1. Status and roles
This addendum is offered for incorporation between the customer identified in an accepted service agreement (controller) and Mahdi Group Ltd (processor). It becomes contractual only when properly incorporated or executed. Merely viewing this page does not execute it or provide subprocessor/transfer authorisation.
Publishing a privacy notice does not require every customer to execute this draft addendum first. A binding controller-processor contract is, however, required for processing on a customer's behalf; it may be incorporated into an appropriate agreement rather than signed as a separate document. Publishing this notice or addendum does not fulfil that contract requirement.
The customer determines the lawful purposes and instructions for its website data. ConvertAI's separate controller processing, such as its own billing/security records, is described in the Privacy Policy. This addendum does not remove either party's statutory responsibilities.
2. Processing schedule to confirm with each customer
| Item | Proposed description |
|---|---|
| Subject and nature | Hosting, storing, organising, displaying, transmitting to authorised destinations, analysing and deleting website enquiry, recording, reporting and related workflow data as configured. |
| Purposes | Provide the selected website/bot/reporting/optimisation services, customer-authorised assistance and necessary support/security, not unrelated advertising, sale of data or cross-site person profiling. |
| People | Customer website visitors and enquirers, customer contacts and authorised workspace users whose data are included in customer-controlled material. |
| Data | Submitted contact/answer data; masked recording events and device/page context; permission records; selected integration/report data; task/content material containing personal data where authorised. No special-category data is authorised by default. |
| Duration | The agreed service period and documented lawful instructions, subject to the application defaults and safeguards in Privacy Policy section 9. Record the actual service, support/incident requirements and agreed return/deletion arrangements in the customer schedule. |
| Locations and transfers | OVHcloud production VPS in France, confirmed by the operator; configured application data stores and inspected deployment backups are on that server. Email uses 20i / Stackmail. Other supplier locations, provider-managed copies and any applicable transfer mechanism must be verified and documented. |
3. Instructions and confidentiality
Process customer personal data only on documented lawful instructions, including instructions about transfers, unless a binding legal requirement requires otherwise. Inform the customer of that requirement where legally permitted, and promptly flag an instruction believed to infringe applicable data-protection law.
Restrict access to authorised people with appropriate confidentiality obligations. Do not repurpose customer data for unrelated advertising, data brokerage or general-purpose model training. Customer responsibility for its lead-retention decisions does not excuse the processor from following lawful instructions.
4. Security and assistance
Apply technical and organisational measures appropriate to the processing and risk. The security schedule should record the implemented workspace/role controls, secure transport, encrypted integration credentials, masking and capture limits, incident handling, backups and access review. No unverified certification, complete at-rest encryption, recovery time or absolute-security guarantee is represented here.
Assist the customer, taking account of the processing and available information, with rights requests, security obligations, breach assessment/notification, impact assessments and regulator consultation. Notify the customer of a relevant personal-data breach without undue delay and provide information as it becomes available. The incident contacts and operating procedures must be verified before execution.
5. Subprocessors and transfers
Use subprocessors only with the customer's required prior written authorisation. An agreed general-authorisation process must identify the register, a notice period for changes and a meaningful objection/resolution process. Do not deem those details accepted merely because a draft register is online.
Require equivalent applicable data-protection obligations from an authorised subprocessor and retain the processor's responsibility for its performance. Document actual processing countries and any required adequacy decision, UK transfer addendum/IDTA or other lawful safeguard before a restricted transfer. This addendum does not by itself execute a transfer mechanism.
6. Return, deletion and accountability
At the end of processing, delete or return customer personal data at the customer's choice and delete existing copies unless applicable law requires storage. Document the practical export, active-system deletion, backup expiry and restoration safeguards. The application-managed backup default is 35 days, subject to the verification/hold safeguards in the Privacy Policy; it is not an agreed account-closure window or a promise about all provider copies. Do not retain customer leads indefinitely or promise a deadline not supported by the actual service.
Make the information reasonably needed to demonstrate compliance available and allow appropriate audits/inspections under agreed protective arrangements. Assistance and audit arrangements must not obstruct statutory rights or expose another customer's information. Commercial costs, liability, contacts and service-specific details must be agreed without reducing mandatory processor obligations.