Data Processing Agreement

Parties and effect

This agreement is between the organisation that accepts it (the "Customer", the controller) and Change8 Ltd ([[TO CONFIRM: full registered company name]], [[TO CONFIRM: registered office address]]), (the "Processor"). It applies to personal data the Processor handles on the Customer’s behalf in providing the Service, and forms part of the Terms of Service.

It takes effect when the Customer’s Owner accepts it in the Service, and applies for as long as the Processor handles that data.

[[TO CONFIRM: counsel to confirm the definitions and the relationship to the Terms, including which prevails on conflict]]

What is processed, and why

The Processor processes personal data only to provide the Service to the Customer, as described in Annex I, and only on the Customer’s documented instructions. Using the Service, and its configuration, is an instruction. If the Processor believes an instruction breaks data protection law it will say so.

The Customer’s responsibilities

The Customer is responsible for having a lawful basis for the data it puts through the Service, for the accuracy of its instructions, and for not migrating personal data it has no need to. It should not migrate special-category data unless it has a lawful basis and has considered whether it needs to.

Confidentiality

The Processor ensures that people authorised to process the data are bound by confidentiality, and that access is limited to those who need it to provide the Service.

Security

The Processor keeps appropriate technical and organisational measures to protect the data, including those in Annex II, and will not materially reduce them.

Subprocessors

The Customer gives the Processor general authorisation to use the subprocessors on the subprocessor list, which is published and kept current, and which describes what each receives, including that the AI assistant sends data to a third-party AI provider. The Processor binds each to obligations no less protective than these.

The Processor will tell the Customer before it adds or replaces a subprocessor, by [[TO CONFIRM: the channel, e.g. email to the Owner, and the notice period, e.g. 30 days]]. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve it, the Customer may stop using the affected part of the Service.

International transfers

Some subprocessors process data outside the UK and the European Economic Area, including in the United States. [[TO CONFIRM: the transfer mechanism that applies: standard contractual clauses and the UK addendum or IDTA, module and annexes, and any transfer risk assessment]]

Requests from individuals

The Processor will pass on, without undue delay, any request it receives from an individual about data it processes for the Customer, and will not respond to it except on the Customer’s instructions. It will give the Customer reasonable help to respond to such requests, and to carry out impact assessments and prior consultations.

Personal data breaches

The Processor will tell the Customer without undue delay [[TO CONFIRM: and within a stated number of hours, if counsel wants one]] after becoming aware of a breach affecting the Customer’s data, with the information it then has and any it later finds out.

Return and deletion

When the Service ends the Processor will, at the Customer’s choice, return the data or delete it, and delete existing copies unless the law requires it to keep them. [[TO CONFIRM: the period, and how backups are treated. Align with the tenant offboarding process, CDMT-1650]]

Information and audits

The Processor will give the Customer the information needed to show it is meeting this agreement and will allow for audits, [[TO CONFIRM: how: e.g. by questionnaire and reports first, on notice, no more than once a year unless a breach has occurred]].

Liability and general terms

[[TO CONFIRM: counsel to confirm how liability under this agreement relates to the limits in the Terms, governing law, and term]]

Annex I: details of the processing

Annex II: security measures

These are the measures the Service applies. Where one depends on the hosting provider, it is marked.

• Isolation: each organisation’s data is held in its own database schema, and requests are resolved to the caller’s own workspace.
• Access control: role-based permissions; a read-only role; one Owner per organisation; staff access is separate from customer access.
• Authentication: passwords of at least 12 characters, stored as hashes; email verification for new workspaces; sessions in cookies that scripts cannot read; sign-in and sign-up rate limits; optional sign-in with Google or Microsoft.
• Credentials for the Customer’s IFS environment are stored encrypted.
• Encryption in transit over HTTPS, terminated by the hosting provider.
• Logging: actions and migration jobs are recorded, and the activity log is kept for 365 days.
• Change control: database changes are made by reviewed migrations applied once per release.
• [[TO CONFIRM: encryption at rest, backups and their retention, vulnerability management, incident response and staff training, once confirmed. These depend on the hosting provider and on company practice, which the code cannot show]]

Annex III: subprocessors

The current list is published on the subprocessor page, which is part of this agreement. It covers DigitalOcean (hosting, and the AI model), Microsoft (email) and, only if a person chooses to use them, Google and Microsoft sign-in.