The contract behind the privacy policy.
Our DPA describes what TAO does with customer-controlled data in plain terms, against the elements GDPR Article 28 requires. Clients may request a counter-signed copy.
Subject matter and duration
TAO processes personal data on behalf of the customer organisation for the term of the agreement covering the customer’s use of the TAO platform. Processing ends when the agreement ends, subject to the deletion timelines documented in the privacy policy.
Nature and purpose of processing
TAO processes personal data to build and run the customer’s TAO, including: connecting to authorised providers, surfacing operational records, generating drafts via Andy, routing approvals, and maintaining the audit trail. Processing is performed only for purposes explicitly disclosed in the privacy policy and the customer agreement.
Type of personal data
Names, contact details, organisational roles, communication metadata, email and calendar content the customer connects, customer-relationship records the customer maintains in TAO, and provider artefacts (invoices, jobs, tasks) as needed for the connected workflow.
Categories of data subjects
Customer employees and authorised users; the customer’s own customers, contractors, suppliers, and other contacts the customer chooses to bring into TAO via provider connections.
Controller and processor obligations
The customer organisation is the controller of personal data processed inside its TAO. TAO is the processor. TAO commits to processing only on documented customer instructions, to confidentiality obligations for personnel, to assistance with data-subject requests, to security measures appropriate to the risk, and to deletion or return of data on instruction.
Subprocessors and change notice
TAO uses a limited set of subprocessors for hosting, model inference, email delivery, observability, and security. The current list is maintained on the privacy page. TAO commits to advance notice of new subprocessors with a reasonable objection window.
International transfers
Where personal data is transferred outside the EEA or UK, TAO relies on the European Commission Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, alongside any additional measures required by the data exporter’s impact assessment.
Audit rights and information
TAO commits to providing the customer with the information needed to demonstrate compliance with the data-processing obligations above, including audit reports or equivalent attestations where available, and to permitting reasonable audits with appropriate notice.
How to get a counter-signed copy
Enterprise customers and customers in regulated industries may request a counter-signed DPA by emailing support@theartificialorganisation.com. We will share our latest template, accept reasonable redlines, and counter-sign before account access is granted for the engagement.
Questions people ask about data
What about privacy and data processing agreements?
Our privacy policy sets out what is collected and why, and a data processing agreement is available for every client. Both are public on this site.
Where is our data and who can see it?
Every client sits on its own isolated database on restricted-access secure servers. There is no shared database between clients. Inside your workspace, each person sees what their role and permissions allow, and Andy respects the same permissions.
Is our data used to train AI models?
No. Your data is used only to run your business inside your workspace. It is never used to develop or train general models for anyone else.
One conversation about how your business works.
Half an hour with the people who would build it. Then a proposal for exactly what TAO should take off your plate.