Data processing addendum

1. About this DPA

1.1 Where it applies. This Data Processing Addendum (“DPA”) forms part of the Master Terms of Service (“Terms”) between Lilium Group Ltd (company number 17549926), trading as HeyWilliam (“we”, “us”, “our”), and the client named in the Order Form or Workspace (“Client”, “you”, “your”). It applies whenever we process Client Personal Data on your behalf in providing the Platform. You do not need to sign it for it to apply. A signed copy is available on request.

1.2 Roles. For Client Personal Data, you are the controller and we are your processor. If you are yourself acting as processor for another controller, we are your sub-processor, you confirm that the other controller has authorised your instructions to us, and you are our single point of contact. For personal data we process for our own purposes, such as managing your account and billing, we are a controller and our Privacy Notice applies instead of this DPA.

1.3 Priority. If this DPA conflicts with the Terms on the processing of personal data, this DPA prevails. Words defined in the Terms have the same meaning here.

2. Definitions

In this DPA:

• “Client Personal Data” means personal data in Client Materials that we process on your behalf under the Agreement.
• “Data Protection Law” has the meaning in the Terms: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended, and, where it applies, the EU GDPR.
• “EU GDPR” means Regulation (EU) 2016/679.
• “EU SCCs” means the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914.
• “IDTA” means the International Data Transfer Agreement, and “UK Addendum” means the International Data Transfer Addendum to the EU SCCs, each issued by the Information Commissioner under section 119A of the Data Protection Act 2018.
• “Restricted Transfer” means a transfer of Client Personal Data that is restricted under Chapter V of the UK GDPR or, where it applies, the EU GDPR.
• “Sub-processor” means a third party we engage to process Client Personal Data.
• “UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

“Controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing” and “special categories of personal data” have the meanings given in the UK GDPR (or the EU GDPR where it applies).

3. Details of the processing

The subject matter, duration, nature and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex 1.

4. Your obligations

4.1 You are responsible for: (a) having a lawful basis for the processing you instruct, and, for special categories of personal data, a condition under Article 9 UK GDPR (and Schedule 1 of the Data Protection Act 2018 where needed); (b) giving data subjects the privacy information the law requires, including that you use AI tools and our services; (c) having any consent required under the Privacy and Electronic Communications Regulations 2003 for messages sent through the Platform; and (d) making sure that sharing Client Personal Data with us does not breach any duty of confidentiality you owe, including a duty of confidentiality to patients.

4.2 Your instructions must comply with Data Protection Law. You will only put into the Platform the Client Personal Data needed for the purposes in Annex 1.

5. Our obligations as processor

5.1 Instructions. We will process Client Personal Data only on your documented instructions, including with regard to Restricted Transfers. Your instructions are the Agreement, the configuration of your Workspace, and any other written instructions you give us that are consistent with the Agreement. If the law requires us to process Client Personal Data otherwise, we will tell you before doing so unless the law prohibits it. We will tell you immediately if we believe an instruction infringes Data Protection Law.

5.2 No use for our own purposes. We will not sell Client Personal Data or use it for our own purposes. In particular, we will not use Client Personal Data to train or improve AI models, ours or anyone else’s, and we will not combine it with personal data from other clients or other sources, except as needed to provide the Platform to you. This does not prevent us from creating System Telemetry, which contains no Client Personal Data.

5.3 Confidentiality. We will make sure that everyone we authorise to process Client Personal Data is bound by a duty of confidentiality and has access only as needed for their role.

5.4 Security. We will take the measures required by Article 32 UK GDPR, including those in Annex 2, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to individuals. We may update Annex 2, provided the overall level of security is not reduced.

5.5 Data subject requests. Taking into account the nature of the processing, we will help you, by appropriate technical and organisational measures where possible, to respond to requests from data subjects to exercise their rights. If we receive a request directly, we will pass it to you without undue delay and will not respond ourselves, except to direct the data subject to you, unless you instruct us otherwise.

5.6 Other assistance. Taking into account the nature of the processing and the information available to us, we will give you reasonable help to meet your obligations under Articles 32 to 36 UK GDPR, covering security, personal data breach notifications, data protection impact assessments and prior consultation with the Information Commissioner. We may charge reasonable costs for help beyond what the Platform’s standard features provide, except where the help is needed because of our breach of this DPA.

5.7 Deletion and return. When the Agreement ends, you may export Client Personal Data for 30 days as set out in clause 7.4 of the Terms. After that, we will delete Client Personal Data within a further 30 days, unless the law requires us to keep it. Copies in backups will be deleted when the backups expire, within 30 days, and will be kept secure and not used in the meantime. You may also ask us to delete specific Client Personal Data at any time. On request, we will confirm deletion in writing.

5.8 Information and audits. We will make available to you all information reasonably needed to show that we comply with Article 28 UK GDPR and this DPA, and will allow for and contribute to audits, including inspections, by you or an independent auditor you appoint, as set out in clause 9.

6. Personal data breaches

6.1 We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data.

6.2 Our notice will describe, as far as we then know: the nature of the breach, including the categories and approximate number of data subjects and records affected; the likely consequences; the measures taken or proposed to deal with it and reduce its effects; and a contact for more information. Where we do not have all the information at once, we will provide it in stages without undue delay.

6.3 We will take reasonable steps to contain and investigate the breach, and will co-operate with you. We will not notify the Information Commissioner or data subjects about a breach of Client Personal Data on your behalf unless you instruct us to or the law requires us to.

6.4 Notifying you of a breach is not an admission of fault or liability.

7. Sub-processors

7.1 Authorisation. You give us general written authorisation to engage sub-processors. The sub-processors we use when this DPA is accepted are listed in Annex 3, which is kept up to date at https://heywilliam.co.uk/subprocessors.

7.2 Changes. We will give you at least 30 days’ notice by email before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period. If you do, we will discuss your concerns in good faith and may offer a reasonable alternative. If we cannot resolve the objection, you may end the affected part of the Agreement, or the whole Agreement if the affected part cannot reasonably be separated, by written notice before the change takes effect, and we will refund any prepaid fees for the period after it ends.

7.3 Sub-processor terms. We will impose on each sub-processor, by written contract, data protection obligations that give the same level of protection as this DPA, including sufficient guarantees of appropriate security measures. AI model providers we use must be contractually prohibited from using Client Personal Data to train or improve their models.

7.4 Our responsibility. We remain responsible to you for the performance of each sub-processor’s obligations.

8. International transfers

8.1 UK transfers. We are based in the United Kingdom. We will only make a Restricted Transfer of Client Personal Data under the UK GDPR, including a transfer to a sub-processor, where: (a) the destination is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for US organisations certified under it); or (b) we have put in place the IDTA or the UK Addendum, or another appropriate safeguard under Article 46 UK GDPR, and assessed that the transfer gives the data an essentially equivalent level of protection. Annex 3 shows the mechanism for each sub-processor.

8.2 EU transfers. Where the EU GDPR applies to Client Personal Data, transfers from you to us in the UK rely on the European Commission’s adequacy decision for the UK. If that decision stops applying, the EU SCCs are incorporated into this DPA with you as data exporter and us as data importer: Module Two applies where you are a controller and Module Three where you are a processor; clause 7 (docking) does not apply; clause 9 option 2 applies with the notice period in clause 7.2; the optional wording in clause 11 does not apply; clauses 17 and 18 are governed by Irish law and the courts of Ireland; and Annexes 1 to 3 of this DPA complete Annexes I to III of the EU SCCs. Onward transfers of such data to sub-processors outside the UK and EEA will be protected by an adequacy decision, the EU-US Data Privacy Framework or the EU SCCs.

8.3 Changes to transfer rules. If a transfer mechanism we rely on is changed, replaced or invalidated, we will move to a lawful alternative without undue delay and tell you if this affects you.

9. Audits

9.1 We will first answer audit requests with documents, such as our security policies, completed questionnaires and any certifications or independent reports we hold.

9.2 If that is not enough to show compliance, or if a personal data breach affecting Client Personal Data has occurred, or if a supervisory authority requires it, you may carry out an inspection, or appoint an independent auditor bound by confidentiality to do so. You must give at least 30 days’ written notice (less after a breach, or where a supervisory authority requires it). Inspections take place during UK business hours, no more than once in any 12 months except after a breach or where an authority requires it, and must avoid disrupting our business or giving access to other clients’ data. You will bear the costs of the inspection, and we may charge reasonable costs for the time our staff spend on it, unless the inspection finds a material breach of this DPA by us.

10. Liability

Each party’s liability under or in connection with this DPA is subject to the limits and exclusions in clause 8 of the Terms. This does not limit any data subject’s rights under Data Protection Law.

11. Duration, changes and law

11.1 This DPA continues for as long as we process Client Personal Data, including after the Agreement ends.

11.2 We may update this DPA under clause 10.2 of the Terms. We may also update it with less notice where needed to comply with a change in Data Protection Law or guidance from a supervisory authority.

11.3 If we can no longer meet our obligations under this DPA, we will tell you without undue delay. You may then suspend the affected processing and, if we cannot put things right within a reasonable time, end the affected part of the Agreement by written notice and receive a refund of prepaid fees for the period after it ends.

11.4 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the EU SCCs require otherwise.

Signature (optional)

The DPA applies without signature. For clients who want a signed copy:

ANNEX 1: DETAILS OF THE PROCESSING

• Subject matter and purpose: providing the Platform to you as described in the Agreement, including carrying out Agent Operations, producing Generated Output, sending messages through External Integrations you connect, storing records, support and security.

• Nature of the processing: collecting, storing, reading, organising, analysing with AI models, generating text and documents, transmitting to External Integrations, and deleting.

• Duration: for the term of the Agreement and the export and deletion periods in clause 5.7.

• Data subjects: your Authorised Users.

• Personal data: names, work contact details, user IDs, roles, login and activity logs, and messages and instructions they enter.

• Frequency: continuous for the term of the Agreement.

• Other data subjects: your staff, and contacts at your customers, suppliers, consignees, carriers and agents.

• Other personal data: names, job titles, business email addresses, phone numbers and postal addresses; signatures and authorisations on export documents; details in order emails and attachments, including emails in mailboxes you connect; EORI and VAT numbers where they identify a sole trader.

• Special categories: none expected. You must not put special category or criminal offence data into HeyWilliam.

ANNEX 2: SECURITY MEASURES

• Encryption: data is encrypted in transit using TLS 1.2 or higher, and at rest in our database and its backups. Mailbox access tokens are additionally encrypted with AES-GCM, and sign-in and session tokens are stored only as hashes.
• Access control: access to production systems and Client Personal Data is limited to named staff who need it, using individual accounts with multi-factor authentication. Access is removed on the day someone leaves and reviewed every quarter.
• Separation: each client’s data is kept logically separate. Client Personal Data is never stored in source code repositories.
• Secrets: passwords, API keys and tokens are kept out of code and stored in restricted configuration files or secret stores.
• Secure development: changes go through version control and review before release. Dependencies are monitored for known vulnerabilities and updated.
• AI providers: we use AI model providers under business terms under which they do not train on our data, and which keep API data for no more than 30 days for abuse monitoring.
• Backups and recovery: our database keeps an encrypted point-in-time recovery history for up to 30 days.
• Human approval: HeyWilliam sends email and books carriers only after a person in your team approves.
• Logging and monitoring: administrative actions and emails sent are logged and reviewed when investigating incidents.
• Incident response: we detect, contain, investigate and report personal data breaches, including notifying clients within the time in clause 6.1.
• People: staff and contractors with access to Client Personal Data are bound by confidentiality obligations.
• Deletion: data is deleted at the end of the Agreement as set out in clause 5.7.

ANNEX 3: SUB-PROCESSORS

Gmail and Outlook are not our sub-processors. When you connect a mailbox, Google or Microsoft keeps providing that mailbox to you under your own agreement with them, and HeyWilliam reads and sends mail in it as an External Integration you control.