One360AI

Legal

UK Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the One360AI UK Terms of Service and forms a legally binding agreement between One360AI LLC ("Processor") and the subscriber ("Controller" or "Customer").

1. Scope, Purpose & Roles

  • Data Controller: The Customer determines the purpose and means of processing prospective buyer, seller, landlord, and tenant data.
  • Data Processor: One360AI processes Personal Data only on behalf of, and in line with the documented instructions of, the Customer, to deliver the One360AI platform and its engines (lead capture, missed-call recovery, voice AI, booking, CRM updates, and growth modules).

2. Obligations of the Processor

One360AI shall:

  • Process Personal Data only in accordance with the Customer's documented instructions, including transfers of Personal Data outside the UK.
  • Ensure that all employees, agents, and contractors authorised to process Personal Data are subject to binding duties of confidentiality.
  • Implement appropriate technical and organisational security measures meeting the requirements of UK GDPR Article 32.
  • Promptly assist the Controller in responding to data subject rights requests under the UK GDPR.

3. Sub-Processor Engagement

The Customer grants general authorisation for One360AI to engage sub-processors (telecommunications routing providers, cloud storage providers, and AI infrastructure providers). One360AI shall maintain written contracts with all sub-processors imposing data protection obligations no less stringent than those in this DPA.

4. Personal Data Breaches

If a Personal Data Breach affecting Customer data is confirmed, One360AI shall notify the Customer without undue delay, and provide reasonable cooperation to help the Customer meet its ICO notification obligations under UK GDPR Article 33.

5. Return and Deletion of Data

On termination of the subscription agreement, One360AI shall, at the Customer's election, securely delete or return all Customer Personal Data within sixty (60) days, unless UK law requires continued retention.