HousingVoiceAI

Data processing agreement (DPA)

Last updated: 16 July 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between:

Creative Bridge, operator of HousingVoiceAI, of 45 Booth Drive, Park Farm Industrial Estate, Wellingborough, Northamptonshire, NN8 6NL (“Processor”, “we”, “us”, “our”)

and

the Customer (“Controller”, “you”, “your”)

(together, the “Parties”).

This DPA applies whenever the Customer submits content containing personal data to HousingVoiceAI for analysis and feedback generation.

For any data protection queries, contact us at info@creative-bridge.com.

1. Purpose

This DPA sets out the Parties’ respective rights and obligations in relation to the processing of personal data under applicable data protection laws, including:

  • The UK General Data Protection Regulation (UK GDPR);
  • The Data Protection Act 2018; and
  • Any other applicable data protection legislation.

This DPA forms part of and supplements the HousingVoiceAI Terms of Use.

2. Roles of the parties

For the purposes of applicable data protection law:

  • The Customer acts as the Data Controller.
  • Creative Bridge acts as the Data Processor.

The Customer determines the purpose and lawful basis for processing any personal data submitted to HousingVoiceAI.

Creative Bridge processes personal data solely for the purpose of providing the HousingVoiceAI service in accordance with the Customer’s instructions.

3. Subject matter of processing

The Processor provides an AI-powered content review and feedback service that analyses submitted content and generates recommendations relating to tone, clarity, readability and potential bias.

Processing activities may include:

  • Receiving submitted content;
  • Analysing submitted content;
  • Generating AI-powered feedback;
  • Displaying feedback to authorised users;
  • Maintaining limited service records and system administration functions.

4. Duration of processing

Processing takes place for as long as necessary to provide the Service.

Submitted content and AI-generated feedback are automatically removed from HousingVoiceAI systems within 24 hours of processing.

Certain account and service administration records may be retained in accordance with the Privacy Policy and Terms of Use.

5. Nature and purpose of processing

The Processor shall process personal data only to:

  • Provide the HousingVoiceAI service;
  • Generate AI-powered feedback and recommendations;
  • Support service administration and operation;
  • Maintain security and system integrity;
  • Comply with legal obligations.

The Processor shall not:

  • Sell Customer data;
  • Use Customer content for marketing purposes;
  • Use Customer content to train its own AI systems;
  • Permit third-party AI providers to use Customer content to train their models on behalf of the Processor.

6. Categories of personal data

Depending on the content submitted by the Customer, personal data may include:

  • Names;
  • Contact details;
  • Tenant or resident information;
  • Employee information;
  • Customer information;
  • Correspondence content;
  • Information voluntarily included within submitted documents or text.

The Customer remains responsible for determining whether submission of such information is lawful and appropriate.

7. Categories of data subjects

Data subjects may include:

  • Tenants;
  • Residents;
  • Customers;
  • Employees;
  • Contractors;
  • Service users;
  • Suppliers; and
  • Other identifiable individuals referenced within submitted content.

8. Customer responsibilities

The Customer warrants and confirms that:

  • It has a lawful basis for processing all personal data submitted to the Service;
  • It has provided any required privacy information to data subjects;
  • It has authority to instruct the Processor to process the personal data;
  • It will comply with applicable data protection laws;
  • It will not knowingly submit unlawful content.

The Customer should avoid submitting special-category personal data unless there is a clear lawful basis and organisational authority for doing so.

9. Processor obligations

The Processor shall:

  • Process personal data only on documented instructions from the Customer;
  • Ensure that persons authorised to process personal data are bound by appropriate confidentiality obligations;
  • Implement appropriate technical and organisational security measures;
  • Assist the Customer, where reasonably possible, in responding to data subject requests;
  • Notify the Customer without undue delay of any personal data breach affecting Customer data;
  • Provide information reasonably required to demonstrate compliance with this DPA.

10. Security measures

The Processor shall maintain appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Such measures may include:

  • Encryption of data in transit;
  • Access controls and authentication safeguards;
  • Password protection;
  • Security monitoring and logging;
  • System maintenance and software updates;
  • Restricted access to operational systems.

The Processor may update and improve its security measures from time to time provided such measures do not materially reduce the level of protection offered.

11. Sub-processors

The Customer authorises the Processor to engage third-party service providers where necessary to operate and provide the Service. These may include providers of:

  • AI and machine learning services;
  • Cloud hosting infrastructure;
  • Authentication and identity management;
  • Email delivery services;
  • Monitoring, logging and security services.

The Processor shall take reasonable steps to ensure that any authorised sub-processor is subject to appropriate contractual obligations relating to the protection of personal data.

The Processor remains responsible for the performance of its sub-processors in relation to processing carried out on behalf of the Customer.

A current list of sub-processors will be provided upon reasonable request.

12. Personal data breaches

If the Processor becomes aware of a personal data breach affecting Customer personal data, it shall notify the Customer without undue delay.

Where available, the notification shall include:

  • A description of the nature of the breach;
  • The categories of personal data affected;
  • The likely consequences of the breach;
  • Measures taken or proposed to address the breach.

The Processor shall provide reasonable cooperation in investigating and managing the breach.

13. Data subject rights

Taking into account the nature of the processing, the Processor shall provide reasonable assistance to the Customer, where practicable, to help the Customer respond to requests relating to:

  • Access;
  • Rectification;
  • Erasure;
  • Restriction of processing;
  • Data portability; and
  • Objections to processing.

14. Return and deletion of data

The Processor’s standard retention model removes submitted content and AI-generated feedback from its systems within 24 hours of processing.

Upon termination of the Service:

  • Any remaining Customer personal data held by the Processor shall be deleted unless retention is required by law;
  • Account information shall be handled in accordance with the Privacy Policy;
  • The Processor may retain information where required for legal, regulatory or security purposes.

15. Audit and compliance information

The Processor shall make available information reasonably necessary to demonstrate compliance with this DPA.

Because HousingVoiceAI is a standardised cloud service, requests for audits shall normally be satisfied through the provision of:

  • Relevant policies;
  • Security information;
  • Compliance documentation; and
  • Responses to reasonable due diligence questionnaires.

Any audit request must be reasonable, proportionate and not unreasonably interfere with the Processor’s business operations or the security of other customers.

16. Liability

Each Party shall remain responsible for its own compliance with applicable data protection laws.

Nothing in this DPA limits or excludes liability where such limitation or exclusion is prohibited by law.

Any liability arising under this DPA shall be subject to the liability provisions contained within the HousingVoiceAI Terms of Use.

17. Order of precedence

In the event of any conflict between this DPA and the HousingVoiceAI Terms of Use, the provisions of this DPA shall take precedence to the extent that the conflict relates to the processing of personal data.

18. Governing law

This DPA shall be governed by and interpreted in accordance with the laws of England and Wales.

Any dispute arising under or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

Schedule 1 – processing summary

Controller
Customer
Processor
Creative Bridge (HousingVoiceAI)
Purpose of processing
AI-powered analysis of submitted content and generation of feedback
Categories of data subjects
Tenants, residents, customers, employees, contractors, suppliers and other identifiable individuals referenced in submitted content
Categories of personal data
Names, contact information, correspondence content and other personal data voluntarily included in submitted material
Retention of submitted content
Automatically deleted within 24 hours
Retention of AI feedback
Automatically deleted within 24 hours
Retention of account information
For the duration of the customer account, subject to deletion requests and legal requirements
Sub-processors
Cloud hosting, AI providers, authentication providers, email providers and security/service monitoring providers.