Data Processing Agreement

1.1 This Data Processing Agreement (DPA) forms part of the subscription agreement between TrueValue Technologies Ltd, company number 17462580, of 66 Paul Street, London, England, United Kingdom, EC2A 4NA (TrueValue), and the Customer identified in the accepted Order. It applies whenever TrueValue processes Customer Personal Data on the Customer's behalf in providing the Service.

1.2 The Customer is the controller or an authorised processor acting for a controller. TrueValue is respectively the processor or subprocessor. Where the Customer is a processor, it confirms that its controller has authorised the appointment and instructions and it will pass relevant obligations and information through the chain. This DPA does not turn TrueValue's independent controller activities into processor activities.

1.3 Applicable Data Protection Law means the UK GDPR, Data Protection Act 2018 and other applicable UK data-protection law, and the EU GDPR where it applies, each as amended and in force. Controller, processor, personal data, processing and personal data breach have their statutory meanings. Customer Personal Data means personal data processed under this DPA. A Subprocessor is another processor appointed by TrueValue for that processing.

1.4 The DPA begins when applicable processing starts and continues for as long as TrueValue or its Subprocessors retain Customer Personal Data, including restricted residual backups. Ending a subscription does not end protection of retained information. Mandatory transfer terms prevail over conflicting provisions; otherwise this DPA prevails on processing Customer Personal Data.

2.1 Schedule 1 describes the subject matter, nature, purposes, duration, data and people involved. The accepted Order, this DPA and lawful instructions issued by Authorised Users through agreed features are the Customer's documented instructions. They include instructed transfers only where the necessary lawful safeguards are in place.

2.2 TrueValue will process Customer Personal Data only on those instructions unless required by applicable law. Where legally permitted, TrueValue will inform the Customer of that requirement before processing. TrueValue will promptly inform the Customer if an instruction, in its opinion, infringes Applicable Data Protection Law and may pause the affected instruction while the parties resolve the concern.

2.3 The Customer is responsible for the lawfulness of its collection, purposes, disclosures, notices and instructions, including authority under confidentiality obligations and applicable law. It will minimise unnecessary personal data and accurately configure access. These responsibilities do not excuse TrueValue from its own obligations or permit it to follow a manifestly unlawful instruction without addressing it.

2.4 A new material processing purpose, data category or high-risk use not covered by the schedules requires a documented assessment and, where necessary, an agreed amendment before it begins. Ordinary service instructions do not authorise TrueValue to use confidential data to train general-purpose AI models or create an independent marketing database.

3.1 TrueValue will ensure that personnel authorised to process Customer Personal Data are subject to confidentiality commitments or an appropriate statutory duty and receive training appropriate to their responsibilities. Access will be limited to people who need it for the authorised purpose.

3.2 TrueValue will maintain appropriate access authorisation and withdrawal procedures and will not permit shared administrative credentials in place of accountable access. Confidentiality obligations continue after an individual's access or engagement ends.

4.1 Taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and risks to individuals, TrueValue will implement appropriate technical and organisational measures. The agreed minimum measures are in Schedule 2.

4.2 Measures will support confidentiality, integrity, availability and resilience, appropriate restoration after an incident, and testing and evaluation of security effectiveness. TrueValue may update measures where overall protection is not materially reduced. It will not use a website edit to withdraw an agreed minimum control.

4.3 The Customer will use the controls made available to it, protect credentials, configure permissions and promptly report relevant compromise. Customer responsibilities do not transfer to the Customer responsibility for TrueValue's infrastructure or Subprocessor compliance.

5.1 The Customer gives general written authorisation for the Subprocessors identified in the completed Subprocessor Register incorporated as Schedule 3. A brand name without verified legal entity, processing description and relevant location information is not a completed entry. Independent controller activities and customer-selected integrations are identified separately.

5.2 Before a Subprocessor processes Customer Personal Data, TrueValue will carry out appropriate diligence and impose a written contract with data-protection obligations substantially equivalent to those applicable to the processing under this DPA, including adequate security and deletion obligations. TrueValue remains fully responsible to the Customer for its Subprocessor's performance of those obligations.

5.3 TrueValue will notify the Customer's nominated contact at least 30 calendar days before adding or replacing a Subprocessor for the Customer's processing, describing its function and relevant locations. The Customer may object within that period on reasonable data-protection grounds. TrueValue will work in good faith to address the concern through information, a reasonable alternative or an available configuration that avoids the processing.

5.4 If the concern cannot reasonably be resolved before the proposed processing, the Customer may terminate the affected feature or subscription without penalty and receive a pro-rata refund of prepaid unused fees. TrueValue will not transfer the Customer's data to the disputed new Subprocessor while a timely objection remains unresolved, unless the Customer subsequently authorises it or law requires it. An emergency does not create permission to disregard required prior authorisation; TrueValue may instead temporarily restrict the affected function while a lawful solution is arranged.

6.1 TrueValue will not make a restricted transfer without a valid legal basis for that transfer and any required supplementary safeguards. It will identify the relevant destinations and mechanism in Schedule 3, including material overseas support access, not just the primary database region.

6.2 Depending on the transfer, an applicable mechanism may be a valid adequacy arrangement, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU clauses where EU GDPR requires them. The parties will complete and execute the appropriate instrument, annexes and assessments before relying on it. Merely listing possible mechanisms does not execute an instrument or establish adequacy.

6.3 TrueValue will provide reasonably requested information about the relevant safeguards, consider changes affecting their validity, and suspend or change affected transfers where required. Where the Customer instructs disclosure to a recipient it independently selects, each party remains responsible for the obligations applicable to its own role in that transfer.

6.4 TrueValue will scrutinise requests for access from public authorities, disclose only what it is lawfully required to disclose, and notify the Customer where legally permitted. It will challenge unlawful or materially disproportionate requests where there are reasonable grounds and it is appropriate to do so.

7.1 Taking account of the nature of processing, TrueValue will assist through appropriate technical and organisational measures, insofar as possible, with the Customer's duty to respond to requests concerning access, correction, deletion, restriction, objection, portability and applicable automated-decision safeguards.

7.2 TrueValue will forward a request concerning Customer Personal Data without undue delay, normally within two Business Days of identifying the relevant Customer. It will not substantively decide the request for the Customer unless instructed or required by law. The Customer remains responsible for its response deadline, and TrueValue will provide available assistance in sufficient time to support compliance.

7.3 Identity checks and disclosures must be proportionate. Neither party will expose another person's data merely to satisfy a request. TrueValue may respond directly for information it independently controls, under its Privacy Notice.

8.1 TrueValue will notify the Customer without undue delay and in any event within 24 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. Awareness does not require a final forensic report, proof that TrueValue is at fault, or a conclusion that regulatory notification is required.

8.2 To the extent known, the initial notice will describe the nature and timing of the breach; affected systems, categories and approximate numbers of individuals and records; likely consequences; measures taken or proposed; practical actions the Customer should consider; and a contact for further information. Missing information may be provided in phases without undue further delay.

8.3 TrueValue will promptly take reasonable steps to contain, investigate and remediate the breach, preserve appropriate evidence and cooperate with the Customer. It will keep an incident record and provide reasonably available updates proportionate to the incident. It need not disclose privileged material, details exposing another customer's data or information that would create a material security risk, but will provide a meaningful alternative where possible.

8.4 Unless law requires otherwise, the Customer directs notifications concerning its controller processing to individuals and regulators. TrueValue will not speak in the Customer's name without authority. It will fulfil its own direct obligations where applicable and will not delay the Customer's assessment pending completion of its investigation. Notification is not by itself an admission of liability.

9.1 Taking account of the nature of processing and information available to it, TrueValue will assist the Customer with security compliance, breach duties, data protection impact assessments and prior consultation with competent authorities. It will provide relevant descriptions of processing and safeguards rather than treating every request as a request for unrestricted source-code access.

9.2 TrueValue will notify the Customer where a regulator contacts it specifically about the Customer's processing, unless legally prohibited, and cooperate appropriately. Each party remains responsible for its own regulatory duties.

10.1 TrueValue will make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, by the Customer or a competent independent auditor mandated by it.

10.2 The parties will normally begin with relevant written information, completed questionnaires and available independent reports. Where those are insufficient, a proportionate further audit may proceed with reasonable advance notice, normally at least 15 Business Days, during normal working hours and under reasonable confidentiality and safety arrangements.

10.3 Routine on-site audits will normally be limited to once in 12 months, but that limit and normal notice do not restrict a regulator, an investigation of a material breach or reasonable evidence of non-compliance, or an audit otherwise necessary to meet Applicable Data Protection Law. Scope, timing and access will protect other customers and avoid unnecessary disruption; those protections must not render audit rights ineffective.

10.4 Each party normally bears its own costs for routine documentary cooperation, and the Customer bears its chosen auditor's costs. Additional exceptional assistance may be charged only at reasonable rates agreed in advance, except that TrueValue bears reasonable costs attributable to remedying its own material non-compliance. A fee dispute must not delay legally required assistance.

11.1 At the Customer's choice on ending the processing services, TrueValue will return or delete Customer Personal Data and delete existing copies unless law requires retention. The Customer may choose return followed by deletion. The Data Retention, Export and Deletion Policy is incorporated as Schedule 4 and specifies the operational timetable.

11.2 A standard export requested before termination or within seven calendar days afterwards will be delivered within seven calendar days of the verified request, subject to a lawful restriction or a different written arrangement. An earlier urgent statutory request is not made to wait for this routine timetable. Customer-controlled active content will be deleted or irreversibly anonymised within 30 calendar days after termination or a verified earlier deletion instruction, subject to lawful exceptions and an agreed export extension where lawful.

11.3 Residual backup copies may persist only for the verified maximum cycle specified in Schedule 4, protected against ordinary access and use. They may be restored solely for authorised disaster recovery, after which relevant deletion instructions must be reapplied. They remain subject to this DPA until expiry. An indefinite backup exception is not permitted.

11.4 Any legal retention must be limited to the information and period required, with restricted processing. TrueValue will distinguish its own controller records from Customer Personal Data; retention of invoices does not justify retaining unrelated deal files. Upon reasonable request it will confirm completion of the relevant deletion steps and identify any remaining lawful exception and expected expiry.

12.1 The liability terms of the accepted subscription agreement apply between the parties to the extent lawful. They do not restrict individuals' statutory rights, regulatory powers, mandatory rights under transfer clauses, or responsibility to assist and perform processing obligations. A DPA claim arising from a covered security breach is not automatically placed under a lower general cap.

12.2 Ordinary compliance with this DPA is included in the subscription unless an expressly agreed charge is lawful and appropriate. TrueValue will not charge the Customer merely to report a breach or remedy TrueValue's own failure. Exceptional bespoke assistance outside ordinary obligations may be agreed separately without delaying mandatory duties.

12.3 Changes require a valid contractual process and cannot reduce mandatory protections. Electronic acceptance of the incorporated DPA is effective as part of the Order. A separately signed copy can be requested from privacy@truevalue.business. Governing law and jurisdiction follow the subscription agreement, subject to mandatory transfer provisions and applicable law.

Subject matter: the Customer's use of the TrueValue deal workspace and the specific features and integrations included in its Order and lawful instructions.

Nature of operations: collection on instruction; organisation and storage; retrieval and display; extraction, classification and analysis of selected documents; calculation and report generation; controlled sharing; communication and signing workflows where enabled; logging necessary to the instructed service; export; backup; restriction; and deletion.

Purpose: deliver, maintain, secure and support the instructed workspace and features for the Customer. No independent sale, unrestricted AI training or independent prospect marketing is authorised by this schedule.

Duration and frequency: continuing during service delivery and instructed use, with task-based processing for individual workflows, followed by the limited offboarding and protected-backup period in Schedule 4. Each active Subprocessor's retention is identified in Schedule 3.

Categories of people: Customer personnel and users; clients and prospective clients; business owners, shareholders, directors and employees appearing in deal records; counterparties and their representatives; professional advisers; authorised guests, recipients and signatories; and other people lawfully included in instructed transaction documents.

Categories of data: names and professional contact details; roles and company associations; account and permission identifiers; correspondence; document contents and metadata; relevant personal financial information in instructed deal records; prompts, extracted text and outputs; invitation, access and signing evidence; and relevant technical identifiers and timestamps. Corporate information that does not identify a person is not personal data, but remains protected by confidentiality terms.

Sensitive data: special-category and criminal-offence data are not part of the ordinary intended processing. Where genuinely necessary, the Customer must first agree the scope, lawful conditions and enhanced controls in writing. Unexpected receipt is handled securely and assessed for restriction, redaction or deletion; it does not create unrestricted authorisation.

Customer contact: the administrator or privacy contact designated in the Order or workspace record. TrueValue contact: privacy@truevalue.business; urgent security reports: security@truevalue.business.

The following are contractual minimum standards, not a claim of a particular certification. Implementation must cover the relevant application, database, file storage, integrations and operational access rather than relying only on a hosting provider's controls.

Access management: role-appropriate authorisation; least-privilege access; accountable administrative accounts; prompt withdrawal of access when no longer needed; and appropriate stronger authentication for privileged access. Customer-facing authentication options must be accurately described in the product.

Tenant and sharing controls: enforce workspace separation and access checks at the server and storage layers; check ownership and permissions for reads, writes, downloads and privileged operations; test relevant access boundaries when material changes are made.

Encryption and secrets: protect transmission of Customer Personal Data with supported industry-standard transport encryption; encrypt stored Customer Personal Data and managed backups where applicable to the architecture; control keys, secrets and tokens separately from public code and ordinary logs. This is not a promise of end-to-end encryption or customer-exclusive key custody.

Change and vulnerability management: review security-relevant changes, maintain supported dependencies, prioritise vulnerabilities by risk, and use appropriate testing before production deployment. Limit production data in development and testing; use synthetic or de-identified data where practicable.

Logging and detection: keep proportionate records of security-relevant access and administrative events, protect logs against inappropriate access or alteration, and avoid unnecessary document content or secrets in logs. Retention follows the verified schedule.

Recovery: maintain protected backups covering the Customer Data required for restoration; document scope and expiry; test restoration at a risk-appropriate frequency; and address gaps in file-storage coverage separately from database recovery. No fixed restoration-time or recovery-point guarantee applies unless expressly agreed.

People and governance: identify responsible personnel, maintain confidentiality commitments and appropriate training, document security responsibilities and review measures against relevant risks.

Supplier controls: conduct risk-appropriate supplier assessment, execute processing and transfer arrangements, control the information supplied and manage changes under this DPA.

AI and integration controls: minimise task payloads; restrict service and integration credentials; apply approved action boundaries; maintain appropriate action evidence; and enforce the no-general-purpose-training instruction in supplier terms and settings.

Incident management: maintain a documented escalation and response process, preserve relevant evidence, assess risk to individuals, deliver notices under section 8 and track remediation.

Deletion and disposal: restrict data pending deletion, securely delete or irreversibly anonymise within the agreed schedule, propagate instructions to Subprocessors and protect residual backups until expiry.

Physical and infrastructure security: select infrastructure providers with risk-appropriate access and environmental controls and review relevant assurance evidence. Provider certifications do not constitute certification of the whole TrueValue service.

The completed Subprocessor Register and International Transfers document forms this schedule. It must identify actual appointed entities, services, data categories, processing and support locations, retention, and applicable transfer arrangements. Customer approval applies to the completed version supplied at acceptance and subsequent changes handled under section 5.

The completed Data Retention, Export and Deletion Policy forms this schedule. Its verified backup and category-specific periods must be populated before this DPA is used. A stricter lawful, expressly agreed Customer arrangement prevails for that Customer.