Great Wave AI Data Processing Agreement (“DPA”)

Last updated: 2nd December 2024

1. Definitions

“Services” means the Great Wave AI platform (https://app.greatwave.ai/ or variations of [subdomain].greatwave.ai). The Services are provided “as is” without any express or implied warranties.

“You” or “Your” means you or the entity that you represent in accepting these Terms. If signing up for a Enterprise Account, you represent and warrant that (i) you have full legal authority to bind your employer or such entity to these Terms; (ii) you have read and understand these Terms; and (iii) you agree to these Terms on behalf of such employer or entity.

“Your Data” means any data or information in any form or medium uploaded to the Great Wave AI platform, via any channel (including, but not limited to via our web interface or via our API endpoints), by yourself, for the provision of the Services under this agreement, including without limitation any personal data but excluding any data or information which Great Wave AI obtains from third parties in the course of providing the Services.

“Data Protection Legislation” means, to the extent applicable to these Terms, (i) the United Kingdom General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003, and the Security of Network & Information Systems Regulations 2018, all as amended and/or replaced, and in force from time to time, (ii) the General Data Protection Regulation 2016 (EU) 2016/679 and all other applicable laws and regulations relating to data protection and privacy, and (iii) all related statutory codes of practice and guidance issued by any relevant data protection authority.

“Personal Data”, “process”, and “processor” have the meanings given in the applicable Data Protection Legislation.

“The Parties” means you and Great Wave AI.

2. Types of Personal Data

The Parties acknowledge that the types of Personal Data processed pursuant to this DPA (including the subject matter, duration, nature and purpose of the processing and the categories of data subject) are as set out below:

Subject matter: Great Wave AI’s provision of the Services to you.

Duration: the Term or such shorter period as may be required for the performance of the Services;
Nature: the collection, storage, duplication, deletion, and disclosure of personal data pursuant to providing the Services to you.
Purpose of processing: to enable Great Wave AI to perform the Services in accordance with this DPA and the Terms of Service;
Type of Personal Data (which may be contained within Partner Data):

Identity Details: Names, user identifiers, marital status, titles, birth dates, gender, job titles, and images.
Contact Information: Addresses, email addresses, phone numbers, and social media handles.
Financial Information: Bank and payment card details, along with transaction data.
Technical Specifications: IP addresses, login details, browser types, time zones, operating systems, and device details.
Usage Insights: Information on the Agent Interactions.
Health Records: Physical or mental health data, including medical conditions and healthcare information.
Biometric Identifiers: Fingerprints, voiceprints, and facial recognition data used for identification.
Employment Background: Employment history, performance evaluations, qualifications, and employment documents.
Educational Achievements: Educational history, including grades, transcripts, and qualifications.
Geographical Data: Information on an individual’s physical location.
Legal Records: Information on criminal convictions, offences, and related security measures.
Sensitive Personal Data: Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health-related data, and information concerning a person’s sex life or sexual orientation.

Categories of data subject: you, your employees and other members of staff, including, without limitation: all current and former employees, workers, officers, individual contractors, seconded and contingent workers, applicants, interview candidates, interns (including university students), agency workers, consultants, executive and non-executive directors, members, partners and agents.

3. Agreement Between Parties

In relation to all personal data provided or made available to Great Wave AI by or on behalf of you, Great Wave AI:

acknowledges that, as between the Parties, it acts only as a processor;
shall only process such personal data in accordance with this agreement and your instructions issued from time to time;
shall immediately inform you if, in Great Wave AI’s opinion, any instructions given to it by you in relation to the processing of such personal data under this agreement infringe any Data Protection Legislation;
shall implement and operate, and shall procure that any permitted sub-processor implements and operates, appropriate technical and organisational measures to ensure:

the protection of the rights of the relevant data subjects; and
a level of security appropriate to the risks that are presented by any processing of such personal data, in particular protection from accidental loss or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed by Great Wave AI pursuant to this agreement;

shall not, without your prior written consent, transfer any such personal data to a country or territory outside the UK or the European Economic Area unless adequate contractual or other assurances have first been put in place such as will enable each party to comply with the requirements of the Data Protection Legislation; you acknowledge and agree that Great Wave AI may process Personal Data in the United States and other jurisdictions outside the UK and the European Economic Area (EEA) using Microsoft Azure services for the purpose of providing the Services.
shall take reasonable steps to ensure the reliability of its personnel who have access to any such personal data and ensure that such personal data shall only be accessible by its personnel to the extent they need to know or require access for the purpose of properly performing their duties in relation to this agreement and who, where relevant, understand the confidentiality of such personal data (and who are contractually bound to maintain its confidentiality);
may engage any sub-processor provided that such engagement is made on the basis of a written contract between Great Wave AI and the sub-processor which imposes on the sub-processor terms substantially equivalent to the provisions of this DPA. Great Wave AI shall give you notice of any proposed additional or replacement sub-processor. Great Wave AI shall be responsible for the management of any permitted sub-processor and its compliance with such terms and shall be directly liable to you for any breach of the same;
shall notify you without undue delay of any breach of the provisions of this DPA and provide assistance to you in respect of any such breach;

shall provide timely cooperation and assistance to you in ensuring compliance with:
Your obligations to respond to any complaint or request from any applicable data protection authority or data subjects seeking to exercise their rights under any Data Protection Legislation, including by promptly notifying you of each subject access request Great Wave AI receives;
Your obligations set out under Articles 32 – 36 of the GDPR to:

(A) ensure the security of the processing;
(B) notify the relevant supervisory authority and any data subjects, where relevant, of any personal data breach;
(C) carry out any data protection impact assessments (“DPIA”) on the impact of the processing on the protection of personal data; and
(D) consult the applicable regulator prior to any processing where a DPIA indicates that the processing would result in a high risk in the absence of measures taken by Partner to mitigate the risk; and

shall make available to you all information reasonably required by you to demonstrate Great Wave AI’s compliance with its obligations set out in this DPA and allow and participate in any data protection audits and inspections conducted by you or another auditor mandated by you.

4. Contact Information

If you have any questions about this DPA, please contact us at:

Email: contact@greatwave.ai