Data Processing Terms
How we handle your customers’ details on your behalf, as UK data protection law asks.
- Your customers’ details are yours. We only use them to run your service.
- We tell you quickly (within 48 hours) if there is ever a breach.
- Texts, chats and voicemail are deleted automatically after set periods.
- When you leave, you get an export of your data, then we delete it.
1. Who is who
These terms apply to the personal data of your customers, enquirers and website visitors that goes through the MagiLux Growth System (“Customer Data”). They form part of the Terms of Service between you and MagiLux Media Ltd.
For Customer Data, you are the controller: you decide why and how it is used, because it is about your customers and your business. MagiLux is your processor: we handle it only to run the service for you. “Controller”, “processor”, “personal data” and “personal data breach” have the meaning they have in the UK GDPR and the Data Protection Act 2018.
For information about you and your staff (your login, billing and account details), we are the controller. That is covered in our Privacy Policy, not here.
2. What we process
| Subject matter | Running your website assistant, missed-call text-back, enquiries, bookings, reminders, review requests, quote follow-ups, voicemail and your results reports. |
|---|---|
| Duration | For as long as the agreement lasts, plus the export and deletion period when it ends (section 9). |
| Nature and purpose | Receiving, storing, organising, sending and deleting messages and enquiries; answering website chat with an AI assistant; recording voicemail and typing it out; taking and reminding about bookings; counting website visits. |
| Types of data | Names, phone numbers, email addresses, the content of texts, website chats and enquiries, booking details, voicemail recordings and typed copies, and anonymous website visit counts. If you connect your calendar, the times and titles of events. |
| Whose data | Your customers, people who enquire or book, callers, and visitors to your website. Also, to the extent they appear, your staff. |
| Sensitive data | The system is not built to collect special category data (such as health information). People sometimes mention such things in messages, for example when booking. Please do not ask for it unless you need it. If it is sent to us we treat it with the same care. |
3. What we will do
We will:
- Process Customer Data only on your documented instructions, which are the agreement, your use of the app, and anything you ask us in writing (including by WhatsApp or text), unless the law requires something else, in which case we tell you first if we are allowed to. If we think an instruction breaks data protection law, we will tell you.
- Make sure everyone at MagiLux who can see Customer Data is bound by confidentiality.
- Keep it secure with measures suitable for the risk (section 5).
- Not sell it, use it for advertising, or use it for our own purposes beyond running and securing the service and producing counts of how the service is being used.
- Help you meet your own duties, for example by giving you the tools in the app to find, correct and delete a customer’s details, and helping with data protection impact assessments or requests from the regulator, within reason.
- Pass on to you, without answering them ourselves, any request we receive from someone about their data (for example a request to see or delete it).
4. Other companies that help us
You give us general permission to use the companies below to help run the service (“sub-processors”). We have contracts with them that require data protection terms like these. We stay responsible for them.
| Company | What they do |
|---|---|
| Cloudflare | Hosts and stores the system and its data; converts voicemail recordings into text. |
| Twilio | Sends and receives texts and handles calls and voicemail. |
| Anthropic | Writes the website assistant’s answers from the messages visitors send. Under Anthropic’s commercial terms, content sent through its business service is not used to train its models. |
| Apple, Google and Mozilla | Deliver notifications to your phone when you turn them on. |
| Google, Meta and TikTok | Only if you choose to connect your calendar or social accounts. |
We will tell you at least 30 days before adding or replacing a sub-processor that handles Customer Data. If you reasonably object, we will talk it through, and if we cannot resolve it you can end the agreement without paying anything extra.
5. Security
We use measures suitable for the risk, including:
- All connections to the system are encrypted (HTTPS).
- Logins use a one-time code sent by text; there are no shared passwords to leak. Sign-in sessions expire.
- Keys that connect your accounts (such as Google Calendar) are stored encrypted.
- Access is limited to the people who need it, and the system does not use cookies or advertising trackers.
- Texts, chats and voicemail are deleted automatically after fixed periods (section 6).
- The system is tested automatically before every update goes live.
6. How long we keep things
| Wording of texts | Cleared after 90 days |
|---|---|
| Website chat transcripts | Deleted after 180 days |
| Voicemail recordings and typed copies | Deleted after 90 days |
| Calendar events | Refreshed every 15 minutes; only the past week and next two months are kept |
| Website visitor information | Daily totals only; the one-day visitor codes are deleted the next day |
| Customer records and bookings | Kept while you are with us, then exported and deleted when the agreement ends |
You can delete a customer and their messages at any time in the app, or your whole account, and we do it straight away.
7. If something goes wrong
If we become aware of a personal data breach affecting Customer Data, we will tell you without undue delay, and in any case within 48 hours, with what we know about what happened, what data is involved and what we are doing about it. That lets you decide whether you need to report it to the Information Commissioner’s Office and to the people affected. We will help you with that.
8. Data sent outside the UK
Some of our sub-processors are based outside the UK or use servers outside the UK, for example in the United States. Where that happens we make sure the transfer is protected by one of the safeguards UK law allows: the UK’s adequacy decisions (including the UK–US data bridge for companies certified under it), the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
9. When the agreement ends
When the agreement ends, for any reason, we will:
- Within 14 days of the end date, send you an export of your Customer Data in a common format that opens in Excel, covering your customers, messages and chats that are still held, bookings and review requests. If you ask for an export earlier, we will send it.
- Within 30 days after we send the export, delete Customer Data from our live systems, including voicemail audio, and any connection keys. If you tell us you do not need the export, we will delete it sooner.
- Confirm in writing when it is done.
The only exceptions are copies we must keep by law, and these stay protected and are used only for that purpose. Copies in any backups are removed as those backups expire. We keep our own business records of the agreement (such as invoices) for as long as the law requires, as set out in the Privacy Policy.
10. Showing we comply
We will give you the information you reasonably need to check we are meeting these terms. If that does not satisfy you, you may carry out an audit, not more than once a year, with 30 days’ written notice, during normal working hours and without disrupting the service. You cover the cost, and we will help in good faith.
11. What we need from you
As the controller, you are responsible for:
- Having a lawful reason to use your customers’ details and to contact them, and telling them how you use their information (the assistant tells people they are talking to an assistant, and voicemail callers are told they are being recorded).
- Keeping the system for the purposes it is designed for, and following the messaging rules in the Terms of Service. Only the messages that are allowed by law and by the agreement should be sent.
- Paying your data protection fee to the Information Commissioner’s Office, if you are required to.
- Deleting or correcting a customer’s details when they ask, using the tools in the app, or telling us if you need our help.
12. Liability and priority
The limits on liability in the Terms of Service apply to these terms. If these terms and the Terms of Service disagree about how personal data is handled, these terms win. Nothing here limits either of us in a way that data protection law does not allow.
Questions about these terms: magiluxmedia@gmail.com or WhatsApp 07438 771105.