Data processing agreement (DPA)

1. Parties and roles

For passenger and booking data processed through the Service, the Customer acts as the data controller and Tiskel acts as the processor. This includes calls, recordings, transcripts, WhatsApp and Messenger messages, phone numbers, pickup and drop-off addresses, and booking details.

Tiskel acts as an independent controller for data processed for its own business purposes, including Customer accounts, billing, contracts, support, website forms, newsletter, analytics, and security logs.

2. Subject matter, duration, and scope

The subject matter of the processing is handling the Customer's calls, messages, and taxi bookings using AI and passing bookings to the Customer's dispatch system. Processing includes collection, recording, transcription, analysis, storage, and transmission of data. Categories of data subjects: passengers and other persons contacting the Customer, and the Customer's drivers and dispatchers. Types of data: phone numbers, messaging identifiers, conversation and message content, voice recordings and transcripts, pickup and drop-off addresses, booking details, location data shared for a booking, and any other data a person provides during a conversation. The Service does not require special categories of data (Article 9 GDPR); if a person provides such data during a conversation, it is processed only to the extent necessary to handle the booking. The processing lasts for the duration of the Customer's use of the Service.

3. Tiskel obligations

Tiskel, as processor:

• processes data only on documented instructions from the Customer. The Terms, the Customer's configuration of the Service, and instructions given in writing or by email are considered instructions. If Tiskel considers an instruction to infringe data protection law, it will immediately inform the Customer;
• ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• implements technical and organisational measures required by Article 32 GDPR that are appropriate to the risk of the processing;
• engages further processors (sub-processors) only under the conditions described below and enters into a contract with them imposing the obligations required by Article 28(4) GDPR;
• assists the Customer, insofar as possible and by appropriate technical measures, in responding to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection);
• assists the Customer in meeting its obligations under Articles 32 to 36 GDPR. Tiskel notifies the Customer of a personal data breach without undue delay after becoming aware of it, together with the information Tiskel has available;
• at the end of the Service, at the Customer's choice, deletes or returns the personal data processed on the Customer's behalf, unless law requires further storage. Backup copies are deleted on their retention cycle. If the Customer does not make a choice, this is treated as an instruction to delete;
• makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR. An audit is at the Customer's cost, on at least 14 days' written notice, no more than once a year unless a supervisory authority requires it or a breach has occurred, and in a manner that does not compromise the security of other Customers' data. Tiskel first responds to written questions and provides documentation.

4. Sub-processors

The Customer gives general authorisation for Tiskel to engage sub-processors. The current list of sub-processors, including the purpose and scope of data shared, is set out in Section 5 of the Privacy Policy.

Tiskel informs the Customer of an intended addition or replacement of a sub-processor by email or through the Service. Where the change is needed for continuity or security of the Service, notice may follow the change. The Customer may raise a reasoned objection. Tiskel remains liable to the Customer for the acts and omissions of its sub-processors.

5. Transfers outside the EEA

If data is transferred outside the European Economic Area, the transfer takes place under the safeguards of Chapter V GDPR.

6. Customer obligations and liability

The Customer is responsible for informing passengers and other end users that it may use Taxi Copilot and AI-based tools to handle calls, messages, and taxi bookings, and for ensuring a valid legal basis for such processing, including call recording. The Customer is also responsible for the content of its instructions and its configuration of the Service, and for not submitting to the Service data that is not necessary to handle bookings.

Tiskel will reasonably assist the Customer in responding to end user data protection requests related to data processed through the Service. The limitations of liability in the Terms also apply to this agreement to the extent permitted by law.