Data processing agreement

Last updated: 16 October 2026

This agreement forms part of the Terms of service between ional.eu (Jools Moore, sole trader, Malta, trading as ional.eu and ional.ai, "Processor", "ional") and the customer ("Controller", "Customer"). It applies automatically to every customer. It covers GDPR Article 28 where ional processes personal data on the Customer's behalf. Terms such as "personal data", "processing" and "data subject" have the meaning in Regulation (EU) 2016/679 ("GDPR").

How ional handles personal data as a controller (for example account, billing and website data) is in the privacy policy. This agreement does not repeat it.

1. Roles

The Customer is the controller of personal data in its Customer Content (the Company Brain, uploaded documents, client and sales information, and the inputs and outputs of its app runs).
ional is the processor of that data.
For account, billing and security data about the Customer's users, ional is an independent controller (see the privacy policy).
For public LinkedIn data that ional collects to run Discovery, Signals, Prospect research and Brain quick start, ional acts as an independent controller, as the privacy policy describes. Once that data is delivered in the Customer's report, the Customer is responsible for its own use of it.

2. Subject matter, duration, nature and purpose

Subject matter and purpose: providing the ional.ai Service to the Customer: storing the Company Brain, running apps, producing outputs, collecting public information the Customer asks for, and giving support.
Nature: storage, retrieval, analysis, generation, transmission to sub-processors, deletion.
Duration: the period of the Customer's account, plus the retention periods in section 10.

3. Categories of data and data subjects

Data subjects: the Customer's staff and users; the Customer's clients, prospects, contacts and partners; people named in uploaded documents, meeting recordings or transcripts; people named in public professional information the Customer adds to its Company Brain or app inputs.
Categories of data: names, job titles, employers, business contact details, content of business communications and documents, meeting audio and transcripts, public LinkedIn post content and stated profile details, images and video supplied by the Customer.
The Customer must not upload special category data or data about criminal convictions unless it is necessary and the Customer has a lawful basis.

4. Customer instructions

ional processes personal data only on the Customer's documented instructions. The Terms, this agreement and the Customer's use of the app features are those instructions. If ional believes an instruction breaks the law it will tell the Customer. ional may process data where the law requires it, and will tell the Customer unless the law forbids this.

5. Confidentiality

ional keeps Customer personal data confidential and allows access only to people who need it to provide the Service and who are bound by confidentiality.

6. Security measures

ional uses the following measures: - encryption of data in transit; - passwords stored as hashes with a per-user salt; - access keys for service access; - sign-in session tracking, with expired sessions and reset links removed on expiry, and sign-in history (IP address and browser) kept for 30 days; - role-limited administrator access, with an audit log; - data export and deletion tools in the app.

No system is perfectly secure. ional will review these measures as the Service changes.

7. Sub-processors

The Customer gives general written authorisation for ional to use sub-processors.
The current list is on the sub-processors page.
ional will change the list by updating that page. It will notify customers of new sub-processors by updating the page and its date, and by email where practical, before the new sub-processor starts to process Customer personal data.
The Customer may object on reasonable data protection grounds within 14 days of the change by writing to [email protected]. The parties will then try to find a solution. If none is found, the Customer may cancel the affected subscription.
ional is responsible for its sub-processors and imposes data protection terms on them that are no less protective than these.

8. International transfers

Some sub-processors are in the United States or elsewhere outside the EEA. Where they rely on a transfer mechanism, ional relies on: the EU-US Data Privacy Framework where the vendor is certified, and the European Commission's Standard Contractual Clauses where the vendor offers them. The basis for each vendor is shown on the sub-processors page. Where the Customer is the exporter and ional is the importer, the parties agree the SCCs (Module Two) apply to the extent GDPR requires them.

9. Assistance

ional will, taking account of the nature of the processing, reasonably help the Customer to: - respond to data subject requests (the Customer can export and request deletion in the app; ional will help with anything else); - meet its security, breach notification, impact assessment and prior consultation duties, where ional holds the information needed.

If a data subject contacts ional about Customer data, ional will refer them to the Customer, unless the law requires otherwise.

10. Breaches

ional will tell the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, with the information it then has, and will keep the Customer updated.

11. Deletion and return

The Customer can export all its data at any time in the app.
On a deletion request, sign-in stops at once and data is deleted 14 days later.
After account closure ional deletes Customer data 12 months after closure.
LinkedIn profile cache is deleted 90 days after its last update. Unconverted trial accounts are deleted 90 days after the last trial ended.
ional may keep data only where the law requires. Stripe keeps billing records as tax law requires. Usage and cost records (account ID and spend only) are kept for accounting.

12. Audits

On reasonable written request, and no more than once a year unless there has been a breach, ional will give the Customer the information needed to show it meets this agreement. The Customer may carry out an audit on reasonable notice, in business hours and at its own cost, without risk to other customers' data.

13. Liability

Each party's liability under this agreement is subject to the limits in the Terms of service.

14. Order of precedence and law

If this agreement conflicts with the Terms on personal data, this agreement applies. Maltese law and the courts of Malta apply, as in the Terms.

15. Contact

[email protected]
43 Solana Court, Triq is-Sirk, Is-Swieqi SWQ 3214, Malta