Data Processing Terms (summary)

These terms apply when IBIOS Limited (company number NI743167) processes personal data for a customer ("you") through the IBIOS service. They form part of our Terms of Service and meet the requirements of Article 28 of the UK GDPR. To receive a signed copy, email hello@allforone.ai.

1. Roles

You are the controller of the personal data you put into IBIOS. We are your processor. We process it only to provide the service, and only on your documented instructions: these terms, your settings in the service, and your written requests.

2. What we process

• Subject matter: providing the IBIOS service, including the data you sync to services you connect, such as QuickBooks or Xero.
• Duration: for as long as your subscription lasts, plus the export and deletion period in section 8.
• Types of data: contact details (name, address, email, phone); quote, job, order, invoice and payment records; appointment details; messages and notes; and, where you switch these features on, call recordings and transcripts. Account users' identity and audit data. We ask you not to put health data or other special category data into IBIOS.
• Data subjects: your customers and enquirers, your staff and contractors, and your suppliers' contacts.

3. Our obligations

We will:

• process personal data only on your instructions, and tell you if we believe an instruction breaks data protection law;
• make sure everyone who can access the data is bound by confidentiality;
• keep appropriate security in place (section 9);
• help you respond to requests from individuals exercising their rights, and with security, breach notification, impact assessments and consultation with the ICO, taking into account the information available to us;
• give you the information needed to show we comply with these terms, and allow audits as described in section 10.

4. Sub-processors

You give general authorisation for us to use the sub-processors listed on our Sub-processors page. We will give at least 30 days' notice before adding or replacing one. If you object on reasonable data protection grounds and we cannot resolve your concern, you may end the affected service without penalty. We place equivalent data protection obligations on each sub-processor and remain responsible for them.

5. International transfers

We will only transfer personal data outside the UK with a lawful safeguard: a UK adequacy regulation, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. The safeguard for each provider is shown on the Sub-processors page.

6. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting your data. We will give you the information you need to meet your own reporting duties, and help you contain and resolve it.

7. Requests from individuals

If an individual contacts us directly about data you control, we will pass the request to you and will not respond to it ourselves unless you tell us to. The service gives you tools to find, export, correct and delete records.

8. When the service ends

You can export your data for 30 days after your subscription ends. We then delete your Customer Data from the live system, and it is removed from backups as they expire on their normal cycle. We keep data for longer only where the law requires us to. Account and audit records that we hold as controller are kept as set out in our Privacy Policy.

9. Security measures

• Separation: each customer's data is kept separate, enforced in the database for every request.
• Access control: permissions by role and by user, controlled by your administrators.
• Encryption: encryption in transit (TLS). Stored secrets and integration tokens are encrypted.
• Audit: changes are recorded in audit logs.
• Authentication: passwords are stored only as hashes, and sessions expire.
• Backups: regular backups of the production system.
• Staff access: our staff access your data only when it is needed to support you or to run the service.
• Testing: changes are tested before release. Our test system uses test data or data with personal details removed.

10. Audits

On reasonable notice, and no more than once a year unless a regulator requires it or after a breach, we will answer your written security questions and provide the evidence you reasonably need. Audits must not give access to other customers' data.

11. Liability

Liability under these terms is subject to the limits in our Terms of Service, except where the law does not allow it to be limited.

Change history

• 1.0, 16 October 2026: First published summary.