UTOMAT

Legal

Data Processing Agreement

Last updated: 29 June 2026

This Data Processing Agreement ("DPA") applies when I, Mario Lucas (trading as Utomat, "Processor"), process personal data on behalf of a business client ("Controller") as part of delivering AI automation services.

This DPA forms part of the service agreement between Utomat and the Controller, and supplements it where personal data processing is involved. If you need a signed version for your records, email mario@utomat.com.

1. Definitions

"Personal data", "processing", "data subject", "controller", and "processor" have the meanings given in the EU General Data Protection Regulation (2016/679) ("GDPR").

2. Role of the parties

The Controller determines the purposes and means of processing. Utomat processes personal data only on the Controller's documented instructions, including those set out in the service agreement.

3. What Utomat processes on your behalf

The categories of personal data and data subjects processed will depend on the specific service engaged, but typically include:

  • Names, phone numbers, and email addresses of the Controller's customers or leads (for voice agent and lead routing services)
  • Interaction logs from AI-assisted conversations
  • Booking and enquiry data passed to or from the Controller's systems

Utomat will not process personal data beyond what is necessary to deliver the agreed service.

4. Utomat's obligations

Utomat will:

  • Process personal data only on documented instructions from the Controller
  • Ensure that any staff or contractors with access to personal data are bound by appropriate confidentiality obligations
  • Implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure
  • Assist the Controller in responding to data subject rights requests (access, rectification, erasure, portability, objection) where the data is held by Utomat
  • Notify the Controller without undue delay (and in any case within 72 hours) upon becoming aware of a personal data breach
  • Delete or return all personal data to the Controller upon termination of the service, at the Controller's choice
  • Make available all information reasonably necessary to demonstrate compliance with this DPA

5. Sub-processors

Utomat uses the following sub-processors in delivering its services. Each is bound by data processing terms no less protective than this DPA:

  • Vercel — infrastructure hosting (US, SCCs apply)
  • Sanity — content and data management (US, SCCs apply)
  • OpenAI / Anthropic — AI model inference (US, SCCs apply) — used only where AI processing is part of the agreed service
  • n8n — workflow automation (EU cloud or self-hosted depending on deployment)

I will notify the Controller of any intended addition or replacement of sub-processors with at least 14 days' notice. The Controller may object on reasonable data protection grounds within that period.

6. International transfers

Where personal data is transferred outside the European Economic Area, Utomat will ensure an appropriate safeguard is in place — Standard Contractual Clauses, adequacy decision, or equivalent — before the transfer takes place.

7. Security measures

Utomat implements the following measures as standard:

  • Encryption of data in transit (TLS) and at rest where technically feasible
  • Access controls limiting data access to those who need it to deliver the service
  • Regular review of access permissions
  • Use of reputable, security-audited cloud infrastructure

8. Term and termination

This DPA remains in force for the duration of the service agreement. Upon expiry or termination, Utomat will delete or return all personal data processed on the Controller's behalf within 30 days, unless retention is required by applicable law.

9. Governing law

This DPA is governed by the laws of the Republic of Cyprus and the GDPR as applicable in Cyprus. Disputes will be subject to the exclusive jurisdiction of the courts of Cyprus.

10. Contact

For any questions relating to this DPA, or to request a signed copy, contact Mario Lucas at mario@utomat.com.