Legal

Data processing agreement

How Titanom.AI processes personal data on your behalf when you use the Titan OS platform.

Last updated: 13 October 2026

1. Who this agreement is between

This agreement is between TITANOM.AI LIMITED, trading as Titanom.AI, company number 12431645, registered in England and Wales ("we", "us", the processor), and the client using the Titan OS platform ("you", the controller).

It forms part of our terms of service and your programme agreement, and applies automatically while you use the platform. It meets the requirements of Article 28 of the UK General Data Protection Regulation (UK GDPR).

2. What it covers

It covers personal data that you, or your team, put into the platform about other people, such as your clients, leads, prospects and staff, and that we process on your behalf to provide the platform and our services to you. The details are in Annex 1.

It does not cover your own account and sign-in information, which we handle as a controller under our privacy policy.

Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in UK GDPR.

3. Your responsibilities

  • You decide what personal data goes into the platform and why, and you are responsible for having a lawful basis to process it and for telling the people concerned.
  • You will not put special category data, such as health information, into the platform unless it is needed and you have a lawful basis for it.
  • Your use of the platform, and the instructions you give us, will comply with data protection law.

4. Our responsibilities

Instructions

We will only process the personal data on your documented instructions. Using the platform as intended, and anything you ask us to do in writing, counts as your instructions. We will not use it for our own purposes. If we think an instruction breaks data protection law, we will tell you. If the law requires us to process the data in another way, we will tell you first, unless the law does not allow us to.

Confidentiality

Everyone we allow to process the personal data is bound by a duty of confidentiality.

Security

We keep appropriate technical and organisational measures in place to protect the personal data, as required by Article 32 of UK GDPR. The current measures are set out in Annex 2.

Sub-processors

You give us general permission to use sub-processors. The current ones are listed on our sub-processors page. We will give you at least 14 days' notice by email before adding or replacing one. If you object on reasonable data protection grounds within that time, we will work with you to find a solution. If we cannot, you may end the affected services.

Each sub-processor is bound by a written contract that gives at least the same protection as this agreement. We remain responsible to you for what our sub-processors do.

International transfers

The platform's database and files are stored in London. Where a sub-processor processes personal data outside the UK, we make sure the transfer is covered by the safeguards required under UK data protection law, such as UK adequacy regulations or the UK International Data Transfer Addendum.

Helping you

  • If someone asks to use their data protection rights, we will help you respond. If the request comes to us, we will pass it to you without undue delay and will not answer it ourselves unless you ask us to.
  • We will give you reasonable help with security, data protection impact assessments and any consultation with the Information Commissioner's Office, taking into account the information available to us.

Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay, and in any event within 48 hours. We will give you the information you need to meet your own obligations, keep you updated, and take reasonable steps to contain it and stop it happening again.

When the services end

When our services to you end, we will delete the personal data within 30 days, or return it to you first if you ask us to before then. We may keep a copy only where the law requires us to, and it stays protected by this agreement while we do.

Showing we comply

If you need to check that we meet this agreement, we will give you the information you reasonably need and help with any reasonable check you or your auditor carry out.

5. How long it lasts

This agreement lasts for as long as we process personal data on your behalf. The parts on deletion, confidentiality and security continue for as long as we hold any of that data.

6. Changes

We may update this agreement to reflect changes in the law or in how the platform works. We will update the date at the top of this page, and if a change materially affects you, we will tell you before it takes effect.

7. The law that applies

This agreement is governed by the law of England and Wales, and the courts of England and Wales deal with any dispute about it.

Annex 1: details of the processing

  • Subject matter: providing the Titan OS platform and Titanom's coaching and consultancy services to you.
  • Duration: for as long as you use the platform, and until the data is deleted or returned under section 4.
  • Nature and purpose: storing, organising, displaying and analysing the information you put into the platform, producing reports, plans and summaries (including with AI), recording and transcribing coaching calls, sending notifications, and supporting you.
  • Types of personal data: names, contact details, business and job details, and any other information about people that you or your team add to the platform, including in check-ins, notes, messages, files and coaching calls.
  • Categories of people: your team members, and your clients, customers, leads, prospects, suppliers and contacts.
  • Special category data: none is expected. See section 3.

Annex 2: security measures

  • The platform's database, sign-in and file storage are hosted in London.
  • All connections are encrypted in transit, and data is encrypted at rest by our hosting provider.
  • Database access rules mean each client can only see their own data, and team members only what they have been given.
  • Two-factor sign-in with an authenticator app is available on every account.
  • Every sign-in is recorded with date, time, device and IP address. Repeated failed sign-ins are detected and alerted, and unusual activity is reviewed.
  • Records of failed sign-in attempts are deleted automatically after 90 days.
  • Limits on how often AI features and sign-ups can be used, to stop abuse.
  • Incoming connections from our call recording provider are checked to confirm they are genuine.
  • Error reports have names, email addresses and IP addresses removed before they leave the platform.
  • Everyone who uses the platform agrees not to share anything from it outside their business.
  • Access to production systems is limited to the people who need it to run and support the platform.

Annex 3: sub-processors

The current list of sub-processors, what each one does and where it is based, is on our sub-processors page.