Data Processing Agreement

1.1 Data Protection Laws

"Data Protection Laws" means all applicable laws and regulations relating to privacy and data protection, including the UK GDPR, the Data Protection Act 2018, and any subsequent amendments or replacements.

1.2 Standard Terms

Terms such as "personal data," "data subject," "processing," "controller," "processor," "sub-processor," and "data breach" have the meanings given in Data Protection Laws. Where this DPA uses these terms, they have the same meaning as in the UK GDPR.

1.3 Customer Personal Data

"Customer Personal Data" means any personal data that Processor processes on behalf of Controller in connection with the Service, including personal data contained in questionnaire documents, knowledge base materials, and user account information.

2.1 Parties' Roles

Customer acts as the Controller of Customer Personal Data and determines the purposes and means of processing. Processor acts as a Processor and processes Customer Personal Data only on behalf of and in accordance with Controller's documented instructions.

2.2 Nature and Purpose of Processing

2.3 Controller Instructions

Processor shall process Customer Personal Data only in accordance with Controller's documented instructions, which are:

• To provide the Service as described in the Terms of Service
• To comply with other reasonable instructions provided by Controller that are consistent with the Terms of Service
• As required by applicable law (with notice to Controller where legally permissible)

Processor will inform Controller if, in Processor's opinion, an instruction violates Data Protection Laws.

3.1 Compliance with Data Protection Laws

Processor shall process Customer Personal Data in compliance with Data Protection Laws and only for the purposes set out in this DPA. Processor warrants that persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

3.2 Security Measures

Processor shall implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. These measures include:

Processor will review and update these measures as appropriate to maintain a level of security appropriate to the risk to the rights and freedoms of data subjects.

3.3 Sub-processors

Controller provides general authorization for Processor to engage sub-processors. Processor shall:

• Maintain a list of current sub-processors at https://askdidier.ai/subprocessors
• Provide at least 30 days' notice before adding or changing sub-processors
• Ensure sub-processors are bound by data protection obligations equivalent to this DPA
• Remain fully liable to Controller for sub-processor performance

Controller may object to the appointment of a new sub-processor by notifying Processor in writing within 15 days of receiving notice. If Controller objects, the parties will work together in good faith to find a commercially reasonable solution. If no solution is found, Controller may terminate the affected Service.

3.4 Data Subject Rights

Processor shall, to the extent legally permitted and taking into account the nature of the processing, assist Controller in responding to requests from data subjects exercising their rights under Data Protection Laws, including:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object

Controller shall be responsible for responding to such requests. Processor will provide reasonable assistance, at Controller's expense, to enable Controller to comply with such requests.

3.5 Personal Data Breaches

Processor shall notify Controller without undue delay (and in any event within 72 hours) after becoming aware of any personal data breach affecting Customer Personal Data. The notification shall include:

• Description of the nature of the breach
• Categories and approximate number of data subjects and records affected
• Likely consequences of the breach
• Measures taken or proposed to address the breach and mitigate its effects
• Contact point for further information

Processor shall provide reasonable cooperation and assistance to Controller in investigating and remediating the breach, and in meeting Controller's obligations under Data Protection Laws regarding breach notification.

3.6 Data Protection Impact Assessments

Processor shall, to the extent required by Data Protection Laws and at Controller's request, provide reasonable assistance to Controller in conducting data protection impact assessments and prior consultations with supervisory authorities.

4.1 Lawfulness of Instructions

Controller represents and warrants that its instructions to Processor comply with Data Protection Laws and that it has a lawful basis for the processing of Customer Personal Data.

4.2 Necessary Consents and Notices

Controller is responsible for ensuring that it has provided all necessary notices to and obtained all necessary consents from data subjects as required by Data Protection Laws for the processing of Customer Personal Data by Processor.

4.3 Appropriate Instructions

Controller shall ensure that all instructions it gives to Processor regarding the processing of Customer Personal Data comply with Data Protection Laws and this DPA.

5.1 Data Location

Processor shall process and store Customer Personal Data exclusively within the United Kingdom using AWS infrastructure located in UK data centers, except as otherwise agreed in writing or as required for backup and disaster recovery purposes.

5.2 International Transfers

To the extent that processing involves transfers of personal data to countries outside the United Kingdom:

• Such transfers shall only be made in compliance with Data Protection Laws
• Processor shall implement appropriate safeguards such as Standard Contractual Clauses
• Controller may request details of such safeguards

Note: While data storage is UK-based, API calls to OpenAI and Anthropic may involve data transmission to the United States. These sub-processors have implemented appropriate safeguards including Standard Contractual Clauses and supplementary measures.

6.1 Data Export

Controller may export Customer Personal Data at any time during the subscription term using the Service's export functionality. It is Controller's responsibility to export data before termination of the Service.

6.2 Deletion Upon Termination

Upon termination or expiration of the Service, Processor shall (at Controller's choice, if technically feasible) delete or return all Customer Personal Data to Controller, unless EU or UK law requires continued storage. Processor shall delete Customer Personal Data within 30 days of termination, except for data retained in backups which shall be deleted in accordance with Processor's standard backup retention policies (maximum 90 days).

6.3 Certification of Deletion

Upon Controller's written request, Processor shall provide written certification that Customer Personal Data has been deleted in accordance with this Section.

7.1 Right to Audit

Processor shall, upon reasonable written notice and no more than once per year (except where required by a supervisory authority or in the event of a suspected breach), allow Controller or an independent third-party auditor appointed by Controller to audit Processor's compliance with this DPA.

7.2 Audit Procedures

Any audit shall be subject to the following conditions:

• At least 30 days' written notice (except in case of emergency)
• Conducted during normal business hours
• Subject to reasonable confidentiality obligations
• Shall not unreasonably interfere with Processor's business
• Controller shall bear all costs unless the audit reveals material non-compliance

7.3 Alternative Compliance Evidence

Instead of an on-site audit, Processor may, at its option, provide Controller with relevant compliance documentation, including security certifications, third-party audit reports, or other evidence of compliance with this DPA and Data Protection Laws.

8.1 Liability Under Data Protection Laws

Each party shall be liable for its respective obligations under Data Protection Laws. Processor shall be liable for damages caused by processing only where it has not complied with obligations specifically directed at processors under Data Protection Laws or where it has acted outside or contrary to lawful instructions from Controller.

8.2 Limitation of Liability

Subject to the requirements of Data Protection Laws, the limitation of liability provisions in the Terms of Service shall apply to any claims arising under or in connection with this DPA. Nothing in this DPA shall exclude or limit liability that cannot be excluded or limited under applicable law.

8.3 Mutual Cooperation

The parties shall cooperate in good faith to address any claims by data subjects or supervisory authorities relating to the processing of Customer Personal Data under this DPA.

9.1 Relationship to Terms of Service

This DPA forms part of and is subject to the Terms of Service. In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail to the extent of the conflict with respect to data protection matters.

9.2 Changes to Data Protection Laws

The parties agree to review this DPA and make any amendments necessary to comply with changes in Data Protection Laws. Such amendments shall be agreed in writing by both parties.

9.3 Precedence

If there is any conflict between this DPA and any other agreement between the parties relating to data protection, this DPA shall prevail.

9.4 Severability

If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect, and the invalid provision shall be replaced with a valid provision that most closely matches the intent of the original provision.

9.5 Governing Law

This DPA shall be governed by the laws of England and Wales, without regard to conflicts of law principles.