Data Processing Agreement

1. Purpose and scope

This Data Processing Agreement ("DPA") forms part of the agreement between Hindsight Intelligence Ltd ("Processor", "we") and the Customer ("Controller", "you") for the use of ProjectHindsight and/or ConditionIQ (the "Services"), and applies whenever we process personal data on your behalf as a processor under UK GDPR Article 28.

This DPA does not apply to personal data for which we are the controller (for example, your own account and billing details), which is governed by our Privacy Notice.

2. Definitions

"UK GDPR", "personal data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018. "Sub-processor" means any processor engaged by us to process personal data on your behalf in providing the Services.

3. Roles of the parties

For Customer Data processed within the Services, you are the Controller and we are the Processor. We will process Customer Data only on your documented instructions, including with regard to transfers of personal data to a third country, unless required to do otherwise by UK law — in which case we will inform you of that legal requirement before processing, unless the law prohibits us from doing so.

4. Our obligations as Processor

We shall:

• Process Customer Data only in accordance with your instructions and the terms of this DPA;
• Ensure that personnel authorised to process Customer Data are bound by appropriate confidentiality obligations;
• Implement appropriate technical and organisational measures as set out in Annex 2;
• Not engage a sub-processor without authorisation as described in section 5;
• Taking into account the nature of the processing, assist you by appropriate technical and organisational measures, insofar as reasonably possible, in responding to requests from data subjects exercising their rights;
• Assist you in ensuring compliance with security, breach notification, and data protection impact assessment obligations, taking into account the nature of processing and information available to us;
• At your choice, delete or return all Customer Data to you at the end of the provision of Services, and delete existing copies unless UK law requires storage;
• Make available to you information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits as described in section 8.

5. Sub-processors

You provide general authorisation for us to engage the sub-processors listed in Annex 3 for the purposes described. We will:

• Impose data protection terms on each sub-processor that are no less protective than those in this DPA;
• Remain liable to you for the performance of each sub-processor's obligations;
• Give you notice of any intended change to the list of sub-processors (addition or replacement) at least 14 days in advance, via email or an in-platform notice, giving you the opportunity to object on reasonable data protection grounds. If we cannot resolve your objection, either party may treat this as grounds to terminate the affected Service without penalty.

6. International transfers

Where processing of Customer Data involves a transfer of personal data outside the UK (for example, to AI sub-processors located in the United States), we will ensure that an appropriate transfer mechanism is in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or reliance on the UK Extension to the EU–US Data Privacy Framework where the recipient is certified.

7. Personal data breach notification

We will notify you without undue delay, and in any event within 72 hours of becoming aware, after becoming aware of a personal data breach affecting Customer Data, and will provide you with information reasonably necessary for you to meet any obligations to report the breach under UK GDPR, including:

• The nature of the breach, including, where possible, the categories and approximate number of data subjects and records concerned;
• The likely consequences of the breach;
• The measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

8. Audits

We will make available to you, on reasonable written request and no more than once per year (except following a confirmed personal data breach), information necessary to demonstrate compliance with this DPA, which may take the form of a summary of our security measures, relevant certifications, or responses to a reasonable security questionnaire. Where you reasonably require an on-site audit, we will discuss timing, scope, and confidentiality terms in good faith; reasonable costs of facilitating such an audit may be charged.

9. Deletion and return of data

On termination or expiry of the Services, we will, at your written election made within 30 days, either delete or return all Customer Data (and any copies) within a further 30 days, except to the extent that UK law requires us to retain some or all of the Customer Data, in which case we will isolate and protect that data from further processing.

10. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations of liability set out in section 15 of our Terms of Service.

Annex 1 — Description of processing

Annex 2 — Technical and organisational security measures

Annex 3 — Authorised sub-processors

We will update this Annex as described in section 5 of this DPA when sub-processors are added, removed, or replaced.

14. Contact

Questions about this DPA, or requests for a signed copy for your procurement records, can be sent to support@hindsightintelligence.co.uk.