Data Processing Schedule

1. Independent Controllers

AI Workforce and the Customer each act as independent data controllers in relation to their respective processing activities. Neither party acts as a data processor on behalf of the other, and nothing in these Terms or this Schedule creates a joint controllership between the parties.

AI Workforce determines the purposes and means of processing for the operation, maintenance, and improvement of the platform. The Customer determines the purposes and means of processing for its own outreach campaigns, CRM usage, and communications conducted through the platform.

Each party is independently responsible for ensuring that its own processing activities comply with applicable data protection law, including UK GDPR.

2. Customer Responsibilities

As an independent controller, the Customer is solely responsible for:

• •

  Establishing and maintaining a valid legal basis for all personal data used in outreach campaigns, AI calls, messaging, and any other communications conducted through the platform

• •

  Ensuring that any contact data uploaded to or used through the platform has been obtained lawfully

• •

  Honouring data subject rights, opt-outs, and suppression requests relating to its own campaigns

• •

  Maintaining a publicly accessible privacy policy that meets the transparency requirements of UK GDPR Articles 13 and 14

• •

  Complying with all applicable telemarketing, e-privacy, and anti-spam laws in the jurisdictions in which it operates

• •

  Notifying AI Workforce promptly of any data breach or regulatory inquiry relating to data processed through the platform

AI Workforce accepts no liability for any failure by the Customer to comply with its obligations as a data controller. The indemnity provisions in the Terms and Conditions apply in full to any third-party claims arising from the Customer's processing activities.

3. AI Workforce Responsibilities

AI Workforce is responsible for the personal data it processes in its own right as a controller, including:

• •

  Account and subscription data collected during registration and billing

• •

  Usage data and platform analytics collected to maintain and improve the service

• •

  Business contact information sourced from publicly available sources to power lead enrichment features, processed under legitimate interests (UK GDPR Article 6(1)(f)) and on the basis that such data has been made manifestly public by the data subject

AI Workforce does not process personal data on the Customer's behalf or under the Customer's instructions. The platform provides tools and infrastructure; the Customer controls how those tools are used in relation to its own contacts and prospects.

4. Data Sources

The lead enrichment and data features within the platform draw on publicly available information sourced from professional profiles, company websites, public directories, and other openly accessible sources on the internet. AI Workforce works with compliant third-party data providers who operate under their own controller obligations and GDPR-compliant frameworks.

AI Workforce does not acquire or use private personal data, data obtained without consent, or special category data for any platform feature.

5. No Audit Rights

Because each party acts as an independent controller, neither party has audit rights over the other's data processing operations. The Customer's use of the platform is governed by the Terms and Conditions, not by a processor relationship. AI Workforce is not subject to audits, inspections, or data processing instructions from the Customer in relation to its own controller activities.

AI Workforce maintains its own compliance programme in accordance with UK GDPR and will cooperate with the Information Commissioner's Office as required by law.

6. Processing Activities Summary

7. International Transfers

Where AI Workforce transfers personal data outside the UK in connection with its own controller activities, it ensures appropriate safeguards are in place, including Standard Contractual Clauses where required. Details are set out in the Privacy Policy at aiworkforce.co.uk/privacy.

Where the Customer transfers data outside the UK using the platform, the Customer is responsible for ensuring its own compliance with the applicable transfer rules under UK GDPR.

8. Security

AI Workforce implements appropriate technical and organisational measures to protect the platform and any personal data processed through it. These include encryption in transit and at rest, access controls, regular security reviews, and breach notification procedures. Details are set out in the Privacy Policy.

The Customer is responsible for the security of its own systems, login credentials, and any data it downloads or exports from the platform.

9. Data Retention

AI Workforce retains account and usage data in line with its Privacy Policy. On termination of a subscription, Customer account data is deleted within 30 days unless retention is required by law.

The Customer is responsible for managing the retention and deletion of any personal data it processes through the platform in connection with its own campaigns.

10. Contact

For any questions relating to data processing under this Schedule, contact us at team@aiworkforce.co.uk.