Data Processing Agreement

Version 2026-09-21 · Last updated: 21 September 2026

What this is. When a company uses TSE-Assistant, some of what it puts into the Service is personal data about its own people — the questions they ask Sofia, the documents she writes, the names in a published index's labels. For that content the company is the controller and we are its processor, and UK data protection law requires a written agreement between us. This is it. It forms part of the Terms of Service (section 4b) for every company account, and applies from the moment the account is created.

1. Parties and definitions

This agreement is between the company that holds a TSE-Assistant company account ("you", the controller) and TSE IT SOLUTIONS LIMITED, company number 15419504, registered office 25 Waterfield Way, Clipstone Village, Mansfield, NG21 9FD ("we", the processor). "Data protection law" means the UK GDPR and the Data Protection Act 2018, each as amended. "Customer content" means the personal data we process on your behalf, described in Annex 1. Words defined in the Terms mean the same here.

2. What we process for you, and why

Annex 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of people it is about. In short: we host and operate the Service for your account, and process customer content only to provide it. We are the controller — not your processor — for your account, billing and the operational records we keep for our own security, as the Privacy Notice says.

3. Our obligations as your processor

Instructions. We process customer content only on your documented instructions. Your instructions are the Terms, this agreement, and the choices your admins make on the dashboard — which environments publish an index, whether Sofia in Teams and the dashboard is on, which AI models your seats may use, whether standard-code review is on. If we believe an instruction breaks data protection law, we tell you before acting on it. We process outside your instructions only where the law requires us to, and then we tell you first unless the law forbids it.
Confidentiality. Everyone we allow to process customer content is bound by a duty of confidentiality. Today that is the company's owner; we have no other staff.
Security. We keep the technical and organisational measures described on the Security & Data Handling page (Annex 2), and we do not lower them during the term without telling you. They include encryption in transit and at rest, per-account isolation, signed licences with tiers enforced on our server, secrets in managed stores, and a daily sweep that deletes each record when its retention period ends.
Sub-processors. You authorise the sub-processors on the sub-processors page. We give the account owner at least 30 days' notice by e-mail before adding or replacing one. If you object on reasonable data protection grounds and we cannot resolve it, you may terminate the affected part of the Service, or the account, and we refund any period paid for and not used. Every sub-processor is bound by written terms that impose the obligations in this section, and we remain responsible for its performance.
Helping you with people's rights. If a person asks us directly about customer content, we pass the request to your account owner within five working days and help you answer it (the Service's export, delete and search functions; our data protection procedure). We do not answer such a request ourselves unless you ask us to or the law requires it.
Helping you with your own duties. We give you the information you reasonably need for your security, breach-notification and data protection impact assessment obligations, taking into account what we know and what the Service does.
Breaches. If we become aware of a personal data breach affecting customer content, we tell your account owner without undue delay, and in any event within 72 hours, with what we know: what happened, whose data and how much, the likely consequences, and what we are doing about it. We update you as we learn more.
At the end. When your account closes, you can ask for an export of your company's content during the next 90 days. After 90 days we delete the customer content and every copy of it, except what the law requires us to keep — and then we keep only that, for only as long as it requires. During the term your owner can delete all of your company's Sofia data at once from the dashboard, and each person can delete their own conversations and memories.
Showing you. We give you the information you need to check that we keep this agreement: this page, the Security page, the sub-processors page, and written answers to a reasonable security questionnaire once a year. If that is not enough, you may have an audit carried out — once in any 12 months unless a regulator requires more, on at least 30 days' notice, during business hours, at your cost, by an auditor bound to confidentiality who does not compete with us — and we cooperate with it.

4. Your obligations as controller

You are responsible for the lawfulness of the customer content you put into the Service, for the notices your people receive, for the choices your admins make, and for giving us instructions that comply with data protection law. You confirm that you hold the licences the Terms' section 4 describes.

5. Transfers outside the UK

Customer content is stored and processed in the United Kingdom (Microsoft Azure, UK South). It leaves the UK only through the sub-processors the sub-processors page marks as such — OpenAI in the United States, when your admin allows the gpt-5.6-terra model, and Microsoft's Bot Service and e-mail delivery, which may process outside the UK — and then under the safeguards named there: the EU Standard Contractual Clauses with the UK Addendum in OpenAI's Data Processing Addendum, together with our transfer risk assessment, and Microsoft's Data Protection Addendum. A new account's seats do not use OpenAI until its admin allows it. We will not transfer customer content elsewhere without a lawful mechanism under Chapter V of the UK GDPR.

6. Liability, term and law

Each party's liability under this agreement is subject to section 9 of the Terms, including its cap for data protection obligations. This agreement lasts as long as we process customer content for you, including the 90 days after the account closes. Where it conflicts with the Terms on the processing of customer content, this agreement prevails. It is governed by the laws of England and Wales. We may update it as the law or the Service changes; a material change is notified like a material change to the Terms (30 days by e-mail), and every version carries its date above.

Annex 1 — the processing

Subject matter	The operation of TSE-Assistant for your company account: the published index, Sofia in the installed app on TSE's LLM, Sofia in the dashboard and Microsoft Teams, and the audit records your admins read.
Duration	While the account exists, and the 90 days after it closes.
Nature and purpose	Hosting, storing, retrieving and searching customer content; sending prompts to the AI models your admins allow and returning their answers; metering model usage; deleting content on request and when its period ends.
Types of personal data	Names, e-mail addresses and account ids of your seat holders; the text of their questions to Sofia and of files they attach; Sofia's answers, memories and documents; names that appear in your environment's label texts and object names; the Teams chat link; per-call usage figures.
Categories of people	Your employees and contractors who hold seats; people named in the content your seats put into the Service (for example in a requirement file or a label).
Special categories	None intended. The Service is not designed for them; do not put them in.

Annex 2 — security measures

The measures are described, and kept up to date, on the Security & Data Handling page — sections 6 (retention), 7 (isolation, access and licensing) and 8 (transport and storage security). That page is part of this agreement.