GDPR and UK GDPR
Last updated: 14 August 2026
How Inqelo supports customers processing personal data from the European Economic Area and the United Kingdom.
1. Our roles
For personal data relating to a customer's prospects, callers, enquirers and staff appearing in interactions, individuals identified in documents the customer uploads, and individuals appearing in publicly accessible web content retrieved on the customer's instruction ("Customer Personal Data"), the customer is the controller and Inqelo is the processor. Where the customer is itself a processor for another controller, Inqelo acts as its sub-processor.
Inqelo is separately the controller of personal data relating to its own account holders. That processing is explained in the Privacy Policy.
2. Contract and transfer safeguards
The Data Processing Agreement forms part of the Terms of Service and contains the processor obligations required by Article 28 GDPR.
The DPA incorporates the completed European Commission Standard Contractual Clauses. Module 2 applies where the customer is a controller; Module 3 applies where the customer is a processor. The completed UK International Data Transfer Addendum applies to transfers governed by UK GDPR.
Customer Personal Data is stored at rest in EU regions under those safeguards. Inqelo is established in Australia, and limited authorised personnel may access the Service from Australia under the safeguards described in the DPA, including the Standard Contractual Clauses. Certain infrastructure providers may process network traffic or associated metadata outside the EEA as disclosed in the sub-processor list. This is not a claim that Customer Personal Data is immune from non-EU jurisdiction.
3. Processing and retention
Inqelo processes Customer Personal Data only on the customer's documented instructions to capture enquiries, transcribe and understand them, derive lead information and value, and return results or configured signals to the customer's systems. Customer Personal Data is not used to train models or combined across customers.
AI processing. The Service's extraction process is automated end to end with artificial-intelligence systems: all content received by the Service is extracted with AI and then passed through generated algorithms and software that interact with AI systems, and the Service's outputs are AI-generated.
Customers choose a company retention period from the options offered in the Platform, including an unlimited-retention election. The default is 365 days, and data is deleted when the elected period expires.
4. Data-subject rights
Inqelo provides appropriate functionality and reasonable assistance to help customers respond to applicable data-subject requests, including access, portability and erasure. Inqelo forwards any request it receives directly to the relevant customer without responding on the customer's behalf.
5. Security overview
Controls include encryption in transit and at rest, role-based access, company isolation, protected credentials, minimised security logging, backup protection, customer-controlled retention, erasure and incident response.
The complete contractual technical and organisational measures are in Schedule 2 of the DPA and are available to signed-in account holders for pre-contract review. This public overview deliberately does not publish detailed security-control information.
6. Sub-processors
The authorised providers that process Customer Personal Data are listed on the Sub-processors page. Customer-configured destinations and Stripe's account-holder billing processing are outside that list because they do not process Customer Personal Data as Inqelo sub-processors.
7. EU and UK representatives
European Union: Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria.
United Kingdom: Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom.
Both representatives can be contacted through the Prighter portal. Quote reference ID-19935887204.
8. Privacy contact
For privacy, data protection or customer due-diligence questions, email admin@inqelo.com.