Data Processing Agreement & Standard Contractual Clauses

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Provonic ("Makli", the "Processor") and the customer (the "Controller"). It applies whenever Makli processes personal data on the customer's behalf, and incorporates the transfer mechanisms in section 9. A countersigned copy is available on request.

1. Roles and scope

The customer is the controller of the personal data held in the helpdesk, billing and control-panel systems it connects to Makli, and of any other personal data it instructs Makli to process. Makli is the processor and will process that data only to provide the service and as documented in the Terms, this DPA and the customer's configuration of the service. The customer's configuration — which systems are connected and which actions are enabled, and at which level — constitutes its documented instructions.

2. Details of the processing

Subject matter	Automated handling of customer-support tickets and chats, and the account actions needed to resolve them.
Duration	The term of the customer's subscription, plus the deletion period in section 11.
Nature and purpose	Reading tickets, chats and connected account data; generating replies, drafts and internal notes; performing the actions the controller has enabled (for example changing PHP settings, updating DNS records or preparing invoices); recording an audit log.
Categories of data subjects	The controller's customers and their end users; the controller's staff who use Makli.
Categories of personal data	Names, email addresses and other contact details; account, service, domain and billing information; the content of tickets, chats and attachments; technical data such as IP addresses and server settings. Special-category data is not sought and is processed only where it appears in ticket content.

3. Processor obligations

Makli will:

• process personal data only on the controller's documented instructions, including with regard to international transfers, unless required to do otherwise by law, in which case Makli will inform the controller before processing where the law allows;
• tell the controller immediately if, in Makli's opinion, an instruction infringes data-protection law;
• ensure that people authorised to process the data are bound by confidentiality;
• implement the technical and organisational measures in section 7 and the Annex;
• respect the conditions for engaging sub-processors in section 6;
• assist the controller, taking account of the nature of the processing, in responding to data-subject requests and in meeting its obligations on security, breach notification, impact assessments and prior consultation;
• delete or return all personal data at the end of the service as set out in section 11;
• make available the information necessary to demonstrate compliance, and allow for and contribute to audits as set out in section 8.

4. Controller obligations

The controller is responsible for the lawfulness of the personal data it makes available to Makli, for providing any notices and obtaining any consents required from its own customers and end users, for the instructions it gives — including which actions it enables and at which level — and for reviewing Makli's drafts, approvals and audit logs.

5. Confidentiality of personnel

Makli restricts access to personal data to personnel who need it to provide the service and requires them to keep it confidential. Staff sign-ins to Makli's administration systems are logged.

6. Sub-processors

The controller gives Makli general authorisation to engage sub-processors for hosting, AI model inference, email delivery and payment processing. At the date of this DPA, Makli's sub-processors include:

Sub-processor	Purpose	Company location
Anthropic, PBC	AI model inference (Claude models), under Anthropic's Commercial Terms	United States
Contabo GmbH	Server hosting for the Makli service	Germany

The complete current list is available on request to sam@makli.com. Makli will give the controller at least 30 days' notice before adding or replacing a sub-processor; the controller may object on reasonable data-protection grounds within that period, and if the parties cannot resolve the objection the controller may terminate the affected service without penalty. Makli imposes data-protection obligations on each sub-processor equivalent to those in this DPA and remains liable for their performance.

7. Security measures

Makli implements and maintains at least the technical and organisational measures described in the Annex, and will not materially reduce the overall level of protection during the term. Makli may update individual measures to keep pace with technical developments, provided the level of security is not reduced.

8. Audits and information

On written request, and no more than once a year unless required by a supervisory authority or following a personal data breach, Makli will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to reasonable security questionnaires. Where that information is insufficient, the controller or an independent auditor bound by confidentiality may audit Makli's relevant processing on reasonable notice, during business hours and without unreasonable disruption.

9. International transfers

Makli is established in the United Kingdom. Where Makli or a sub-processor transfers personal data to a country without an adequacy decision — for example, AI model inference by Anthropic in the United States — the parties rely on the following, which are incorporated into this DPA by reference:

• For transfers subject to the UK GDPR: the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as issued by the Information Commissioner under s.119A of the Data Protection Act 2018.
• For transfers subject to the EU GDPR: the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor) as applicable, with the optional docking clause, and with the details of the processing in section 2 and the measures in the Annex forming the relevant annexes.

Makli will carry out and document transfer risk assessments where required and apply supplementary measures where necessary.

10. Personal data breaches

Makli will notify the controller without undue delay after becoming aware of a personal data breach affecting the controller's data, and will provide the information reasonably available to help the controller meet its own notification obligations, including the nature of the breach, the categories and approximate numbers of data subjects and records affected, the likely consequences, and the measures taken or proposed.

11. Deletion and return

On termination or expiry of the service, Makli will, at the controller's choice, return the controller's personal data in a commonly used format or delete it, and will delete existing copies within 90 days unless UK or EU law requires longer retention. Connected third-party systems remain the controller's own and are unaffected.

12. Data-subject requests

If Makli receives a request from a data subject relating to personal data it processes for the controller, it will not respond on the merits but will promptly forward the request to the controller and assist as described in section 3.

13. Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. If this DPA conflicts with the Terms, this DPA prevails on matters of data protection. If the Standard Contractual Clauses or UK transfer instruments conflict with this DPA, those instruments prevail.

14. Governing law and signed copies

This DPA is governed by the laws of England and Wales, except that the Standard Contractual Clauses and UK transfer instruments are governed as provided within them. Customers who need a countersigned DPA, or executed transfer clauses with their details completed, can request them from sam@makli.com.

Annex — Technical and organisational measures

Integrity and authenticity of connections

• Every request between the controller's WHMCS and Makli, in both directions, is signed with HMAC-SHA256 using the controller's own key, over the timestamp, a single-use nonce, the method, the path and a digest of the body; signatures are compared in constant time.
• Requests outside a five-minute window, and any reused nonce, are rejected. Keys are generated from a cryptographically secure source, can be rotated, and identify the organization — the organization is never taken from the request body.
• Single sign-on links expire after two minutes; tool access for the AI during a job uses signed tokens limited to 15 minutes and 25 calls.

Encryption

• Stored secrets — AI provider keys and the passwords and tokens customers save in the Client Portal — are encrypted at rest with authenticated encryption (Fernet); administration secrets use AES-256-GCM. Keys are held separately from the data with owner-only permissions and can be rotated.
• Makli verifies TLS certificates on its outbound connections to the controller's WHMCS, AI providers and partner APIs.
• Live-chat context passed to the AI is stored encrypted and erased when the chat turn ends.

Access control

• Individual accounts for staff; passwords hashed with bcrypt (cost 12); rate limiting of sign-in and two-factor attempts; two-factor authentication (TOTP), which the owner can require for every administrator.
• Session cookies are HttpOnly, Secure and SameSite; session identifiers are renewed on sign-in and every 30 minutes; idle and absolute session limits apply; all form submissions are protected against cross-site request forgery.
• Each organization's data is scoped to that organization by its signed key.

Control of automated actions

• Each action that changes data is set by the controller to Off, Explain only, Ask me first or Automatic, separately for tickets and live chat, with optional daily limits and minimum confidence. Stricter platform limits apply on top, including caps for sensitive, financial and destructive actions in live chat and mandatory human approval for the riskiest actions.
• Account changes are performed only for the verified account holder; unverified requesters receive read-only help without other clients' personal data.
• "Ask me first" actions wait in an approval queue in the controller's WHMCS; changes proposed to staff in WHMCS require that staff member's confirmation and respect their WHMCS permissions.
• A test mode replays real tickets while holding back every change, reply and note.
• Before a website file is edited a backup is made and verified; many changes are read back after they are made; a failed change is reported to staff rather than to the end user as a success.

Data minimisation and confidentiality

• The controller can choose client fields (name, email, company, address, phone, country) to be replaced with placeholders before data is sent to Makli and the AI.
• Action results are redacted before storage; secret-looking values are masked in logs and administration screens; secrets found in website files are removed before the AI reads them; request bodies containing account context are not written to the WHMCS module log.
• Makli does not use controller personal data to train or fine-tune AI models; AI inference is provided by Anthropic under Commercial Terms that state Anthropic may not train models on customer content.

Logging and accountability

• Every action Makli runs, its result and the underlying API calls are logged against the ticket or chat they belong to; changes to action permissions and staff sign-ins are recorded in audit logs; tool calls carry idempotency keys so a retried call is not run twice.

Retention

• Live-chat uploads are deleted after 30 days, empty chats after five minutes and cached image readings after 45 days; other personal data is deleted or returned as set out in section 11.