Scope and roles
This addendum applies to personal data belonging to your customers and callers which Wepickup processes on your behalf. For that data you are the controller and Wepickup is the processor.
It does not apply to your own account data, for which Wepickup is the controller and the privacy policy applies.
Subject matter and duration
The subject matter of the processing is the operation of an AI telephone assistant for your business. Processing continues for as long as your account is active, and ends when your account is closed or you request deletion.
Nature and purpose
Personal data is processed in order to answer calls to your business, understand what the caller wants, look up your business data, create orders and bookings, send confirmations, and give you a record of the conversation.
Categories of data and data subjects
Data subjects are the people who call your business. The categories processed are:
- Contact data: telephone number and any name given on the call.
- Conversation data: call audio where recording is enabled, and the transcript.
- Transaction data: orders, bookings, values, times and any notes captured during the call.
- Where you choose to configure it, delivery address or postcode information used to calculate a delivery fee.
Our obligations
Wepickup will:
- Process personal data only on your documented instructions, which include your configuration of the service.
- Ensure that personnel with access are bound by confidentiality.
- Implement appropriate technical and organisational measures, including workspace isolation, encryption of credentials at rest, HTTPS in transit and time-limited retention of call recordings.
- Assist you, taking account of the nature of the processing, in responding to requests from data subjects and in meeting your security, breach notification and impact assessment obligations.
- Notify you without undue delay on becoming aware of a personal data breach affecting your data.
- Delete or return personal data at the end of the service, subject to any retention required by law.
Sub-processors
You authorise Wepickup to engage sub-processors for telephony, voice and language processing, hosting and database services, payment processing, calendar connections you choose to make, and email delivery. Each is engaged under terms no less protective than those in this addendum.
We will give you notice of an intended change to the sub-processor list, and you may object on reasonable data protection grounds. The current list is available on request from support@wepickup.app.
International transfers
Where personal data is transferred outside the United Kingdom or the European Economic Area, the transfer is made under the safeguards required by applicable law.
Audit
We will make available the information reasonably necessary to demonstrate compliance with this addendum and will contribute to audits conducted by you or an auditor you appoint, on reasonable notice and subject to confidentiality.
Status of this document
This addendum is published in advance of launch and the contracting entity is still being confirmed. If your procurement process requires a signed copy, email support@wepickup.app and we will tell you the current position.