Relay data processing agreement
Parties and scope
Relay is a product of Corsift, a trading name of ASG INFOTECH LIMITED, registered in England and Wales, company number 13873222. Registered office and correspondence address: Sterling House Maple Court, Maple Road, Tankersley, United Kingdom, S75 3DP. VAT registration number: GB402247244. Contact: hello@corsift.com.
This agreement forms part of the Relay service terms between ASG INFOTECH LIMITED (processor) and the customer business (controller). Processing lasts for the service period and the agreed return, deletion and backup-expiry period. The subject matter is handling inbound service enquiries, retrieving approved answers and managing callbacks on the customer’s behalf.
Processing details
Operations include receipt, transcription, retrieval, generation of spoken approved responses, organisation, storage, disclosure to authorised users and providers, and deletion. Data subjects are callers, customer staff and people mentioned in supplied content. Data types include contact identifiers, voice where supplied, enquiries, messages, callback details and call metadata. The standard service is not intended for special-category data; any such deployment requires a separate suitability assessment and written agreement before use.
Instructions and confidentiality
We process personal data only on documented customer instructions, including these terms and configured service settings, unless law requires otherwise. We will inform the customer of a legal requirement unless prohibited and notify them if an instruction appears to infringe applicable data protection law. Persons authorised to process customer data must be bound by confidentiality and receive access only as needed for their role.
Security and assistance
We maintain technical and organisational measures appropriate to processing risk, including access control, tenant scoping, protected credentials, encrypted public transport, backup and recovery procedures, and deletion controls. The security page describes the standard service. We will assist the customer, taking account of the nature of processing and information available, with rights requests, security, impact assessments and consultation with regulators. We will notify the customer without undue delay after becoming aware of a personal data breach and provide available information needed for their response.
Subprocessors
The customer generally authorises the providers below for the stated service functions. We will impose data protection obligations offering materially equivalent protection, remain responsible for their performance of processor obligations, and give at least 30 days’ notice of planned additions or replacements. Customers may object on reasonable data protection grounds during that notice period. If we cannot resolve the objection, either party may end the affected service before the change takes effect, with a proportionate refund of prepaid unused service.
- Civo: application infrastructure, databases, object storage and recovery copies; service content and metadata, London hosting.
- Twilio: telephone connectivity and media transport; caller numbers, audio and call metadata.
- Deepgram: speech recognition; caller audio and resulting text.
- ElevenLabs: speech synthesis; text to speak and generated audio.
- Clerk: customer authentication; account identifiers and security metadata.
- Cloudflare: website and network delivery; visitor and request metadata as applicable.
- Tailscale: private network connectivity; device and connection metadata.
Stripe processes billing and payment information under its applicable role and terms. Office-hosted inference is operated by ASG INFOTECH LIMITED. Customer-selected integrations are additional destinations directed by the customer. Provider country coverage and contractual transfer safeguards must be checked for the selected deployment; this agreement does not represent that every provider processes exclusively in the UK. We will only make restricted transfers under an applicable lawful transfer mechanism and will provide details on request.
Return, deletion and assurance
On termination or a documented request we will, at the customer’s choice, return or delete personal data, except where law requires retention. Protected backup copies expire within 30 days after removal from active storage. If restored, outstanding deletion instructions must be reapplied before normal processing resumes. We will make available information reasonably needed to demonstrate compliance with these processor obligations and allow audits, including inspections by the customer or an auditor they mandate, subject to proportionate confidentiality and security arrangements.