This addendum forms part of the agreement between you and AIS Insights, and applies whenever we process personal data on your instructions. If anything here conflicts with the rest of the agreement, this addendum wins on data protection.
1. Who this is between
AIS Insights is the trading name of AIS Insights Limited, a company registered in England and Wales under company number 17513349, whose registered office is at Office 2138, 60 Tottenham Court Road, Fitzrovia, London W1T 2EW.
“You” is the organisation subscribing to AIS Insights. “We” and “us” is AIS Insights. “Data protection law” means the UK GDPR, the Data Protection Act 2018, and the EU GDPR where it applies to you. Terms such as controller, processor, personal data, processing and personal data breach carry the meanings they have in that law.
2. Which of us is responsible for what
For the personal data inside your workspace, you are the controller and we are the processor. You decide what is tracked and why, and we act on your instructions. Annex 1 sets out the subject matter, duration, nature, purpose, types of data and categories of people.
For some data we are the controller in our own right, not your processor: your users’ account records, our billing and accounting records, and our product analytics and error monitoring. Our privacy notice covers those, and this addendum does not.
You confirm that you have a lawful basis for the data you put into the service and for the brands and prompts you ask us to track, and that you have given the people concerned whatever information the law requires. Answering requests from people whose data is in your workspace, including people named in AI answers collected for your projects, is your responsibility.
3. What we will and will not do with your data
- We process your personal data only on your documented instructions. Your use of the product, and this addendum, are those instructions. If the law compels us to process it otherwise, we will tell you first unless the law forbids us from saying so.
- We will tell you if we think an instruction breaks data protection law.
- Everyone we let near your data is under a duty of confidentiality.
- We do not sell your data, use it for our own marketing, or use it to train AI models.
4. Other companies we use
You give us general authorisation to engage sub-processors. The current list is in section 5 of our privacy notice, and Annex 3 refers to it so there is only ever one list to keep accurate.
Before a new sub-processor starts handling your data, we will give you 14 days’ notice by email to your workspace owner. If you have a reasonable data protection objection, tell us within that time. If we cannot resolve it, your remedy is to stop using the affected part of the service or end the agreement, and we will refund any fees you have prepaid for the period after it ends.
Each sub-processor is bound by written terms that give the protection data protection law requires, and we remain responsible to you for what they do, within the limits in section 11.
5. Where the data goes
Your workspace data is held in our primary database in London, in the United Kingdom. Some sub-processors operate from the United States. Where personal data is transferred outside the UK, it relies on a transfer mechanism the law allows, such as the UK Extension to the EU-US Data Privacy Framework, or the standard contractual clauses with the UK International Data Transfer Addendum. Transfers from the European Economic Area to our UK systems rely on the European Commission’s adequacy decision for the United Kingdom.
6. Security
We keep appropriate technical and organisational measures in place to protect your data, taking account of the state of the art, the cost, and the risk to the people concerned. Annex 2 describes what those are today. We may change them, but not in a way that materially weakens protection.
7. Helping you answer people’s requests
If one of your users asks us directly to access, correct, delete or export their data, we will not answer for you. We will pass the request to you promptly and wait for your instructions.
Taking account of the nature of the processing and the information available to us, we will give you reasonable help to respond, mainly through the product’s own tools. We will also give you reasonable help with data protection impact assessments and any consultation with a regulator, so far as the information is ours to give. We may charge you reasonable costs for help that goes beyond the product’s own tools.
8. If there is a breach
If we become aware of a personal data breach affecting data we process for you, we will notify you without undue delay after becoming aware of it.
We will tell you what happened, the categories and approximate number of records affected, the likely consequences, and what we have done about it, giving you what we have at the time and the rest as we learn it. You decide whether to notify a regulator or the individuals, because you are the controller and the clock is yours. We will give you the information we reasonably can to support it. Notifying you is not an admission of fault or liability. Your contact for all of this is privacy@aisinsights.com.
9. Getting your data back, and deletion
You can export your data through the product at any time during the subscription, and that export is how we return it to you, so export what you need before the agreement ends.
When the agreement ends, we delete your personal data within 90 days. We may keep data where the law requires it, in which case we keep it only for as long as we have to and carry on protecting it under these terms. Backups age out on their own cycle and are not restored into live use.
10. Showing you we are doing this
We will make available the information you reasonably need to show that we meet our obligations under this addendum. If that information is not enough to show it, or a regulator requires it, you may audit us, or have an independent auditor bound by confidentiality do it, no more than once a year. Give us 30 days’ notice, keep the findings confidential, and do not disrupt the service. Audits are at your cost, and we may charge you reasonable costs for our time.
11. Liability and governing law
The liability limits in the main agreement apply to this addendum, and one cap covers the agreement and this addendum together, except where data protection law says it cannot. You will indemnify us against any claim or fine that arises from your instructions, or from data you had no lawful basis to put into the service. This addendum is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, without affecting any right anyone has to complain to a regulator or bring a claim where they live.
12. Accepting this addendum
This addendum takes effect when you start using the service and needs no signature. If your procurement process needs a signed copy, email privacy@aisinsights.com and we will send you one. On self-serve plans we do not sign customers’ own data processing templates.
Annex 1. What we process for you
- Subject matter. Providing the AIS Insights AI search visibility service.
- Duration. The term of your subscription, plus the deletion period in section 9.
- Nature and purpose. Hosting, storing, analysing and displaying the data in your workspace: running the prompts you configure against AI models, parsing the answers, and reporting on them. Sending the notifications and reports you ask for.
- Types of personal data. Names, work email addresses, job roles and organisation membership for the people you invite. Their product usage and settings. Any personal data contained in the free text you enter, and any that appears in the AI answers and cited pages we collect for your projects.
- Categories of people. Your staff and anyone else you invite to your workspace. People who happen to be named in the AI answers and public pages collected for your projects.
- Special category data. Not requested and not required. Please do not put it into the service. AI answers are unstructured text and could contain it incidentally. If you find any, tell us and we will delete it.
Annex 2. How we protect it
- Encryption in transit and at rest.
- Row-level security in the database, so one workspace’s data is separated from another’s at the data layer rather than only in the application.
- Access limited to the people who need it, with multi-factor authentication on administrative accounts and an audit log of administrative actions.
- Session replay configured to mask all text and block all images, so diagnostics do not capture what your users typed.
- Error and availability monitoring, with alerting.
- Change control through version-controlled code review and automated checks before release.
- A documented personal data breach procedure, with a named decision-maker.
- Managed, redundant infrastructure with regular backups.
Annex 3. Sub-processors
The current list, with what each one does, is in section 5 of our privacy notice. Changes are notified under section 4.
Questions about this addendum? Contact us or email privacy@aisinsights.com.