This section explains the main points of the data processing agreement in plain English. The full agreement below forms part of your agreement with us when you accept the Terms. If there is any inconsistency between this summary and the full agreement, the full agreement governs.
Who is who
For your customers' data, you are the controller and Adminmate is your processor. In plain terms: it is your customer list, and we handle it only to run your office, on your instructions.
We process it to answer your calls where your plan includes call answering, send your documents, chase your invoices and keep your records, and to test and check the service using redacted and minimised examples, as the full agreement describes. We do not use it to train general-purpose AI models or for advertising.
The commitments
We keep it secure, our main database is in London, we tell you without undue delay if anything goes wrong, and we delete it when you tell us to or when you leave.
Sub-processors (the companies that run our hosting, calls, texts and AI) are listed on our sub-processors page and held to the same standard. We email you at least 14 days before we add or replace one.
The full agreement is below, and it forms part of your agreement with us when you accept the Terms.
Version 2026-09-26. Published here on 20 October 2026.
1. Roles
1.1 The subscribing business (the "controller") is the controller, and Mitigate It Limited ("Adminmate") is its processor, for personal data that Adminmate processes on the controller's behalf to provide the service, whether the controller supplies it or Adminmate collects it for the controller from the controller's customers and contacts by phone, message, email or web link, and including recordings and transcripts of calls to the controller's customer line. The details are in the Annex.
1.2 Mitigate It may be controller for account, billing, security, support and other data where it determines the purposes and means.
2. Instructions
Adminmate processes personal data only on documented instructions, including those in the Subscriber Terms, the customer's configuration and the processing expressly described in this Agreement.
The controller documents the following instruction as part of the service: Adminmate may select appropriately redacted and minimised examples from messages and call transcripts processed through the service for testing, validation and quality assurance of the Adminmate service. Before an example is placed into the controlled testing environment, direct identifiers are removed or transformed, relevant indirect identifiers are generalised, timestamps are reduced to month where applicable, no key is retained linking the example back to the original record, and every example is manually reviewed before use. The testing process does not retain a mapping key to the original customer record. This activity is limited to testing, validation and quality assurance of the contracted Adminmate service and is not an instruction to use customer content to train general purpose AI models or for advertising.
2A. Unlawful instructions
Adminmate will tell the controller promptly if it reasonably considers an instruction to infringe data protection law and will not knowingly follow that instruction unless and until the instruction is confirmed or changed. Where the law requires Adminmate to process personal data other than on the controller's instructions, Adminmate will tell the controller first unless the law prevents it.
2B. The controller's responsibilities
The controller confirms that: (a) it has a lawful basis for the processing it instructs, including sending messages to its customers through the service; (b) it gives its customers, staff and other individuals the information the law requires, including that calls are recorded and transcribed and that the service uses automated systems; (c) its instructions, settings and the data it supplies comply with data protection and electronic marketing law; and (d) where it connects a service it has its own account with, such as accounting software, it has instructed Adminmate to send personal data to that service, which is the controller's own supplier and not Adminmate's subprocessor.
3. Confidentiality
Persons authorised to process personal data are subject to confidentiality obligations.
4. Security
Adminmate maintains appropriate technical and organisational measures, including access control, authentication, logging where implemented, secure hosting, vendor controls and incident response.
5. Subprocessors
5.1 The controller gives general authorisation for Adminmate to use the subprocessors listed in the Subprocessor Register published on the Adminmate website. Adminmate will impose data protection obligations on each subprocessor that give the protection required by Article 28(4) and remains responsible to the controller for their performance as the law requires.
5.2 Adminmate will tell the controller of any intended addition or replacement of a subprocessor by updating the Register and emailing the account owner at least 14 days before the change takes effect.
5.3 The controller may object on reasonable data protection grounds within that period. The parties will discuss the objection in good faith. If it cannot be resolved, the controller may cancel the subscription before the change takes effect and will receive a refund of unused prepaid time in the usual way.
5.4 Where a change is needed urgently for security, legal or service continuity reasons, Adminmate may make it with shorter notice and will tell the controller as soon as reasonably practicable, with the same right to object and cancel.
6. International transfers
Where a restricted transfer occurs, Adminmate will use an appropriate UK GDPR transfer mechanism and complete the required transfer assessment/data protection test where required.
7. Data subject requests
Adminmate will assist the controller, by appropriate technical and organisational measures and taking into account the nature of the processing, in responding to requests from individuals exercising their rights. The export and correction tools in the service are the primary means of assistance. If an individual contacts Adminmate directly about the controller's data, Adminmate will pass the request to the controller without undue delay and will not respond to it except on the controller's instruction.
8. Breach assistance
Adminmate will notify the controller without undue delay after becoming aware of a personal-data breach affecting the controller's data and provide reasonably available information needed for assessment and notification.
The notification will describe, so far as then known, the nature of the breach, the categories and approximate numbers of individuals and records concerned, the likely consequences and the measures taken or proposed. Information may be provided in stages. A notification is not an admission of fault or liability.
9. DPIAs and regulator assistance
Adminmate will provide reasonable assistance with DPIAs and regulatory consultations where required by Article 28.
10. Deletion/return
At termination, Adminmate will return or delete personal data in accordance with the controller's instructions and the Retention Schedule, subject to legal retention, legal holds and backup requirements.
The standard service commitment gives the customer 90 days of read-only access after cancellation for download. This does not prevent earlier deletion where requested and lawful, and does not override legal retention or a legal hold.
11. Audit
11.1 Adminmate will make available the information reasonably necessary to demonstrate compliance with Article 28, including by answering a reasonable written questionnaire and providing relevant supplier and security documentation.
11.2 Where that information is not sufficient to demonstrate compliance, or a regulator requires it, Adminmate will allow for and contribute to an audit or inspection by the controller or an independent auditor it appoints, on at least 30 days' written notice, during business hours, no more than once in any 12 months (except after a personal data breach affecting the controller or where a regulator requires it), subject to the auditor agreeing to confidentiality and Adminmate's security requirements, and without access to other customers' data.
11.3 Each party bears its own costs of an audit, unless the audit shows a material breach by Adminmate.
12. Liability
Liability between the parties is subject to the Subscriber Terms, except where mandatory law provides otherwise.
13. Duration and order of precedence
13.1 This Agreement lasts for as long as Adminmate processes personal data on the controller's behalf, including during the read-only period after cancellation and until deletion under clause 10.
13.2 If this Agreement conflicts with the Subscriber Terms about the processing of personal data, this Agreement prevails, except for clause 12 (liability).
14. Changes to this Agreement
14.1 Adminmate will tell the controller of any proposed change to this Agreement separately from any change to the Subscriber Terms, by email to the account owner at least 30 days before it takes effect, with the new wording. Changes to subprocessors follow clause 5 instead.
14.2 The controller may object to a change on reasonable data protection grounds before it takes effect. The parties will discuss the objection in good faith. If it cannot be resolved, the controller may cancel the subscription before the change takes effect and will receive a refund of unused prepaid time in the usual way.
14.3 Where a change is required for legal or regulatory compliance, Adminmate may make that change with shorter notice where that is legally necessary, and will tell the controller as soon as reasonably practicable.
14.4 Continued use of the service alone is not treated as agreement to a change to this Agreement.
Annex: details of the processing
Subject matter: Providing the Adminmate service to the controller under the Subscriber Terms
Duration: The subscription, the 90 day read-only period after cancellation, and the retention periods in the Retention Schedule, subject to legal holds
Nature and purpose: Answering, recording and transcribing calls to the controller's customer line; receiving and sending messages and emails; organising enquiries, customers, jobs, bookings and diary information; preparing, sending and recording acceptance of quotes and invoices; payment reminders; suggesting matches between bank transactions and invoices where enabled; posting to accounting software the controller connects, on the controller's approval; passed-on enquiries on the controller's instruction; storage, backup, security and support; the service testing and quality assurance described in clause 2
Types of personal data: Names; phone numbers; email and postal addresses; job, property and enquiry details; messages; call recordings and transcripts; photos; quotes, invoices, payment and deposit records; document opening events; bank transaction references used for matching; notes the controller records
Categories of individuals: The controller's customers and prospective customers; people who call or message the controller's line; landlords, tenants and other contacts linked to a job; the controller's staff and team members
Special category data: Not intended. It may be volunteered by callers (for example, health information about a vulnerable occupant). The controller should not instruct its collection.