Legal

Data Processing Terms

Last updated 4 September 2026

These terms apply where we process personal data on your behalf as part of the platform services. In that relationship you are the controller and we are the processor. They form part of our terms of service.

1. Scope of processing

We process the personal data you and your customers provide to the platform, including names, contact details, call recordings and transcripts, messages, notes and job information, for the purpose of providing the services described in your order confirmation and for no other purpose. Data subjects are your customers, prospects, staff and other people you communicate with through the platform.

2. Our obligations

We will:

  • Process personal data only on your documented instructions, which include these terms and your configuration of the platform, unless required by law.
  • Make sure people with access to the data are bound by confidentiality.
  • Apply appropriate technical and organisational security measures, summarised on our security page.
  • Engage subprocessors only under a written contract imposing equivalent obligations, and keep an up-to-date list on our subprocessors page. We will give you at least 30 days' notice of new subprocessors and you may object on reasonable grounds.
  • Help you respond to requests from data subjects and meet your obligations on security, breach notification and impact assessments, taking into account the nature of the processing.
  • Notify you without undue delay after becoming aware of a personal data breach affecting your data.
  • At the end of the services, delete or return the personal data at your choice, unless we are required by law to keep it.
  • Make available the information needed to demonstrate compliance and allow audits, on reasonable notice and no more than once a year unless required by a regulator.

3. Your obligations

You will make sure you have a lawful basis for the processing you instruct us to carry out, provide appropriate privacy information to your customers, and configure the platform, including consent and opt-out handling, in line with your obligations.

4. AI processing

Some features send data to AI model providers to generate transcripts, summaries and drafts. These providers are listed as subprocessors. We contract with them on terms that prohibit the use of your data to train their models. Outputs are returned to you for review and approval according to the settings you choose.

5. International transfers

Customer records are hosted in the United Kingdom. Where a subprocessor processes data outside the UK we rely on an adequacy decision, the UK International Data Transfer Agreement or the UK addendum to the EU standard contractual clauses.

6. Duration

These terms apply for as long as we process personal data on your behalf.

Step Into AI is a trading name of Manchester PC Services Ltd, company number 13356970, registered office Jactin House, 24 Hood Street, Ancoats, Manchester, M4 6WX. Contact: info@stepinto-ai.com.