Data Processing Summary
Effective date: 9 October 2026
This summary describes how AutoGenix handles lead data to provide Instant Reply. It is not a substitute for a binding Article 28 data processing agreement or required international transfer documentation; those must be agreed before live personal data is processed.
1. Roles and instructions
The estate or letting agency client is the data controller. Maneesh Rajbhar, trading as AutoGenix (India) is the data processor. The client determines the purposes, lawful basis and instructions for processing. We process personal data only on the client’s documented instructions, including any instructions about transfers, unless applicable law requires otherwise.
The client is responsible for lawful collection, consent where required, privacy notices and handling data subject requests. We will inform the client if we believe an instruction infringes applicable data protection law.
2. Purpose, duration and data categories
Processing is limited to receiving inbound enquiry data, creating and sending personalised AI replies, scoring leads, sending priority owner alerts, monitoring the agreed workflow and providing support. We do not use client lead data for our own marketing.
Data subjects are people who enquire about the client’s properties and relevant client staff. Data may include name, phone number, email address, enquiry details (such as property interest, budget and moving timeline), message content and the resulting lead rating.
Processing continues for the service term and the limited deletion period below. Special-category data, children’s information and unnecessary sensitive information should not be submitted to the workflow.
3. Sub-processors and service recipients
Make — automation platform, receiving and routing enquiry information between connected services.
Anthropic — AI provider, processing relevant enquiry details to generate personalised replies and lead scoring.
Whapi.Cloud — WhatsApp connection provider, delivering messages through the client’s business WhatsApp number and processing related message information.
Telegram — delivery of owner alerts containing relevant lead details. The client’s owner account receives those alerts.
These services may have their own independent-controller responsibilities for account, security or operational information. Their contractual roles and processing terms must be confirmed in the client’s processing agreement. We will apply appropriate data protection obligations to appointed sub-processors and give advance notice of intended changes so the client can raise a reasonable data protection objection.
4. Security and confidentiality
Measures include access limited to authorised people who need it, confidentiality obligations, account access controls, protection of credentials, encrypted connections where supported, minimisation of information sent to each service and monitoring of the automation for failures.
We will maintain appropriate measures proportionate to the processing risk and assist with security questions. The client must keep its devices, enquiry form, WhatsApp account and Telegram account secure and prevent unauthorised sharing of lead alerts.
5. International transfers
AutoGenix is based in India, and providers may process data in the UK, US, India or other locations. India does not have a UK adequacy decision. Transfers must be assessed and covered by an applicable lawful mechanism before live UK personal data is processed.
Where required, the parties must execute a UK International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses, assess transfer risks and agree appropriate supplementary measures. This summary does not claim these documents have already been signed or that every provider transfer is automatically lawful.
6. Assistance and incident notification
We will assist the client, taking account of the nature of processing and information available to us, with data subject requests, security obligations, breach assessment, impact assessments and regulator consultations where applicable. We will not respond substantively to a lead’s request on the client’s behalf unless instructed or legally required.
If we become aware of a personal data breach affecting client data, we will notify the client without undue delay, provide available information about the incident and affected data, and cooperate on containment and remediation. The controller remains responsible for assessing any ICO or data-subject notification obligations.
7. Return and deletion
On termination, we will follow the client’s documented choice to return or delete personal data under our control, and complete deletion within 30 days, unless law requires retention. Any lawfully retained information will be restricted to the required purpose.
Copies already delivered to the client’s WhatsApp or Telegram accounts remain the client’s responsibility. Provider-controlled records and backups are subject to the provider’s contractual retention arrangements; the binding processing agreement must address those arrangements.
8. Accountability and contact
We will provide information reasonably necessary to demonstrate compliance with agreed processor obligations and support proportionate audits under the binding agreement, subject to confidentiality and security safeguards. Contact maneesh@autogenix-ai.com to request the processing agreement, ask about sub-processors or raise a data protection concern.