PipeIQ

Data Processing Agreement

UK GDPR Article 28 — between PipeIQ (Processor) and your agency (Controller)

Last updated: 2 July 2026 — Version 1.3

1. Parties

Data Processor: TradeBoost AI Ltd, trading as PipeIQ. Company No. 17227850. Registered in England and Wales. London, UK. ICO Registration: ZC164080.

Data Controller: The agency signing up to PipeIQ (you), as identified by your registered agency name and email address.

2. Subject Matter & Purpose

PipeIQ provides an SMS campaign management platform. In doing so, PipeIQ processes personal data on behalf of the Controller solely to:

Store contact lists uploaded by the Controller
Send SMS messages to those contacts via Twilio on the Controller's instruction
Record replies and conversation stages in the pipeline
Maintain opt-out (STOP) records to honour data subject requests

PipeIQ will not use this data for any other purpose, including its own marketing.

3. Data Processed

Category	Data Fields	Data Subjects
Contact data	First name, last name, phone number	Controller's customers / prospects
Interaction data	SMS sent/received, reply content, opt-out status, conversation stage	Same
Account data	Agency name, email, billing status	Controller's authorised users

Duration: For the term of the Controller's active subscription, plus a maximum of 365 days thereafter (after which contact data is anonymised per our retention policy).

4. Processor Obligations (PipeIQ)

PipeIQ agrees to:

Process personal data only on documented instructions from the Controller
Ensure all staff with access to personal data are bound by confidentiality obligations
Implement appropriate technical and organisational security measures (encryption in transit, JWT authentication, access controls, audit logging)
Not engage additional sub-processors without informing the Controller
Forward any data subject rights request (access, erasure, portability) received by PipeIQ to the Controller within 3 business days, and assist the Controller in fulfilling such requests within one calendar month
Notify the Controller within 48 hours of becoming aware of a personal data breach, to enable the Controller to meet its own 72-hour ICO notification obligation
Delete or return all personal data at the end of the service relationship, at the Controller's choice
Make available all information necessary to demonstrate compliance with this Agreement
Permit the Controller or its appointed auditor to conduct audits or inspections to verify compliance with this Agreement, on written notice of no less than 14 days. Audits are limited to once per calendar year unless a personal data breach has occurred. The Controller bears the reasonable costs of any on-site audit.
Ensure that any sub-processor engaged by PipeIQ is bound by data protection obligations equivalent to those in this Agreement, in accordance with UK GDPR Article 28(4)

5. Controller Obligations (You)

By using PipeIQ, you confirm that:

You have a lawful basis for processing each contact's personal data (legitimate interest for B2B, or explicit consent for B2C)
B2C contact lists have been screened against the Telephone Preference Service (TPS/CTPS) before upload
You will not upload special category data (health, religion, ethnicity, etc.) via PipeIQ
You will honour opt-out requests promptly — PipeIQ records STOP replies automatically
You will maintain your own records of lawful basis and consent where required
You are responsible for the accuracy and legality of the data you upload
You indemnify TradeBoost AI Ltd against any claim, cost, or legal expense brought by any third-party service provider engaged by TradeBoost AI Ltd in delivering the platform (including TPS screening providers), where such claim arises directly from your breach of these obligations

6. Sub-Processors

PipeIQ uses the following sub-processors. By accepting this DPA you authorise their use:

Sub-processor	Purpose	Location	Safeguard
Twilio Inc.	SMS delivery & inbound	USA	UK IDTA & EU-US Data Privacy Framework
Supabase Inc.	Database & storage	EU (Frankfurt)	UK Addendum to EU SCCs
GitHub, Inc. (a Microsoft company)	Off-site disaster-recovery backup — a nightly copy of the database is stored in a private repository. Storage only; no processing, analysis, or onward disclosure. Access is restricted to TradeBoost AI Ltd.	USA	GitHub Data Protection Agreement incorporating EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Transmitted over TLS and encrypted at rest by GitHub; repository is private and not publicly accessible.
Google Cloud Platform (Google Cloud EMEA Ltd)	Compute hosting for the campaign dispatch, opt-out enforcement and voice AI services	USA	UK IDTA & EU-US Data Privacy Framework
Vercel Inc.	Application hosting & serverless functions	USA	UK IDTA & EU-US Data Privacy Framework
Stripe Inc.	Payment processing	USA	UK IDTA & EU-US Data Privacy Framework
Twilio SendGrid	Transactional email	USA	UK IDTA & EU-US Data Privacy Framework
Anthropic PBC	AI message generation (claude.cmd)	USA	UK IDTA. No contact data sent — message templates only.
I Want That Ltd (TPS Services) — Co. No. 07314202	TPS/CTPS register screening — phone numbers checked against the Telephone Preference Service and Corporate Telephone Preference Service before every campaign dispatch. Only the phone number is transmitted — no names, emails, or other personal data.	UK (London EC1V 2NX)	UK-based provider. Signed Data Sharing Agreement in place (GDPR Principles of & Agreement for the Sharing of Data, v1.0). All transmission via HTTPS/SSL-encrypted API calls to service.tpsapi.com. Phone numbers expunged within 60 days of screening (30-day option configured). TPS Services use a third-party HLR/mobile validation sub-processor; they are contractually bound by no less restrictive terms (s.2.5 of the Data Sharing Agreement). HLR sub-processor identity to be confirmed by TPS Services.

PipeIQ will notify the Controller by email at least 30 days before adding or replacing any sub-processor. The Controller has 30 days from notification to object in writing to support@pipeiq.co.uk. If the objection cannot be resolved, the Controller may terminate their subscription without penalty.

PipeIQ will not transfer personal data outside the UK or EEA except as described in the sub-processors table above, where appropriate safeguards (Standard Contractual Clauses or equivalent) are in place.

7. Security Measures

All data transmitted over TLS 1.2+
JWT-authenticated API access — each agency's data is isolated by agency_id
Row Level Security enabled on every application table at database level, operating on a default-deny basis — the public client-side API key can read no customer data
Opt-out (STOP) records isolated per agency — one agency's opt-outs do not affect another
Contact data anonymised after 365 days of campaign inactivity (automated)
Access logs retained for audit purposes

8. Data Retention & Deletion

Contact personal data (name, phone) is automatically anonymised 365 days after the last campaign dispatch. Upon subscription cancellation, PipeIQ will automatically anonymise or delete all contact personal data within 90 days of termination, regardless of whether a deletion request is made. The Controller may also request full deletion at any time by emailing support@pipeiq.co.uk — PipeIQ will action this within 30 days.

9. Liability

PipeIQ's liability under this Agreement is subject to the limitations set out in PipeIQ's Terms of Service, which form part of the agreement between the parties. Nothing in this Agreement excludes or limits liability for fraud, wilful misconduct, or any liability that cannot be excluded by law.