1. Introduction and Scope
1.1 This Data Processing Agreement (“DPA”) forms part of the agreement between Pulsium Limited (“Pulsium”, “we”, “us”) and the customer identified in that agreement (“Customer”, “you”) for the provision of the Pulsium platform and services (“the Services”).
1.2 This DPA applies where Pulsium processes personal data on the Customer’s behalf in the course of providing the Services.
1.3 Pulsium Limited is registered in England and Wales, company number 17168349, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
1.4 Where there is any conflict between this DPA and the client agreement, this DPA takes priority in respect of the processing of personal data.
2. Definitions
2.1 “Data Protection Law” means the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any legislation that amends or replaces them.
2.2 “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” have the meanings given in Data Protection Law.
2.3 “Customer Personal Data” means personal data that Pulsium processes on the Customer’s behalf under this DPA, as described in Annex 1.
2.4 “Sub-Processor” means any third party engaged by Pulsium to process Customer Personal Data.
3. Roles of the Parties
3.1 The Customer is the Controller of Customer Personal Data. Pulsium is the Processor.
3.2 Pulsium is an independent Controller of personal data relating to the Customer’s own account, billing, and its authorised users’ use of the platform. That processing is described in the Pulsium Privacy Policy and is not governed by this DPA.
3.3 The Customer confirms that it has a lawful basis for the processing it instructs Pulsium to carry out.
4. Details of Processing
4.1 The subject matter, duration, nature, purpose, types of personal data and categories of Data Subject are set out in Annex 1.
4.2 Processing continues for the term of the client agreement and for any retention period the Customer has selected.
5. Pulsium’s Obligations
5.1 Pulsium shall process Customer Personal Data only on the Customer’s documented instructions, which are given by the client agreement, this DPA, and the Customer’s configuration of the Services.
5.2 Pulsium shall immediately inform the Customer if, in its opinion, an instruction infringes Data Protection Law.
5.3 Pulsium shall not process Customer Personal Data for its own purposes.
5.4 Where Pulsium is required by law to process Customer Personal Data other than on the Customer’s instructions, it shall inform the Customer of that legal requirement before processing, unless the law prohibits it from doing so.
6. Confidentiality
6.1 Pulsium shall ensure that every person authorised to process Customer Personal Data is subject to a binding duty of confidentiality.
6.2 Access to Customer Personal Data is limited to personnel who require it to deliver or support the Services.
7. Security
7.1 Pulsium shall implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing.
7.2 The measures in place are described in Annex 2.
7.3 Pulsium may update these measures provided the level of protection is not reduced.
8. Sub-Processors
8.1 The Customer gives Pulsium general authorisation to engage Sub-Processors.
8.2 The Sub-Processors engaged at the date of this DPA are listed in Annex 3.
8.3 Pulsium shall impose on each Sub-Processor, by written contract, data protection obligations no less protective than those in this DPA.
8.4 Pulsium remains fully liable to the Customer for the performance of each Sub-Processor’s obligations.
8.5 Pulsium shall give the Customer at least 30 days’ notice before adding or replacing a Sub-Processor. The Customer may object on reasonable data protection grounds within that period. Where the parties cannot resolve the objection, the Customer may terminate the affected Services without penalty.
8.6 The current Sub-Processor list is published in the Pulsium Privacy Policy at pulsium.ai.
9. International Transfers
9.1 Pulsium processes Customer Personal Data in the United Kingdom and the European Economic Area wherever possible. The Pulsium application, database, file storage, encryption key management and knowledge base index run in Google Cloud’s London region.
9.2 Where Customer Personal Data is transferred outside the United Kingdom, Pulsium shall ensure the transfer is subject to the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses, together with a transfer risk assessment where one is required.
10. Assistance with Data Subject Rights
10.1 Pulsium shall provide the Customer with functionality within the Pulsium Workspace to access, export, correct and delete Customer Personal Data.
10.2 Where a Data Subject contacts Pulsium directly, Pulsium shall not respond substantively but shall forward the request to the Customer without undue delay.
10.3 Pulsium shall provide reasonable assistance to the Customer in responding to Data Subject requests, taking account of the nature of the processing and the information available to Pulsium.
11. Personal Data Breach
11.1 Pulsium shall notify the Customer without undue delay, and in any event within 48 hours, of becoming aware of a Personal Data Breach affecting Customer Personal Data.
11.2 The notification shall describe, so far as known, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed.
11.3 Pulsium shall provide reasonable assistance to the Customer in meeting its own notification obligations to a Supervisory Authority or to Data Subjects.
11.4 Pulsium shall not notify a Supervisory Authority or any Data Subject of a breach affecting Customer Personal Data on the Customer’s behalf unless the Customer instructs it to do so.
12. Data Protection Impact Assessments
12.1 Pulsium shall provide reasonable assistance to the Customer with data protection impact assessments and with any prior consultation with a Supervisory Authority, taking account of the nature of the processing and the information available to Pulsium.
13. Audit and Information
13.1 Pulsium shall make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR.
13.2 Pulsium shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it appoints.
13.3 Audits shall be conducted on at least 30 days’ written notice, no more than once in any 12 month period unless a Personal Data Breach has occurred, during business hours, and in a manner that does not disrupt Pulsium’s operations. The Customer bears its own costs.
13.4 Pulsium may satisfy an audit request by providing current third party certifications or audit reports.
14. Retention, Return and Deletion
14.1 The Customer selects the retention period for conversations handled by its agents: 30, 60 or 90 days, or no retention. Where no selection is made, the default is 30 days. An automated daily process deletes data that has passed the selected period.
14.2 A conversation the Customer archives is retained until the Customer deletes it. A conversation the Customer moves to the bin is permanently deleted 30 days later.
14.3 The Customer may export its data at any time during the term through the Pulsium Workspace.
14.4 On termination of the client agreement, Pulsium shall, at the Customer’s choice, return or delete all Customer Personal Data and delete existing copies, unless required by law to retain it.
14.5 Where the Customer makes no choice within 30 days of termination, Pulsium shall delete the Customer Personal Data.
15. Customer Obligations
15.1 The Customer shall ensure it has a lawful basis for the processing it instructs, and shall provide all notices and obtain all consents required from Data Subjects.
15.2 Where the Customer uses the Services to record or assess calls handled by its own employees, the Customer is responsible for establishing a lawful basis for that monitoring, for informing its employees, and for meeting any consultation or notification obligations that apply to it.
15.3 The Customer shall inform Pulsium in writing before instructing any processing of special category personal data as defined in Article 9 of the UK GDPR, including health data, so that appropriate additional measures can be agreed.
15.4 The Customer is responsible for any call recording notice or artificial intelligence disclosure required by its own regulator or industry.
16. Use of Data for Artificial Intelligence Model Training
16.1 Pulsium does not use Customer Personal Data, including conversations, recordings, transcripts or business data, to train artificial intelligence models.
16.2 Pulsium’s artificial intelligence providers are contractually prohibited from using Customer Personal Data to train their models.
17. Liability
17.1 Each party’s liability under this DPA is subject to the limitations and exclusions set out in the client agreement.
17.2 Nothing in this DPA limits either party’s liability where Data Protection Law does not permit that liability to be limited.
18. Term and Termination
18.1 This DPA takes effect on the date the client agreement takes effect and continues for as long as Pulsium processes Customer Personal Data.
18.2 Clauses that by their nature should survive termination, including clauses 6, 14 and 17, survive termination.
19. Governing Law
19.1 This DPA is governed by the laws of England and Wales.
19.2 The courts of England and Wales have exclusive jurisdiction over any dispute arising from it.
Annex 1: Details of Processing
| Item | Detail |
|---|---|
| Subject matter | The provision of the Pulsium platform and artificial intelligence agent services to the Customer. |
| Duration | The term of the client agreement, plus the retention period selected by the Customer. |
| Nature and purpose | Receiving, handling and recording customer conversations across voice, SMS, WhatsApp, email and web chat. Producing transcripts, summaries, quality scores and follow up actions. Scheduling appointments and updating records in the systems the Customer connects. Where subscribed, analysing conversations to produce business intelligence and quality assurance reporting. |
| Categories of Data Subject | The Customer’s customers, patients, clients and enquirers. The Customer’s employees and contractors. The Customer’s authorised platform users. |
| Types of Personal Data | Names. Telephone numbers. Email addresses. Postal addresses. Appointment and booking details. The content of telephone calls, messages and emails. Audio recordings and transcripts of calls. Quality scores and coaching notes relating to the Customer’s employees. Any other personal data the Customer or a Data Subject chooses to include in a conversation. |
| Special category data | Not processed unless the Customer has notified Pulsium in writing under clause 15.3. Where notified, this may include health data where the Customer operates in a healthcare setting. |
Annex 2: Technical and Organisational Measures
| Encryption | Customer Personal Data is encrypted in transit and at rest. Credentials for connected systems are encrypted with a key unique to each credential and bound to the Customer’s account. |
| Access control | Permissions are enforced on the server for every request rather than in the client application. Access is granted on a least privilege basis and reviewed periodically. |
| Infrastructure | The application, database, file storage, encryption key management and knowledge base index run in Google Cloud’s London region. |
| Segregation | Customer data is logically segregated by tenant, and every request is checked against the requesting user’s tenant and permissions. |
| Authentication | Platform access requires individual named accounts. |
| Monitoring and logging | Platform activity, sign in history and administrative actions are logged. |
| Deletion | An automated daily process permanently deletes conversation data that has passed the Customer’s selected retention period. |
| Personnel | All personnel with access to Customer Personal Data are subject to a binding duty of confidentiality. |
| Certification | Pulsium is certified under the UK government backed Cyber Essentials scheme, with the whole company in scope, valid to 1 August 2027. |
| Resilience | Data is held in managed cloud services with the resilience and backup characteristics of those services. |
Annex 3: Approved Sub-Processors
| Sub-processor | Purpose |
|---|---|
| Google Cloud Platform | Application hosting, database, file storage and encryption key management, and the artificial intelligence models that understand and generate conversation content. |
| Twilio | Telephone numbers and the voice network that carries calls to and from agents. |
| Stripe | Subscription billing and payment processing. |
| Nango | Connection broker used when the Customer links its own business software to Pulsium. |
| Firecrawl | Retrieval of publicly available web pages for the market research included with Phoebe Intelligence. |
| Google Workspace | Transactional email delivery of service notifications and reports to the Customer’s team. |
The current list of sub-processors is published in the Pulsium Privacy Policy at pulsium.ai and is updated when providers change.