Legal
Data Processing Agreement
Last updated
This DPA forms part of the service agreement between Sensa Intelligence FZCO, Trade Licence 91128, and the customer identified in the accepted order. The customer is controller of its CRM personal data; Sensa is processor.
Processing scope
Sensa processes personal data to provide the modules selected in the order: CRM synchronisation, conversation analysis, risk detection, Broker DNA, Conversion and ROI, and optional Lina qualification or Luna reactivation. Operations include retrieval, storage, analysis, scoring, message generation, authorised sending, export and deletion. Processing lasts for the service term and the return or deletion period.
Data and individuals
Individuals include customer prospects, clients, brokers, employees and authorised users. Data may include names, contact details, CRM identifiers, property interests, budgets, timelines, messages, call notes or transcripts where enabled, tasks, activity records and linked AI outputs. Unnecessary sensitive data must not be submitted.
Instructions and customer duties
Sensa processes data only on documented instructions in the agreement, approved settings and authorised written requests, or as legally required. Sensa informs the customer of an instruction it considers unlawful and of mandatory processing unless notice is prohibited. The customer is responsible for lawful collection, notices, permissions, outreach restrictions and appropriate human review of AI outputs.
Confidentiality and security
Sensa restricts access to authorised personnel bound by confidentiality and maintains technical and organisational safeguards appropriate to the risks. These include access controls, protected transmission, credential protection and incident response. Sensa provides current security information on request. Sensa does not sell customer personal data. It does not use it to train shared AI models without separate written permission.
Providers and transfers
The customer gives general written authorisation for the hosting, AI and communications providers identified in the subprocessor list supplied before processing begins. The list states each provider’s purpose and processing location. Sensa gives at least 15 days’ notice of additions or replacements and allows reasonable data protection objections. Unresolved objections permit termination of the affected service. Sensa imposes equivalent relevant obligations and remains responsible for delegated processing. International transfers require the safeguards applicable law requires; this DPA does not replace mandatory transfer clauses.
Incidents and assistance
Sensa notifies the customer without undue delay after becoming aware of a personal data breach, provides available details and updates, and assists with containment and required notifications. Sensa forwards data subject requests and provides reasonable assistance with rights requests, impact assessments and regulator consultations.
Return and deletion
At the end of service, the customer may request return of its personal data; otherwise Sensa deletes it. Unless a different period is agreed, Sensa completes return and deletion from active systems within 30 days and removes residual backups within 90 days. Legally required records may be retained with access restricted. Sensa confirms deletion on request.
Verification and precedence
Sensa provides information needed to demonstrate compliance and allows proportionate audits by the customer or its confidential independent auditor on reasonable notice, without exposing other customers’ data. Confidentiality and protection duties continue while data is retained. This DPA prevails over conflicting service terms on personal data. Applicable data protection law governs these duties; other disputes follow the service agreement. Contact [email protected].