Data processing

You are the controller. You decide what your agent collects, why, and how long it is kept. Fiveleaf Ltd is your processor, acting on your documented instructions.

That split matters in practice, not just on paper. A data subject exercising their rights exercises them against you. We will help you answer, and we can act on the systems we run, but we will not make those decisions on your behalf.

We sign a DPA with every client before any personal data is processed. It is governed by the law of England and Wales.

Categories of personal data

• Contact details — name, email address, phone number.
• Communication content and history — what was said in a conversation, on whichever channel it happened.
• Service enquiries and preferences.
• Website usage data relevant to the interaction.

Categories of data subject

• Your customers.
• Your prospective customers.
• Visitors to your website.

Voice deployments additionally involve call audio and transcripts, which routinely contain more than the categories above because callers say whatever they say. Where voice is in scope we agree the handling explicitly rather than relying on this general list.

We do not process special category data by design. If your use case would involve it, that is a conversation to have before the build, not after.

• Providing the AI-powered support, retention or lead generation described in your service agreement.
• Optimising agent performance based on real interactions.
• Generating analytics and insight about those interactions for you.

We process for those purposes and no others. In particular, your data is not used to improve the models or agents we run for anyone else. That is a contractual commitment, not a policy we could quietly change.

This is the section most vendor pages are vague about, so here is the actual mechanism.

You set the horizon

Retention is configured per client in the dashboard, not fixed by us. The default is 365 days. The permitted range is 30 days to 10 years, enforced in the database rather than only in the interface — there is deliberately no “keep forever” option, because indefinite retention is hard to defend under the storage limitation principle in Article 5(1)(e).

A scheduled job runs every day and deletes conversations, transcripts and client-scoped audit records past your horizon, along with every record that hangs off them. Lowering your setting takes effect on the next daily run, so a change from 24 months to 12 removes the difference within a day. Each run writes an audit record to your own account, so you can evidence your retention compliance rather than taking our word for it.

The honest exception

Conversations that are still live are not deleted on schedule — one that is mid-handover, waiting on your team, or carrying an incomplete follow-up task is kept until that work is finished, and is recorded as skipped rather than silently retained. The bound on those is operational rather than temporal: close the handover and the normal horizon applies again.

Records that outlive your horizon

Consent records outliving the conversation they relate to is deliberate. An audit trail that expired before the claim it defends would be worthless.

At the end of the contract

On termination we delete or return all personal data in the systems we manage, at your choice, within 30 days, and delete remaining copies unless the law requires us to keep them. We may keep anonymised usage metrics that cannot be linked to an identifiable person.

We are a managed service. We hold the accounts on the underlying platforms and configure them for you, which means real processing happens on third-party infrastructure we select. Pretending otherwise would misrepresent the architecture.

The current named list is available on request and we will provide it to any client or prospective client doing diligence. Every sub-processor is bound by data protection obligations consistent with our DPA, and we remain liable to you for their performance.

We will tell you about changes that would significantly affect how your data is processed.

Some sub-processors operate outside the UK. Where personal data is transferred, it is transferred under a safeguard required by Chapter V of the UK GDPR — an adequacy decision, the International Data Transfer Agreement, or standard contractual clauses with the UK addendum. We keep documentation of those safeguards and will provide it on reasonable request.

The technical and organisational measures committed in Annex 1 of the DPA:

• Platform selection weighted toward enterprise-grade providers with appropriate security certifications.
• Role-based access to management interfaces, multi-factor authentication on administrator access, and periodic review of access privileges.
• Secure configuration practices, with credentials and configuration held separately from application data.
• Encryption of data in transit between systems, and minimisation of temporary storage in transit.
• Monitoring of system health, review of platform audit logs, and alerting on security and performance events.
• Documented system architecture and data flows, maintained so recovery and audit are both possible.
• Data protection training for staff with system access, and confidentiality commitments from anyone authorised to access client data.

Client data is kept logically separated from other clients’ data. We run our own security reviews of the platform and remediate what they find; we are happy to discuss current posture under NDA with a client’s security team.

We notify you without undue delay and no later than 48 hours after becoming aware of a breach affecting systems under our management.

The notification covers the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken, and a contact for more detail. Where something is not yet known we say so and follow up rather than delaying the whole notification, and we will chase sub-processors for what we need. We then assist you with your own notification obligations, because they are yours to discharge.

Assistance

We assist you with data subject requests, breach notification and data protection impact assessments, for data in the systems we configure. If we think one of your instructions breaches the UK GDPR we will say so, and may pause that instruction until you confirm or change it.

Audit

You can verify our compliance three ways: written documentation on request, a call with us to walk through it, or — where those are not enough — a formal audit on 30 days’ written notice, once a year, during business hours. An audit covers processing of your data, not other clients’ data or our commercial internals.

Ownership

All customer interaction data collected through your agents remains yours. The AI system itself — the flows, methods, architecture and implementation — remains ours.

This page is a summary. The signed DPA is the operative document and governs where the two differ.

To request the full DPA, the current named sub-processor list, or a security questionnaire response, email support@fiveleaf.co.uk. We would rather send it early in a conversation than at the end of one.