Data Processing Terms
These terms apply when MAISIE AI LIMITED ("Maisie", the processor) processes personal data on behalf of a dealer using Maisie DMS (the controller). They form part of our Terms of Service and are intended to meet Article 28 of the UK GDPR.
1. Scope of processing
| Subject matter | Providing Maisie DMS: dealer website, AI sales assistant, enquiry handling, bookings, messaging and lead management. |
|---|---|
| Duration | For the term of the dealer's subscription and until deletion under section 9. |
| Data subjects | The dealer's prospective and existing customers, website visitors who make contact, and the dealer's staff users. |
| Personal data | Names, phone numbers, email addresses, vehicle interests, viewing and test drive requests, part-exchange details, payment intention (cash or finance, not financial account data), messages, call details and, where enabled, call recordings and transcripts. |
| Special category data | Not intended. The dealer should not ask customers for it through Maisie DMS. |
2. Our commitments
- We process personal data only on the dealer's documented instructions, including those given through the dealer's use and settings of the service, unless the law requires otherwise.
- Everyone authorised to process the data is bound by confidentiality.
- We apply appropriate technical and organisational security measures, including encryption in transit, encrypted credentials, access controls and logging.
- We assist the dealer, taking into account the nature of the processing, in responding to data subject requests and in meeting its security, breach notification and impact assessment obligations.
- We notify the dealer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting its data.
- We make available the information needed to demonstrate compliance with these terms and allow for reasonable audits, on reasonable notice.
3. Sub-processors
The dealer gives general authorisation for us to use sub-processors for hosting and security, our customer engagement platform, AI model and voice providers, email, SMS and telephony, and payments. We impose data protection obligations on each that are no less protective than these terms, and remain responsible for them. We keep a list of our sub-processors by name, available on request, and will tell dealers before adding or replacing one so they can object on reasonable grounds.
4. International transfers
Where a sub-processor processes data outside the UK we ensure an appropriate safeguard is in place, such as the UK data bridge or an international data transfer agreement.
5. AI processing
Conversation content is processed by AI providers only to generate the assistant's replies and summaries for the dealer. We do not permit it to be used to train general-purpose models.
6. Third-party vehicle data
Stock data obtained from a source the dealer authorises, such as Autotrader, is processed only to provide the service to that dealer, is not shared with other dealers, and is deleted within 30 days of authorisation being withdrawn or the subscription ending.
7. The dealer's responsibilities
The dealer is responsible for having a lawful basis for the processing it instructs, for giving its customers the privacy information the law requires, and for the lawfulness of its instructions.
8. Deletion and return
On termination the dealer can export its customer data for 30 days after its website closes. We then delete it, and delete all of the dealer's data within 90 days of the plan ending, unless the law requires us to keep it.
9. Contact
To request our sub-processor list, a signed copy of these terms, or anything else about data protection, email dms@maisie.website.