Echlo Data Processing Agreement
Last updated: 26 September 2026
This agreement forms part of the Echlo terms of service between Echlo Ltd (the "processor") and the business using Echlo (the "controller"). Where it differs from the terms on anything about personal data, this agreement takes precedence.
1. What is processed
| Subject matter | Providing Echlo's review-flow service to the controller |
| Duration | For as long as the controller's account is open, plus the deletion period in section 9 |
| Nature and purpose | Storing request details; presenting questions to the controller's customers; generating a review draft from each customer's answers; recording the customer's approval and the platforms they post to; showing the controller its dashboard; recording how the customer screens and dashboard are used, with personal details masked, to improve them |
| Data subjects | The controller's customers who are sent a request; the controller's staff named in Echlo |
| Personal data | Names; contact details supplied by the controller; job and location descriptions; the customer's answers, draft and approved review; request status and timestamps; how the screens are used (taps, scrolls, pages visited, device and browser details), with names, jobs, answers, reviews and contact details masked |
| Special category data | None is sought. The controller must not enter any |
2. The processor's obligations
The processor will:
- process the personal data only on the controller's documented instructions. The terms and use of Echlo's features are those instructions. It will tell the controller if an instruction appears to break data protection law;
- make sure everyone authorised to process the data is bound by confidentiality;
- take appropriate technical and organisational security measures, including encryption in transit, access limited to those who need it, and access controls on the database;
- use sub-processors only as set out in section 3;
- help the controller, as far as reasonably possible, to answer requests from data subjects exercising their rights;
- help the controller meet its obligations on security, breach notification, impact assessments and consultation with the ICO;
- at the end of the service, delete or return the personal data as set out in section 9;
- give the controller the information needed to show compliance with this agreement, and allow reasonable audits on at least 30 days' notice, at the controller's cost, no more than once a year unless there has been a breach.
3. Sub-processors
The controller gives general authorisation for the processor to use sub-processors. Those currently used are:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase Inc | Database | Data stored in the UK (London); US company |
| Vercel Inc | Hosting | US and worldwide; server functions run in the UK (London) |
| OpenAI | Draft generation from the customer's answers; not used for model training under OpenAI's API terms | US |
| Microsoft Ireland Operations Ltd (Microsoft Clarity) | Recording how the customer screens and dashboard are used, with personal details masked; people can opt out | Microsoft Azure; may be transferred to the US (Microsoft Corporation) under Microsoft's Standard Contractual Clauses |
The processor will give at least 14 days' notice before adding or replacing a sub-processor. The controller may object on reasonable data protection grounds. If the objection can't be resolved, the controller may cancel without the rest of its minimum term being due. The processor puts equivalent data protection obligations on every sub-processor and remains responsible for them.
4. International transfers
Where personal data is transferred outside the UK, the processor makes sure a lawful transfer mechanism is in place: UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
5. Personal data breaches
The processor will notify the controller without undue delay, and in any case within 48 hours of becoming aware of a breach affecting the controller's data. It will give what information it has and update it as more becomes known, so the controller can meet its own 72-hour duty to report to the ICO where that applies.
6. The controller's obligations
The controller confirms it has a lawful basis to give the processor each customer's details and to contact them for a review, and that it has told its customers about this in its own privacy information.
7. Private feedback
A customer's answer to the question about what could have been better is shown to the controller only. It is never put into a review draft.
8. Review content
The processor will not include a street address, postcode, phone number, email or similar personal detail in a review draft, even if the customer wrote it in their answers.
9. Deletion at the end
Within 30 days of the account ending, the processor deletes the controller's personal data, including the customer answers held by its form provider, unless the controller asks for an export first or the law requires it to be kept. Backups are overwritten in their normal cycle, within 30 further days. OpenAI may keep API inputs for up to 30 days for abuse monitoring under its own terms, and then deletes them.
Reviews already posted by customers on third-party platforms are outside Echlo's control and are not affected.
10. Liability
Liability under this agreement is subject to the limits in the terms of service.