application hosting, with servers in the United States and Germany.
• Supabase Inc.: database and user accounts for Omnirexis PT, hosted in the London region (United Kingdom).
• Resend Inc. (United States): sending email.
• Stripe: payment processing for subscriptions.

Any other sub-processors needed for a particular project are named in the proposal. This list may change, and we will notify you of changes.

6. Data subject rights

Taking into account the nature of the processing, we will help you, with appropriate measures and where possible, to respond to requests from data subjects exercising their rights.

7. Helping you meet your obligations

We will help you meet your obligations under Articles 32 to 36 of the UK GDPR, covering security, personal data breaches, data protection impact assessments and prior consultation with the Information Commissioner, taking into account the nature of the processing and the information available to us.

8. Personal data breaches

We will tell you without undue delay after we become aware of a personal data breach affecting your personal data, and give you the information you reasonably need to meet your own obligations.

9. End of the services

When the services end, you can ask us to return or export your personal data within 30 days. After that we delete it from our live systems, unless the law requires us to keep it. Copies in backups expire in line with our providers’ standard backup cycles.

10. Audits and information

We will make available to you the information reasonably needed to show that we meet our obligations under Article 28 of the UK GDPR, and allow for and contribute to audits, including inspections, carried out by you or an auditor you appoint, on reasonable notice.

11. International transfers

We only transfer personal data outside the United Kingdom where appropriate safeguards are in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or where the destination has UK adequacy regulations.

12. Governing law

This addendum is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.

13. Contact

Questions about this addendum? Email hello@omnirexis.co.uk.