Data Processing Agreement

1 Parties to this Agreement

This DPA forms part of the Master Services Agreement / Terms of Service between the parties and supersedes any prior data processing terms relating to the Service.

2 Definitions

"Agreement" means these terms together with the Terms of Service and any applicable Order Form.

"Personal Data" means any information relating to an identified or identifiable natural person processed by Processor on behalf of Controller under this DPA.

"Processing" has the meaning given in GDPR Article 4(2), including collection, storage, retrieval, use, disclosure, alteration, and deletion.

"GDPR" means EU Regulation 2016/679 and any applicable national implementing legislation, including the UK GDPR where relevant.

"Service" means the GDPR Compliance Hub SaaS platform, including all modules: DSAR workbench, consent management, breach register, data inventory, risk register, audit programme, policy library, and associated features.

"Sub-processor" means any third party engaged by Processor to process Personal Data in connection with the Service.

"Data Subject" means the natural person to whom Personal Data relates.

3 Subject Matter, Duration & Nature of Processing

3.1 Subject Matter

Processor provides a cloud-based GDPR compliance management platform. Controller uses the Service to manage its own compliance obligations, including processing personal data relating to its own customers, employees, and website visitors.

3.2 Duration

This DPA remains in force for the duration of the Agreement and until all Personal Data is returned or deleted in accordance with Section 10 below.

3.3 Categories of Data Subjects

• Controller's customers and website visitors (data subjects of DSARs, consent records, cookie preferences)
• Controller's employees and contractors (recorded in data inventories, breach notifications, audit evidence)
• Third-party contacts referenced in Controller's compliance records

3.4 Types of Personal Data Processed (varies by module used)

3.5 Special Category Data

Controller may upload special-category data (Article 9 GDPR) as part of breach records or DSAR responses. Processor does not intentionally seek or use special-category data for any purpose other than storing and displaying it to Controller's authorised users. Controller is responsible for ensuring a valid Article 9 legal basis before entering such data.

4 Processor Obligations (GDPR Art. 28(3))

4.1 Process Only on Instructions

Processor shall process Personal Data only on documented instructions from Controller. The instructions are set out in this DPA and in Controller's use of the Service features. Processor shall immediately inform Controller if an instruction infringes applicable data protection law.

4.2 Confidentiality

Processor shall ensure that all personnel authorised to process Personal Data are subject to appropriate confidentiality obligations.

4.3 Security

Processor shall implement technical and organisational measures appropriate to the risk, as detailed in Section 8 of this DPA and in the Security Measures section of the Privacy Notice.

4.4 Sub-processing

Processor shall only engage Sub-processors as listed in Section 7 of this DPA, and shall impose equivalent data protection obligations on each Sub-processor.

4.5 Assistance with Data Subject Rights

Processor shall assist Controller, by appropriate technical and organisational measures, in fulfilling Controller's obligation to respond to Data Subject requests. The platform provides built-in tools for DSAR export, consent withdrawal, and data deletion.

4.6 Assistance with Compliance Obligations

Taking into account the nature of processing and the information available to Processor, Processor shall assist Controller in ensuring compliance with security, breach notification, DPIA, and consultation obligations under Articles 32–36 GDPR.

4.7 Deletion or Return

At Controller's choice, Processor shall delete or return all Personal Data at the end of the Agreement as set out in Section 10.

4.8 Audit Cooperation

Processor shall make available all information necessary to demonstrate compliance with GDPR Article 28, and shall allow for and contribute to audits and inspections conducted by Controller or a mandated auditor, as set out in Section 9.

5 Controller Obligations

Controller shall:

• Have a lawful basis for all processing activities it records in the Service;
• Provide complete and accurate privacy notices to its own data subjects;
• Respond to all Data Subject requests for access, rectification, erasure, restriction, portability, and objection within statutory timeframes;
• Ensure that access to the Service is restricted to authorised personnel and that seat credentials are kept secure;
• Not instruct Processor to process Personal Data in a way that would violate applicable law;
• Notify Processor promptly if it becomes aware of a security incident related to Controller's use of the platform.

6 International Data Transfers

6.1 Primary Data Location

All Personal Data is stored and processed on servers located within the European Economic Area (EEA) by default. Processor does not transfer Personal Data to Bahrain-based infrastructure for primary storage.

6.2 Processor's Establishment in Bahrain

Processor is established in the Kingdom of Bahrain, which does not currently hold an EU adequacy decision under GDPR Article 45. Accordingly, where Processor's staff in Bahrain access EU Personal Data (e.g., for technical support or maintenance), this constitutes a restricted transfer governed by:

• Standard Contractual Clauses (SCCs) — Module 2 (Controller-to-Processor), EU Commission Implementing Decision 2021/914; and
• A Transfer Impact Assessment (TIA) specific to Bahrain, available on written request.

Processor has implemented the Bahrain PDPL (Law No. 30 of 2018, as amended 2023) as its local data protection framework, which is consistent with the obligations in these SCCs.

6.3 Transfers to Other Third Countries (Sub-processors)

Where Processor engages Sub-processors located outside the EEA, Processor relies on one or more of the following safeguards under GDPR Chapter V:

• An adequacy decision of the European Commission (Art. 45);
• Standard Contractual Clauses — EU Commission Decision 2021/914 (Art. 46(2)(c)); or
• Certification under the EU-U.S. Data Privacy Framework (Art. 45).

Details of the safeguard applicable to each Sub-processor are listed in Section 7.

7 Authorised Sub-processors

Controller provides a general written authorisation for Processor to engage the Sub-processors listed below. Processor shall notify Controller by email at least 30 days before adding or replacing any Sub-processor. Controller may object within 14 days of such notice.

SCCs = Standard Contractual Clauses (EU Decision 2021/914). DPF = EU-U.S. Data Privacy Framework.

8 Technical & Organisational Security Measures

Processor implements the following measures in accordance with GDPR Article 32:

9 Personal Data Breach Notification

9.1 Notification Timeline

Processor shall notify Controller without undue delay and in any event within 48 hours of becoming aware of a Personal Data Breach affecting Controller's data.

9.2 Content of Notification

• Description of the nature of the breach, including categories and approximate number of data subjects and records affected;
• Name and contact details of the Data Protection Officer or other contact;
• Likely consequences of the breach;
• Measures taken or proposed to address the breach and mitigate its effects.

9.3 Controller Responsibility

Controller is responsible for notifying the supervisory authority within 72 hours of becoming aware of a breach (GDPR Art. 33), and for notifying affected data subjects without undue delay where required (Art. 34). Processor will cooperate fully and provide all information available to assist.

9.4 Audit Rights

On reasonable written notice (minimum 30 days, except where a regulatory authority requires otherwise), Controller may audit Processor's compliance with this DPA no more than once per calendar year. Processor's current SOC 2 Type II report may be provided in lieu of an on-site audit.

10 Return and Deletion of Data

Upon termination or expiry of the Agreement, Processor shall, at Controller's written election within 30 days of termination:

• (a) Return all Personal Data in a machine-readable format (JSON/CSV export available via the platform); then securely delete all copies; or
• (b) Delete all Personal Data within 60 days of the termination date.

Processor may retain anonymised, aggregated statistical data that does not identify any individual. Billing records are retained for 7 years to comply with EU VAT law.

Processor shall provide written confirmation of deletion upon Controller's request.

11 Liability

Each party's liability under this DPA is subject to the limitations set forth in the Terms of Service. Notwithstanding any limitation, Processor's liability shall not be excluded or limited for:

• Fraudulent misrepresentation or wilful misconduct;
• Breach of data protection obligations resulting from Processor's gross negligence;
• Fines or penalties imposed directly on Processor by a supervisory authority for Processor's own violations.

12 Governing Law & Jurisdiction

This DPA is governed by the laws of England and Wales (a neutral choice of law often used by non-EU businesses contracting with EU customers), without regard to its conflict of law principles.

The parties submit to the exclusive jurisdiction of the courts of England and Wales for any dispute arising out of or in connection with this DPA, except that either party may seek emergency injunctive relief in any court of competent jurisdiction.

This DPA also incorporates by reference the Standard Contractual Clauses (EU Commission Decision 2021/914), which take precedence in the event of any conflict with these governing law provisions in respect of transfers of EU Personal Data.