Layer's Data Processing Addendum
About this Addendum
This Data Processing Addendum, including its annexes (the "DPA"), forms part of the agreement governing the use of the Layer Service (the "Agreement") between the organisation using the Service ("Customer") and Layer AI Systems Ltd, company number 15632925 ("Layer"). The Agreement is made up of Layer's Terms & Conditions and any Order Form signed by Layer and Customer (an "Order").
The DPA applies where Layer processes Customer Personal Data on Customer's behalf. By entering into the Agreement, each party agrees to this DPA. Capitalised terms not defined here have the meaning given in the Agreement.
"Customer Content" means the data and content submitted to the Service by or for Customer, obtained from Customer's connected services, or generated specifically from that material for Customer (called "Your Data" in the Terms & Conditions). "User" means a person authorised by Customer to use the Service.
Definitions
"Applicable Data Protection Law" means privacy, data protection, and data security law applicable to Layer's processing of Customer Personal Data under the Agreement, including the UK GDPR, EU GDPR, Data Protection Act 2018, Swiss Federal Act on Data Protection, and applicable US State Privacy Laws.
"Controller", "Data Subject", "Personal Data", "Process", "Processor", and "Supervisory Authority" have the meanings given by Applicable Data Protection Law. "Business", "Contractor", and "Service Provider" have the meanings given by applicable US State Privacy Laws.
"Customer Personal Data" means Personal Data contained in Customer Content that Layer processes on Customer's behalf to provide the Service.
"EU GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the EU GDPR as incorporated into United Kingdom law, together with applicable amendments and the Data Protection Act 2018.
"Information Security Incident" means a confirmed breach of Layer's security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data. It does not include unsuccessful attempts that do not compromise Customer Personal Data.
"Restricted Transfer" means a transfer of Customer Personal Data that requires an approved transfer mechanism under Applicable Data Protection Law.
"Subprocessor" means a third party engaged by Layer to process Customer Personal Data on Customer's behalf.
"EU SCCs" means the European Commission standard contractual clauses adopted by Implementing Decision (EU) 2021/914. "UK Addendum" means the ICO's International Data Transfer Addendum to the EU SCCs, version B1.0, as revised in accordance with its mandatory clauses.
Roles and Scope
Customer is a Controller or Processor, as applicable. Layer is a Processor of Customer Personal Data. If Customer is a Processor, Layer is Customer's Subprocessor and Customer confirms that its instructions and appointment of Layer are authorised by the relevant Controller.
The subject matter, duration, nature, purpose, data categories, and Data Subjects are described in Annex 1.
This DPA continues for as long as Layer processes Customer Personal Data, regardless of expiry or termination of the Agreement.
Layer may process some personal data as an independent Controller, including account administration, billing, security, legal-compliance, and business-contact data. That processing is governed by Layer's Privacy Policy and is outside this DPA.
Customer Instructions
Layer will process Customer Personal Data only:
- on Customer's documented instructions, including the Agreement, Orders, Customer's configuration and authorised use of the Service, and written instructions consistent with the Agreement;
- as necessary to provide, secure, support, and maintain the Service; or
- where required by applicable law, in which case Layer will inform Customer before processing unless the law prohibits notice.
Layer will promptly inform Customer if, in Layer's reasonable opinion, an instruction infringes Applicable Data Protection Law. Layer may suspend the affected processing while the parties resolve the issue.
An instruction requiring material changes or work outside the Service is subject to written agreement and reasonable additional fees.
Confidentiality and Access
Layer will ensure that people authorised to process Customer Personal Data are bound by confidentiality obligations and receive access only where reasonably necessary for their role.
Security
Layer will maintain technical and organisational measures designed to provide security appropriate to the risk, taking into account the state of the art, implementation costs, and the nature, scope, context, and purposes of processing. The current categories of measures are described in Annex 2.
Layer may update its measures to reflect changes in technology, threats, law, or the Service, provided the overall protection of Customer Personal Data is not materially reduced.
Customer is responsible for secure configuration of the Service within its control, management of Users and permissions, protection of credentials and devices, and lawful use of connected services.
Information Security Incidents
Layer will notify Customer without undue delay after becoming aware of an Information Security Incident affecting Customer Personal Data. Initial notice will not await a completed investigation.
As information becomes reasonably available, Layer will provide relevant details about the nature of the incident, likely consequences, affected data, mitigation, and a contact point. Layer may provide information in phases and may withhold information where disclosure would create a security risk, breach law, or compromise another customer.
Layer will take reasonable steps to contain, investigate, and mitigate the incident and will reasonably assist Customer with legally required notifications. Notification does not constitute an admission of fault or liability.
Assistance and Data Subject Requests
Taking into account the nature of the processing and information available to Layer, Layer will provide reasonable assistance for Customer to:
- respond to Data Subject requests;
- maintain security of processing;
- notify Supervisory Authorities and affected Data Subjects of personal-data breaches where required;
- conduct legally required data protection impact assessments; and
- consult a Supervisory Authority where required.
If Layer receives a request relating to Customer Personal Data, Layer will, unless prohibited by law, notify Customer and direct the requester to Customer. Layer will not respond substantively except on Customer's documented instruction or where legally required.
Layer may charge reasonable fees for assistance requiring material work outside the standard Service, after giving Customer an estimate where practicable.
Subprocessors
Customer gives Layer general written authorisation to engage the Subprocessors identified in Layer's current Subprocessor List, which is available on request under confidentiality.
Layer will:
- enter into a written agreement with each Subprocessor imposing data-protection obligations appropriate to the processing and no less protective in substance than the relevant obligations in this DPA;
- remain responsible for each Subprocessor's performance of those obligations to the extent required by Applicable Data Protection Law; and
- make available the Subprocessor's name, service function, and relevant processing location or transfer information.
Layer will provide notice of a new material Subprocessor at least 30 days before it begins processing Customer Personal Data, normally by email or another notification method agreed with Customer.
Customer may object on reasonable data-protection grounds within 15 days of the notice. The parties will work in good faith to resolve the objection. If no reasonable alternative is available, Customer may terminate the affected Service by written notice before the new Subprocessor begins processing. Fees paid or due up to termination are not refunded. This is Customer's sole remedy for an unresolved Subprocessor objection.
The Subprocessor List identifies material third parties that process Customer Personal Data for Layer. It need not disclose source code, internal architecture, security configurations, ordinary business software that does not process Customer Personal Data, or a connected service with which Customer chooses to interact directly.
Return and Deletion
During the term, Customer may ask Layer at hello@withlayer.ai to export or delete supported Customer Content, or use available Service controls where they exist. Deletion instructions given during the term will be completed within 90 days unless a shorter period is legally required. Customer may export Customer Content for 30 days after termination.
Layer will delete Customer Personal Data within 90 days after termination, except where:
- applicable law requires retention;
- Customer Personal Data is contained in disaster-recovery or provider-infrastructure copies, which are placed beyond ordinary use, protected, and erased within 180 days after the deletion instruction and in any event no later than 210 days after termination; or
- limited data must be retained to establish, exercise, or defend legal claims, maintain security, or evidence billing or compliance, in each case only for as long as reasonably necessary and subject to continued protection.
Layer will cease other processing of retained Customer Personal Data and will delete it when the relevant exception ends. If data is restored from a retained copy, Layer will reapply deletion instructions before normal use.
Audits and Compliance Information
Layer will make available information reasonably necessary to demonstrate compliance with this DPA. Where available, Layer may satisfy an audit request by providing relevant independent reports, summaries, questionnaires, or other diligence materials under confidentiality restrictions.
If that information is insufficient for a requirement imposed by Applicable Data Protection Law, Customer may request an audit no more than once in any 12-month period, or following a material Information Security Incident where legally justified. The parties will agree a reasonable scope, timing, duration, confidentiality arrangement, and method designed to avoid disruption and protect other customers and Layer's security and intellectual property.
Customer will bear its audit costs and reimburse Layer's reasonable costs for material assistance outside the standard diligence process. An auditor must be independent, suitably qualified, not a Layer competitor, and bound by confidentiality.
Nothing requires Layer to disclose another customer's data, privileged information, penetration-test details, source code, credentials, threat-detection logic, or information whose disclosure would create a material security risk. Layer will provide a reasonable alternative form of evidence where possible.
Artificial Intelligence
Layer will not use Customer Personal Data to train or fine-tune a general-purpose or foundation AI model, whether owned by Layer or a third party, unless Customer expressly instructs or authorises that use in writing.
Layer will contractually prohibit an AI Subprocessor from using Customer Personal Data for its own model training or fine-tuning except where Customer has expressly authorised that use in writing.
This section does not prohibit:
- processing Customer Personal Data to provide model inference and generate requested outputs;
- retrieval, configuration, memory, or personalisation performed for Customer within the Service;
- processing necessary for security, abuse prevention, reliability, or support; or
- use of data that has been de-identified so that it can no longer reasonably identify Customer or a Data
Subject, where permitted by law.
If Customer configures the Service for automated decision-making that is intended to produce legal or similarly significant effects, Customer must notify Layer before that use. The parties will reasonably cooperate to document the processing and implement safeguards required by Applicable Data Protection Law.
Government Requests
Unless prohibited by law, Layer will notify Customer of a legally binding request from a public authority for Customer Personal Data. Layer will review the request for legal validity, disclose only the data legally required, and use reasonable efforts to redirect the authority to Customer where appropriate.
International Transfers
Layer will ensure that Restricted Transfers use a valid transfer mechanism and any supplementary measures reasonably required by Applicable Data Protection Law.
For a transfer subject to the EU GDPR where the receiving country is not covered by an adequacy decision, the EU SCCs are incorporated into this DPA as follows:
- Module Two applies where Customer is a Controller and Layer is a Processor;
- Module Three applies where Customer is a Processor and Layer is a Subprocessor;
- Clause 7, the optional docking clause, applies;
- Clause 9 uses Option 2, general written authorisation, with the notice period in section 8;
- the optional language in Clause 11 does not apply;
- for Module Two, the optional language in Clause 9(a) does not apply;
- Clause 17 uses the law of Ireland; and
- Clause 18 selects the courts of Ireland.
Annexes I and II to the EU SCCs are populated using Annexes 1 and 2 of this DPA and the parties' details in the Agreement. The competent Supervisory Authority is determined under Clause 13 of the EU SCCs.
For a Restricted Transfer subject to the UK GDPR, the EU SCCs as completed above are modified by the UK Addendum, which is incorporated by reference. Tables 1 to 3 are completed using the parties' details, Annexes 1 and 2, and the selections above. In Table 4, either party may end the UK Addendum as permitted by section 19 of its mandatory clauses.
For a transfer subject to Swiss data protection law, the EU SCCs apply with references to the EU and EU GDPR interpreted to include Switzerland and the Swiss Federal Act on Data Protection as required, and the competent authority is the Swiss Federal Data Protection and Information Commissioner.
If an approved transfer mechanism is replaced or amended, Layer may update this section on written notice to maintain lawful transfers, provided the update does not materially reduce protection of Customer Personal Data.
US State Privacy Laws
To the extent US State Privacy Laws apply and Layer acts as a Processor, Service Provider, or Contractor, Layer will:
- process Customer Personal Data only for the limited and specified purposes in the Agreement and
Customer's documented instructions;
- not sell Customer Personal Data or share it for cross-context behavioural advertising;
- not retain, use, or disclose Customer Personal Data outside the direct business relationship or combine it with personal data from another source except as permitted by applicable law and reasonably necessary to provide the Service;
- provide the same level of privacy protection required of a Processor, Service Provider, or Contractor under applicable law;
- notify Customer if Layer determines it can no longer meet an applicable obligation; and
- allow Customer to take reasonable and appropriate steps to stop and remediate unauthorised processing.
Customer Responsibilities
Customer will:
- comply with Applicable Data Protection Law and process Customer Personal Data lawfully;
- provide required notices and obtain required permissions or consents;
- ensure its instructions are lawful and that it is entitled to provide Customer Personal Data to Layer;
- use the Service's roles, permissions, and controls appropriately; and
- avoid intentionally submitting restricted or highly sensitive data unless the Agreement and Service expressly support that processing.
Liability and Conflict
Each party's liability under this DPA is subject to the exclusions and limitations in the Agreement, except to the extent Applicable Data Protection Law or the EU SCCs prohibit that limitation.
If this DPA conflicts with the Agreement on processing Customer Personal Data, this DPA controls. If the EU SCCs or UK Addendum conflict with this DPA, the applicable transfer terms control.
Changes
Layer may update this DPA where reasonably necessary to comply with law or maintain valid transfer mechanisms, provided the update does not materially reduce protection of Customer Personal Data. Material changes will be notified in accordance with the Agreement.
Acceptance
This DPA is accepted when the parties enter into an Agreement that incorporates it. If a separate signature is required, authorised representatives may sign an Order or separate copy that references this DPA.
Annex 1: Processing Details
Parties
- Processor / data importer: Layer AI Systems Ltd, company number 15632925, 1 Dukes Court, Brighton, East Sussex BN1 1BS, United Kingdom. Contact: hello@withlayer.ai.
- Customer / data exporter: The Customer identified in the Agreement. Customer's contact details are stated in the Agreement, Order, or account.
Subject Matter and Purpose
Processing Customer Personal Data to provide, secure, support, and maintain the AI-assisted revenue-team features selected and configured by Customer, including relevant assistant, roleplay, voice, meeting, coaching, analysis, integration, workflow, and administration features.
Duration
The term of the Agreement plus the return, deletion, backup, and legally required retention periods described in this DPA. Retained call recordings are kept during the subscription until Customer instructs deletion. The production application database and retained call recordings are stored in London, United Kingdom. Application processing and supporting services operate internationally, and section 13 applies to those transfers.
Nature of Processing
Collection, access, transmission, recording, organisation, storage, retrieval, consultation, analysis, transformation, generation, alignment, combination, restriction, return, and deletion, as initiated or configured by Customer and reasonably necessary to provide the Service.
Categories of Data Subjects
Customer and prospect personnel; Users and administrators; people participating in communications, calls, meetings, or customer workflows; customer, supplier, partner, and business contacts; and other people whose Personal Data Customer submits or makes available through the Service.
Categories of Customer Personal Data
Business identity and contact data; account and role data; communications and content; call, meeting, audio, transcript, and interaction data; CRM, calendar, email, document, and connected-service data; prompts and instructions; sales, coaching, performance, and workflow data; generated summaries, scores, recommendations, drafts, and other derived outputs; device, usage, and diagnostic data; and other Personal Data submitted by Customer.
Sensitive Data
The Service is not intended to require sensitive or special-category data. Such data may appear incidentally in unstructured Customer Content. Audio is Personal Data where identifiable; biometric identification is not an agreed purpose. Customer must not intentionally submit regulated credentials, full payment-card data, government identifiers, health records subject to sector-specific law, children's data, or other restricted data unless the parties have expressly agreed that the Service supports it.
Frequency
Continuous or as initiated by Customer during its use of the Service.
Subprocessors and Transfers
As described in Layer's current Subprocessor List, available on request under confidentiality, and section 13 of this DPA.
Annex 2: Security Measures
Layer's security programme includes measures appropriate to the Service and risk in the following areas:
- information-security ownership, policies, and risk management;
- personnel confidentiality, security awareness, and access lifecycle;
- logical access control, least privilege, and authentication safeguards;
- tenant and data-access separation;
- encryption in transit and at rest where appropriate;
- secure software development, change management, and review;
- vulnerability, dependency, patch, and threat management;
- event logging, monitoring, alerting, and investigation;
- incident response and breach-management procedures;
- backup, resilience, recovery, and continuity measures;
- supplier assessment and contractual data-protection controls;
- secure disposal and deletion processes; and
- periodic testing and review of relevant controls.
Layer may provide further security information through an appropriate diligence process subject to confidentiality and security restrictions.