Data Processing Agreement
Version 0.2, effective 22 October 2026.
This Data Processing Agreement ("DPA") forms part of the Arcela Terms of Service between:
- you, the business that holds the Arcela account (the "Customer", acting as controller); and
- Arcscribe Ltd, registered in England and Wales, company number 16921982, registered office 18 Colegate, Norwich, NR3 1BQ, United Kingdom, ICO registration ZC072411 ("Arcscribe", "we", acting as processor).
It sets out how we process personal data on your behalf when you use Arcela, as required by Article 28 of the UK GDPR. You accept it when you accept the Terms of Service. If this DPA and the Terms conflict on data protection, this DPA wins.
1. Definitions
Words such as controller, processor, personal data, processing, data subject, personal data breach and special category data have the meanings given in the UK GDPR and the Data Protection Act 2018 ("Data Protection Law").
- Customer Personal Data means personal data that you, your users or your customers put into Arcela, or that Arcela collects on your behalf. Examples are client records, call recordings, transcripts, texts, bookings, form and booking page submissions, and logged emails.
- Sub-processor means a third party we engage to process Customer Personal Data.
2. Roles and scope
2.1 You are the controller of Customer Personal Data, and we are your processor. Annex 1 describes the processing.
2.2 This DPA doesn't cover personal data we handle as a controller in our own right, such as your account and billing details. Our Privacy Policy covers that.
2.3 Payments: where you use the Payments module, Stripe processes payment data and identity verification data under its own agreement with you, as a separate controller. We receive only the payment information needed to show payments in Arcela and charge our fee.
3. Your responsibilities
You confirm that:
- Lawful basis: you have a lawful basis for the processing, and you've given data subjects the information Data Protection Law requires. That includes telling callers about call recording and transcription where needed;
- Lawful instructions: your instructions to us comply with Data Protection Law; and
- Necessary data only: you'll only put special category data or criminal offence data into Arcela where you genuinely need it and have the right conditions to process it.
4. Our obligations
We will:
- Follow your instructions:
- process Customer Personal Data only on your documented instructions, which include the Terms, this DPA and your use and settings of Arcela, unless the law requires otherwise;
- tell you if we believe an instruction breaks Data Protection Law;
- Keep it confidential: make sure everyone we authorise to process Customer Personal Data is bound by confidentiality;
- Keep it secure: apply appropriate technical and organisational measures, including those in Annex 2;
- Use sub-processors properly: only use sub-processors as set out in section 5;
- Help with requests: taking into account the nature of the processing, help you respond to data subject requests (access, correction, erasure, restriction, portability and objection), mainly through tools in Arcela such as client data export and erase. If a data subject contacts us directly about your data, we'll pass the request to you and won't respond ourselves unless you ask us to;
- Help with security and assessments: help you with security, breach notification, data protection impact assessments and consultation with the ICO, taking into account the information available to us;
- Delete or return: at the end of the service, delete or return Customer Personal Data as set out in section 7; and
- Show compliance: make available the information you reasonably need to show compliance with Article 28, and allow audits as set out in section 8.
5. Sub-processors
5.1 You give general authorisation for us to use sub-processors. The current list is in Annex 3 and on our website at /legal/sub-processors.
5.2 We'll give you at least 30 days' notice by email or in Arcela before adding or replacing a sub-processor. If you reasonably object on data protection grounds, tell us within that period:
-
we'll try to find a solution;
-
if we can't, you may end the affected part of the service and we'll refund any prepaid fees for it.
5.3 We'll put a written contract in place with each sub-processor that gives data protection obligations equivalent to this DPA. We remain responsible to you for our sub-processors.
6. Personal data breaches
6.1 We'll notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We'll tell you what we know, and update you as we learn more.
6.2 We'll take reasonable steps to contain the breach and reduce its effects, and help you meet any obligation to notify the ICO or data subjects.
7. Deletion at the end of the service
7.1 When your account closes, you can export your data for 30 days. After that, we delete Customer Personal Data from our live systems. Copies in backups are overwritten within a further 35 days.
7.2 We may keep Customer Personal Data longer only where the law requires us to. In that case we protect it and use it only for that purpose.
7.3 During the service, you control retention through Arcela's settings. Our defaults are:
| Data | Default retention |
|---|---|
| Call recordings and transcripts | 90 days |
| Call details and summaries | 12 months |
| Texts | 12 months |
| Client records and bookings | While your account is open, unless you set retention rules |
| Photos and files | Deleted with the record they belong to |
8. Audits
8.1 We'll answer reasonable written questions about our data protection practices, and provide relevant summaries of our security measures.
8.2 If that isn't enough to show compliance, you, or an independent auditor bound by confidentiality, may audit our compliance:
- once a year;
- with at least 30 days' notice;
- during business hours;
- in a way that doesn't disrupt our service or compromise other customers' data.
You'll cover your own costs. Audits required by a regulator, or following a breach, aren't limited to once a year.
9. International transfers
9.1 We host Arcela on servers in Germany, which the UK government recognises as providing adequate protection.
9.2 Some sub-processors process data in the United States or elsewhere outside the UK (see Annex 3). For those transfers we rely on:
- the UK Extension to the EU-US Data Privacy Framework, where the sub-processor is certified; or
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.
10. AI processing
10.1 Arcela uses AI providers to transcribe calls, understand callers and produce speech. They process Customer Personal Data only to provide that service to us.
10.2 We don't use Customer Personal Data to train AI models, and we configure our AI providers so that they don't use it to train theirs.
11. Liability and general
11.1 Each party's liability under this DPA is subject to the limits in the Terms of Service, except where Data Protection Law doesn't allow those limits.
11.2 This DPA lasts as long as we process Customer Personal Data for you.
11.3 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Annex 1: Details of the processing
| Subject matter | Providing Arcela to the Customer |
| Duration | The term of the Customer's subscription, plus the deletion periods in section 7 |
| Nature and purpose | Hosting, storing, organising and displaying records. Receiving, routing, recording and transcribing calls. Sending and receiving texts and emails. Running the AI receptionist. Scheduling and reminders. Publishing booking pages and forms. Producing quotes and invoices. Showing payments. Support and keeping the service secure. |
| Types of personal data | Names, phone numbers, email addresses, postal addresses and postcodes, property access notes, job details, notes, photos and files, call recordings, transcripts and AI summaries, text and email content, booking and calendar data, quote and invoice data, payment status (not card details), and marketing consent records |
| Special category data | Not required by Arcela. It may be included if the Customer chooses (for example health details mentioned by a caller). The Customer is responsible for its lawful basis. |
| Data subjects | The Customer's clients and their contacts, callers and texters, people who submit forms or booking pages, people named in jobs or notes, and the Customer's staff who use Arcela |
Annex 2: Security measures
- Hosting: servers we run ourselves in Hetzner data centres in Germany, with access restricted to authorised Arcscribe staff using individual accounts and multi-factor authentication.
- Separation: each business's data is separated by database-level row security. Files are held in private storage and served by short-lived signed links.
- Encryption:
- in transit, using TLS;
- at rest, using disk-level encryption.
- Backups: encrypted daily database backups, kept off the main server. Restores are tested.
- Least privilege: staff access Customer Personal Data only where needed for support or security, and access is logged.
- Sensitive fields: access codes and key safe notes are visible only to authorised roles, and are left out of exports and calendar feeds by default.
- Application security:
- dependency and vulnerability checks;
- verified webhooks;
- rate limiting;
- audit logs of sensitive actions;
- separation of production and test data.
- Incident response: a documented process for assessing, containing and notifying personal data breaches.
Annex 3: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Data centre hosting our servers (application, database, file storage, email) | Germany |
| Cloudflare, Inc. | DNS, network security, bot protection on public forms | UK, EU and US |
| Twilio Inc. | Phone numbers, calls, call recording and texts | US, UK and EU |
| Deepgram, Inc. | Speech to text and text to speech | US |
| Anthropic, PBC | AI language model for the receptionist | US |
| Stripe Payments UK Ltd | Payments module only: displaying payments and taking our fee | UK, EU and US |
| Mapbox, Inc. | Map images for addresses (no personal data beyond map coordinates being viewed) | US |
We send email from our own mail server on our Hetzner servers in Germany. Address checks use postcodes.io, and business checks use Companies House and HMRC. Only postcodes, company numbers or VAT numbers are sent to those services.