SmartMeetings DPA

Variables

Parties

You, as defined in the Main Agreement, will act as the Controller.

Birdie Care Services Limited, registered in England and Wales (Company No. 10863579) ("Birdie"), will act as the Processor.
Main Agreement The document entered into by the parties entitled "SmartMeeting Additional Product Terms", to which this document is appended.
Term This DPA will commence on the Effective Date of the Main Agreement and will continue for the term of the Main Agreement.
Breach Notification Period Without undue delay after becoming aware of a personal data breach.
Sub-Processor Notification Period 14 days before the new sub-processor is granted access to Personal Data.
Liability Cap For the avoidance of doubt, this DPA will be subject to the liability limitations and exclusions of liability in the body of the Main Agreement.
Governing Law and Jurisdiction England and Wales.
Data Protection Laws

All laws and regulations which apply to the processing of Personal Data in the United Kingdom (UK). This includes the:

  • UK General Data Protection Regulation (UK GDPR)
  • Data Protection Act 2018
  • Privacy and Electronic Communications (EC Directive) Regulations 2003

each as amended from time to time.

Scope of processing

Services related to processing SmartMeeting Services
Duration of processing For the Term of this DPA
Nature and purpose of processing

Processing necessary to provide the SmartMeeting additional product:

Automated processing of audio recordings to generate meeting transcripts and structured summaries (optionally based on defined meeting templates).

Reviewing and validating a limited number of audio recordings and generated outputs for product quality assurance and improvement purposes and, where necessary, to ensure clinical safety.

(Birdie does not permit its subprocessors to use the audio recordings or generated outputs for their own purposes, such as training or fine-tuning AI models.)
Personal Data
  • Audio recordings of meetings
  • Temporarily, voice profile data for the narrow purpose of speaker diarisation (assigning speaker identity to phrases to determine "who said what")
  • Transcripts of meetings
  • AI-generated meeting summaries (optionally based on defined meeting templates) created from the transcripts
Data subjects
  • Customer employees
  • Care recipients
  • Associates (e.g. family, friends) of care recipients
  • Other individuals referenced in meetings
Special provisions None
Transfer Mechanism N/A

Annexure 1A

Security measures. Technical and organisational measures to ensure the security of Personal Data https://www.birdie.care/security-by-design

Annexure 1B

Sub-processors. Current sub-processors

https://www.birdie.care/terms/sub-processors

SmartMeeting-specific Sub-processors will be marked in the above list as such.

‍

TERMS

‍

1.  What is this agreement about?

‍

1.1  Purpose. The parties are entering into this Data Processing Agreement (DPA) for the purpose of processing Personal Data (as defined above).

‍

1.2  Definitions. Under this DPA:

(a)  Adequate country means a country or territory that is recognised under Data Protection Laws as providing adequate protection for processing Personal Data.

(b)  Controller, data subject, personal data, personal data breach, process/processing, Processor and supervisory authority have the same meanings as in the Data Protection Laws.

(c)  Sub-processor means another processor engaged by the Processor to carry out specific processing activities with Personal Data.

‍

1.3  Scope of Agreement. This DPA is limited solely to the processing of Personal Data in the SmartMeeting Services as described in the Variables table. For all other processing of Personal Data by Birdie, the standard DPA shall continue to apply.

‍

‍

2.  Each Party’s Obligations

‍

2.1  Your Obligations. You instruct Birdie to process Personal Data in accordance with this DPA, and are responsible for:

(a)  informing Birdie whether you are a Controller of the Personal Data, or a Processor to another Party;

(b)  Where you are a Controller, you warrant that all notices have been provided and all consents, licences and legal bases required to allow Birdie to process Personal Data have been obtained. You are solely responsible for ensuring that the collection and processing of the Personal Data complies with the Data Protection Laws; and

(c)  Where you are a Processor to another Party, you warrant:

(i)  that you are authorised by the Controller to appoint Birdie as a sub-processor;

(ii)  that you will communicate any applicable instructions and obligations from the Controller to Birdie in a timely manner; and

(iii)  that any instructions you give to Birdie in relation to the Personal Data have been authorised by the Controller.

‍

2.2  Birdie’s Obligations. Birdie will:

(a)  only process Personal Data in accordance with this DPA, the Main Agreement, and your instructions (unless legally required to do otherwise);

(b)  not sell, retain or use any Personal Data for any purpose other than as permitted by this DPA and the Main Agreement;

(c)  inform you immediately if (in its opinion) any instructions infringe Data Protection Laws;

(d)  use the technical and organisational measures described in Annexure 1A when processing Personal Data to ensure a level of security appropriate to the risk involved;

(e)  notify you of a personal data breach within the Breach Notification Period and provide assistance as required under Data Protection Laws in responding to it;

(f)  ensure that anyone authorised to process Personal Data is committed to confidentiality obligations;

(g)  without undue delay, provide you with reasonable assistance with data protection impact assessments, responses to data subjects’ requests to exercise their rights under Data Protection Laws, and engagement with supervisory authorities;

(h)  if requested, provide you with information necessary to demonstrate its compliance with obligations under Data Protection Laws and this DPA;

(i)  allow for audits at your reasonable request, provided that audits are limited to once a year and during business hours except in the event of a personal data breach; and

(j)  comply with the requirements of clause 6 of the Main Agreement with respect to the retention, return and deletion of the personal data.

‍

2.3  Warranties. The Parties warrant that they and any staff and/or subcontractors will comply with their respective obligations under Data Protection Laws for the Term.

‍

3.  Use of Sub-processors

‍

You authorise Birdie to engage other processors (referred to in this section as sub-processors) when processing Personal Data. Birdie’s sub-processors are listed in Annexure 1B.

‍

3.1  Sub-processor requirements. Birdie will:

(a)  require its sub-processors to comply with equivalent terms as Birdie’s obligations in this DPA;

(b)  ensure appropriate safeguards are in place before internationally transferring Personal Data to its sub-processor;

(c)  be liable for any acts, errors or omissions of its sub-processors as if they were a party to this DPA; and

(d)  ensure that Sub-processors shall not use the Personal Data for any purpose other than those stated in this DPA. For the avoidance of doubt, this includes a prohibition on using the Personal Data for model training purposes.

‍

3.2  Notifications. Birdie may appoint new sub-processors provided that they notify you in writing, in accordance with the Sub-Processor Notification Period.

‍

3.3  Objections. You may reasonably object in writing to any future sub-processor. If the parties cannot agree on a solution within a reasonable time, either party may terminate this DPA.

‍

4.  International Personal Data Transfers

‍

4.1  Instructions. Birdie may transfer data outside the UK where:

(a)  a UK data adequacy decision exists for the relevant destination country;

(b)  it has implemented a Transfer Mechanism compliant with Data Protection Laws, which for example may include a derogation pursuant to Article 49 of the GDPR or an appropriate Transfer Mechanism under UK GDPR such as an International Data Transfer Agreement; or

(c)  transfer is made to a sub-processor acting as an employer-of-record for Birdie personnel, and individuals with access are operating directly and exclusively under Birdie’s governance and controls.

‍

4.2  Transfer mechanism. Where a party to this DPA is located outside the UK, the EEA or an adequate country and receives Personal Data:

(a)  that party will act as the data importer;

(b)  the other party is the data exporter; and

(c)  the relevant Transfer Mechanism will apply.

‍

4.3  Additional measures. If the Transfer Mechanism is insufficient to safeguard the transferred Personal Data, the data importer will promptly implement supplementary measures to ensure Personal Data is protected to the same standard as required under Data Protection Laws.

‍

4.4  Disclosures. Subject to the terms of the relevant Transfer Mechanism, if the data importer receives a request from a public authority to access Personal Data, it will (if legally allowed):

(a)  challenge the request and promptly notify the data exporter about it; and

(b)  only disclose to the public authority the minimum amount of Personal Data required and keep a record of the disclosure.

‍

5.  Other Important Information

‍

5.1  Survival. Any provision of this DPA which is intended to survive the Term will remain in full force.

‍

5.2  Order of precedence. In case of a conflict between this DPA and other relevant agreements, they will take priority in this order:

(a)  Transfer Mechanism;

(b)  DPA; and

(c)  Main Agreement (including without limitation the Order and Acceptable Use Policy).

‍

5.3  Notices. Formal notices under this DPA must be in writing. The Parties agree that notices by email are deemed sufficient.

‍

5.4  Governing law and jurisdiction. The Governing Law applies to this DPA and all disputes will only be litigated in the courts of the Jurisdiction.

‍

Table of contents