HelmBack

Data Processing Addendum

Last updated: October 30, 2026

This addendum forms part of the Helm Terms of Service between Accelara AI Solutions Limited, trading as Helm (“Helm”), and the business using Helm (“you”). It applies whenever Helm processes personal data on your behalf, and you accept it when you accept the Terms. If you need a signed copy for your records, email hello@helmchat.com.

1. Definitions

  • Data protection laws means whichever of these applies to the processing: the EU General Data Protection Regulation 2016/679 (“EU GDPR”); the UK GDPR and the UK Data Protection Act 2018; the DIFC Data Protection Law, DIFC Law No. 5 of 2020, and its regulations; and UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“PDPL”).
  • Customer personal data means personal data Helm processes on your behalf through Helm.
  • Controller, processor, personal data, data subject, processing, and personal data breach have the meanings given in the data protection laws.

2. Roles

You are the controller of customer personal data and Helm is your processor. If you act as a processor for someone else, Helm is your sub-processor and you will pass their instructions on to us. Helm is a separate controller for account, billing, and usage data about you and your team, and for visitors to its own website; our Privacy Policy covers that.

3. What Helm processes

Subject
Providing Helm to you under the Terms.
Duration
For as long as the Terms apply, plus the deletion period in section 12.
Nature
Receiving, storing, organizing, searching, transcribing, analyzing with AI models, sending, and deleting.
Purpose
Answering your customers, capturing enquiries, booking appointments, handing conversations to your team, sending notifications and follow-ups, running your inbox and reports, support, and security.
People
People who contact you through Helm, such as website visitors, callers, and message or email senders; your staff named in your setup or in conversations; and others mentioned in conversations or your knowledge.
Data
Contact details (name, email, phone number, messaging profile); enquiry content and request details; conversation transcripts from chat, messaging, and email; call audio and call transcripts; booking details; and technical data, such as browser details and IP addresses, used to deliver conversations and prevent abuse.
Sensitive data
Health information that people choose to share, for example when booking at a clinic. Helm does not ask for it unless you set it up to.

Call audio is processed while the call happens. Helm stores the call transcript, not an audio recording.

4. Your instructions

Helm processes customer personal data only on your documented instructions: the Terms, this addendum, and your setup and use of Helm. If the law requires other processing, Helm will tell you first unless the law forbids it. Helm will tell you if it believes an instruction breaks data protection laws. Helm does not sell customer personal data or use it to train AI models.

5. Your responsibilities

You are responsible for having a lawful basis for the processing; giving people the privacy information the law requires, including that they are talking to an AI where that is required; getting any consent needed, for example for call transcription; carrying out any data protection impact assessment the law requires, especially where health information is involved; and making sure your instructions comply with data protection laws.

6. Confidentiality

Helm limits access to customer personal data to people who need it to run, support, or secure Helm, and makes sure they are bound by confidentiality.

7. Security

Helm uses technical and organizational measures suited to the risk, including:

  • Workspace isolation: organization membership checks, tenant boundaries in the database, and row-level security on workspace data; owner, admin, and member roles; and privileged database access only on the server paths that need it.
  • Encryption: data travels over encrypted (TLS) connections; our database and hosting providers encrypt stored data and backups; connection credentials, such as channel, calendar and store tokens and API keys you add, are encrypted with AES-256-GCM before they are stored; and production secrets are kept out of source code.
  • Access: access to production systems and customer data is limited to a small number of authorized personnel and uses multi-factor or federated sign-in.
  • Minimization: error monitoring is set to send no personal data by default, and strips user identity, cookies, headers, request bodies, and query strings; production data is not copied into development or test environments.
  • Logging: actions your receptionist takes with personal data are recorded in an audit log.
  • Change control: database changes are migration-controlled and reviewed, with access-control tests before release.
  • Backups and incidents: encrypted managed database backups, and a documented incident response process.

Helm may update these measures as long as the overall level of protection is not reduced.

8. Sub-processors

  • You give Helm general authorization to use sub-processors. The current list is on the Sub-processors page.
  • Helm puts each sub-processor under written data protection terms no less protective than this addendum, and remains responsible to you for their work.
  • Helm will give at least 30 days’ notice before adding or replacing a sub-processor, by updating that page and emailing workspace owners.
  • You may object on reasonable data protection grounds within those 30 days. We will try to resolve it in good faith. If we cannot, you may cancel the affected service and we will refund any fees you prepaid for the period after cancellation.
  • Services you connect yourself, such as Meta, Google, Cal.com and Shopify, are not Helm’s sub-processors. They process data under your own agreement with them, and Helm exchanges data with them on your instruction.

9. Requests from individuals

Helm will help you respond to people exercising their data protection rights, taking into account the nature of the processing. Owners and admins can export enquiries and remove knowledge in the dashboard; for anything else, email us and we will help. If someone contacts Helm directly about customer personal data, we will pass the request to you without undue delay and will only direct them to you, unless you ask us to do more.

10. Personal data breaches

Helm will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer personal data. We will email workspace owners with what we know: what happened, the data and people affected, the likely consequences, and the steps taken. We will add detail as we learn more, take reasonable steps to contain the breach, and help you meet your own notification duties. Telling you is not an admission of fault.

11. Impact assessments

Helm will give you reasonable information about its processing to help with data protection impact assessments and any prior consultation with a supervisory authority, including the DIFC Commissioner of Data Protection.

12. Deletion and return

When the Terms end, or when you ask, Helm will delete customer personal data within 30 days. Before then, you can export enquiries from Settings, or ask us for a copy of other customer personal data in a common machine-readable format. Helm may keep data the law requires it to keep, and this addendum continues to protect it. Copies in provider backups expire on their normal cycle.

13. Audits

Helm will make available the information needed to show it meets this addendum: this addendum, its security measures, the sub-processor list, and answers to reasonable security questionnaires, once a year or after a breach. If that is not enough, or a supervisory authority requires it, you or an independent auditor bound by confidentiality may audit Helm’s relevant processing on 30 days’ written notice, during business hours, no more than once in 12 months, at your cost, and without access to other customers’ data. For a sub-processor that publishes audit reports, Helm will rely on those reports.

14. International transfers

Helm is based in the Dubai International Financial Centre. Helm and its sub-processors process customer personal data in the United States and the other locations on the sub-processor list. Where a transfer needs a safeguard under data protection laws:

  • EU: the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (“SCCs”) are incorporated by reference: Module 2 where you are a controller, and Module 3 where you are a processor. Clause 7 applies; under Clause 9, option 2 applies with the notice period in section 8; the optional wording in Clause 11 does not apply; and under Clauses 17 and 18, the law and courts of Ireland apply. Annexes I and II are completed by sections 3 and 7 and the sub-processor list.
  • UK: the International Data Transfer Addendum to the SCCs (version B1.0), issued by the Information Commissioner under section 119A of the Data Protection Act 2018, is incorporated by reference, with its tables completed from this addendum.
  • DIFC: for transfers from the DIFC to a jurisdiction without an adequacy finding, the parties rely on the appropriate safeguards under the DIFC Data Protection Law, applying the SCCs with references to the EU GDPR read as references to that law and to the supervisory authority as the DIFC Commissioner of Data Protection.
  • UAE: for transfers subject to the PDPL, the parties rely on the transfer grounds the PDPL provides.

15. Liability and precedence

Each party’s liability under this addendum is subject to the limits in the Terms, except where data protection laws do not allow it. If the SCCs conflict with this addendum or the Terms, the SCCs prevail. If this addendum conflicts with the Terms on personal data, this addendum prevails.

16. Contact

Accelara AI Solutions Limited, trading as Helm
Innovation Hub, Dubai International Financial Centre, IH-00-01-03-OF-05, Level 3, Dubai, United Arab Emirates

Privacy questions and requests: hello@helmchat.com.