Data Processing Addendum

Effective date: 24 October 2026

This Data Processing Addendum (DPA) forms part of the Raq.com Terms of Service (Terms) between Vu AI Ltd (Raq.com, we, us) and the business or organisation that uses the Services (you). It applies whenever we process personal data on your behalf, and takes effect when you accept the Terms. You do not need to sign it. If you need a signed copy for your records, email privacy@raq.com.

1. Definitions

Data Protection Law: the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) and, where they apply to you, the EU GDPR and other laws on personal data and electronic marketing.
Customer Personal Data: personal data we process on your behalf when providing the Services, as described in section 4.
Controller, processor, data subject, personal data, personal data breach and processing have the meanings given in the UK GDPR.
Subprocessor: a third party we engage to process Customer Personal Data.
Other capitalised words have the meanings given in the Terms.

2. Roles

For Customer Personal Data you are the controller and we are your processor. We are a controller for the personal data we need to run your Account, bill you, keep the Services secure and meet our own legal duties, as described in our Privacy Policy; this DPA does not cover that data.

When you send email or other messages with the Services, you are the sender and instigator of those messages under PECR. An email account or other messaging account you connect and pay for yourself is engaged by you under your own contract with that provider. It is your provider, not our subprocessor, and we pass messages to it on your instructions.

3. Your instructions

We process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you first unless the law forbids it. Your instructions are the Terms, this DPA and the way you configure and use the Services, including the contacts you import, the messages you send and the automations you switch on. We will tell you if we think an instruction breaks Data Protection Law.

You are responsible for the lawfulness of your instructions, for having a lawful basis and, for marketing, the consent or soft opt-in PECR requires for every person you contact, for the accuracy of the consent records you give us, and for giving people the privacy information the law requires.

4. Details of the processing

Subject matter and duration: providing the Services to you for as long as you use them, and afterwards for the period in section 11.
Nature and purpose: hosting, storing, organising, analysing, transmitting and deleting data so that the Services you choose work, including AI features, and keeping the Services secure and protecting recipients from abuse.
Data subjects: your users and team members; your customers, prospects, contacts and supporters; people who receive or reply to your messages; and anyone else whose data you put into the Services.
Types of personal data: names and contact details (email addresses, phone numbers, postal addresses); CRM records and notes; consent records and their history (what each person agreed to, the wording shown, where, when and how they agreed, and for Raq.com forms and opt-in pages their IP address and browser); opt-out and suppression lists; message content, delivery statuses, opens, clicks and replies; files, documents, recordings and other content you upload or create; and usage data linked to your users.
Special category data: you must not put special category or criminal offence data into the Services unless you need to, the law allows it and you have assessed the risk. Messaging features must not be used to target people by special category data.

5. Our people

Only people who need access to provide or support the Services can access Customer Personal Data, and each of them is bound by a duty of confidentiality.

6. Security

We keep appropriate technical and organisational measures in place to protect Customer Personal Data, taking account of the risks of the processing, as Article 32 of the UK GDPR requires. They include encryption in transit, encryption of stored provider keys and tokens, access controls, logging, backups and regular security reviews, and the measures described on our AI Privacy & Security page. We may update these measures, but never in a way that lowers the overall protection.

7. Subprocessors

You give us general authorisation to engage Subprocessors. Our current Subprocessors are listed at raq.com/subprocessors. We will update that page before a new Subprocessor processes Customer Personal Data and notify affected customers of material changes. If you object on reasonable data protection grounds, tell us within 30 days; we will try to address your concern, and if we cannot, you may stop using the affected Service. Each Subprocessor is bound by written terms that give the same level of protection as this DPA, and we remain responsible for them.

8. International transfers

Where Customer Personal Data is transferred outside the UK, we make sure a lawful transfer mechanism is in place, such as UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

9. Helping you

Taking into account the nature of the processing and the information available to us, we will help you, through the Services' features or otherwise:

respond to people exercising their rights (access, correction, deletion, objection and the rest). If a person contacts us directly about Customer Personal Data, we will pass the request to you and not answer it ourselves unless you ask us to
meet your security, breach notification, data protection impact assessment and prior consultation duties under Articles 32 to 36 of the UK GDPR
show a regulator, a provider or a recipient the consent records we hold for you.

10. Personal data breaches

We will tell you without undue delay after we become aware of a personal data breach affecting Customer Personal Data. We will give you the information you need to meet your own duties, including what happened, the data and people affected, the likely consequences and what we are doing about it, and send more as we learn it. Telling you is not an admission of fault.

11. Deletion and return

You can export your Content at any time. When you stop using the Services, we will, at your choice, return Customer Personal Data to you (through export) or delete it, and delete any remaining copies within the periods described in our Privacy Policy, unless the law requires us to keep it. Opt-out and suppression records may be kept for as long as needed to make sure people who opted out are not contacted again.

12. Audits

We will make available the information you reasonably need to show that we meet our obligations under Article 28 of the UK GDPR. If that information is not enough, you or an independent auditor bound by confidentiality may audit our compliance once a year, on at least 30 days' notice, at your cost, during business hours and without disrupting the Services. You may audit more often where a regulator requires it or after a personal data breach affecting you.

13. Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law does not allow them. If this DPA and the Terms conflict on the processing of Customer Personal Data, this DPA applies.

14. Changes and contact

We may update this DPA when the law or the Services change. The date above changes with it, and we will tell you before a material change takes effect. Questions about this DPA or our processing: privacy@raq.com, or write to Vu AI Ltd, Suite 15, 1666 High Street, Knowle, Solihull, B93 0LY. Company number 15766790.