Data Processing Addendum

1. Scope and parties

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between [COMPANY NAME] Ltd, company number [COMPANY NUMBER], of [REGISTERED ADDRESS] (“Reguard”, the “Processor”) and the customer organisation (the “Customer”, the “Controller”). It applies whenever Reguard processes Customer Personal Data in providing the Service.

In this DPA, “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR (Regulation (EU) 2016/679). “Customer Personal Data” means personal data contained in Customer Content. Terms such as “controller”, “processor”, “personal data breach” and “data subject” have the meanings given in Data Protection Law. If this DPA conflicts with the Agreement, this DPA prevails in relation to data protection.

2. Details of processing

3. Customer's obligations

The Customer is responsible for having a lawful basis for the processing it instructs, for providing any required notices to data subjects, and for the accuracy and lawfulness of Customer Personal Data. The Customer's use of the Service, as configured by it, and the Agreement, are its documented instructions to Reguard.

4. Reguard's obligations as processor

Reguard will:

• process Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law (in which case Reguard will inform the Customer first, unless the law prohibits this);
• tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Law;
• ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations;
• implement the technical and organisational measures in Annex A;
• not use Customer Personal Data to train AI models, and not sell it;
• taking into account the nature of the processing, assist the Customer by appropriate measures in responding to data subject requests (section 7);
• assist the Customer with its obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to Reguard; and
• make available the information necessary to demonstrate compliance with Article 28 and allow for audits (section 9).

5. Subprocessors

The Customer gives general authorisation for Reguard to engage subprocessors. The current subprocessors are listed on our Subprocessors page.

• Reguard will impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and remains liable to the Customer for each subprocessor's performance.
• Reguard will give the Customer at least [NOTICE PERIOD] notice of any intended addition or replacement of a subprocessor, by updating the Subprocessors page and notifying account Admins [NOTIFICATION MECHANISM: TBC].
• The Customer may object on reasonable data protection grounds within that notice period. The parties will discuss the objection in good faith; if it cannot be resolved, the Customer may terminate the affected part of the Service and receive a pro rata refund of prepaid fees for it.

6. International transfers

Customer Personal Data will be hosted in the UK. Some processing, including AI processing by Anthropic PBC, takes place in the United States. Reguard will only transfer Customer Personal Data outside the UK or EEA where appropriate safeguards are in place under Data Protection Law, such as the UK International Data Transfer Agreement or UK Addendum, and the EU Standard Contractual Clauses (Module 3, processor to processor). [TRANSFER MECHANISMS: TO CONFIRM]

7. Data subject requests

If Reguard receives a request from a data subject relating to Customer Personal Data, it will refer the request to the Customer and will not respond itself except on the Customer's instructions. The Service allows the Customer to access, correct, export and delete questionnaires and answers directly.

8. Personal data breaches

Reguard will notify the Customer without undue delay, and in any event within [BREACH NOTIFICATION PERIOD: e.g. 48 hours] of becoming aware of a personal data breach affecting Customer Personal Data. The notice will include, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed. Reguard will provide further information as it becomes available and take reasonable steps to contain and remedy the breach.

9. Audits and information

Reguard will respond to the Customer's reasonable written security and data protection questions, and make available the information needed to demonstrate compliance with this DPA. Where that information is not sufficient, the Customer may carry out an audit, at its own cost, on at least [AUDIT NOTICE PERIOD] notice, no more than once a year (unless required by a regulator or following a personal data breach), during business hours and subject to confidentiality.

10. Return and deletion

The Customer can delete questionnaires and answers in the Service at any time. On termination of the Agreement, or on request to [CONTACT EMAIL], Reguard will delete all Customer Personal Data, including the organisation account, within [DELETION PERIOD], unless the law requires it to be kept. The Customer may export its data before termination. Data held in backups will be deleted as the backups expire on their normal cycle of [BACKUP RETENTION PERIOD]. Data sent to Anthropic PBC for processing is retained by Anthropic only in line with its commercial API data-retention policy.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement. [LIABILITY POSITION FOR DPA: TO CONFIRM WITH LEGAL REVIEW]

Annex A: Technical and organisational security measures

Reguard maintains the following measures, which it may update provided the overall level of protection is not reduced. More detail is available on our Data Security page.

Encryption

• All traffic to and from the Service is encrypted in transit using TLS.
• Customer Content, including questions, answers, the answer bank, organisation profile content and User names, is encrypted at the field level using AES-256-GCM before it is stored.

Access control and authentication

• Time-based one-time password (TOTP) multi-factor authentication for Users.
• Role-based access control within each customer organisation, with Admin, Standard and Read Only roles.
• Each customer's data is logically separated, and access is restricted to that customer's Users.
• Sessions use httpOnly cookies that expire after 24 hours; an optional MFA device-trust cookie expires after 7 days.
• Access to production systems by Reguard personnel is limited to those who need it to operate and support the Service.

Hosting and infrastructure

• The Service will be hosted on Amazon Web Services in the London (eu-west-2) region.
• Infrastructure security, physical security and environmental controls of the hosting facilities are provided by AWS.

AI processing

• Only the content needed to classify a question or draft an answer is sent to the AI model provider, through its commercial API.
• Under the provider's commercial terms, data sent through the API is not used for model training, and is retained only in line with its commercial API data-retention policy.

Privacy by design

• No analytics, tracking or marketing cookies or tools in the Service.
• Customers can delete questionnaires and answers themselves at any time.

Organisational measures

• Confidentiality obligations for all personnel.
• An incident response process for identifying, containing and notifying personal data breaches.
• [ADDITIONAL ORGANISATIONAL MEASURES: TBC]