Data processing agreement

This agreement is between [to confirm: full legal entity name and company number] (“Processor”, “we”) and the customer organisation that subscribes to the Deal Scout platform (“Controller”, “you”).

You are the controller of the personal data you put into the platform. We are your processor for it. This split is explained in clause 02 of the Privacy notice, and it is the premise of everything below: we do not decide what personal data enters the platform, why, or for how long — you do, and we act on your instructions.

This agreement supplements the Terms of service and forms part of them. Where a separately negotiated DPA is signed between us, that document prevails. Where this agreement conflicts with the Terms on the handling of personal data, this agreement prevails.

“Data Protection Law” means the UK GDPR and the Data Protection Act 2018, the EU GDPR where applicable, and any other data protection law applying to the processing. Terms such as controller, processor, personal data, processing, personal data breach and data subject carry the meanings given in that law.

The prescribed description sits in Annex I. In summary: we process the personal data contained in the documents and records you put into the platform, for the purpose of providing the platform to you, for as long as your subscription runs plus the period in clause 09.

We will not process that personal data for any purpose of our own. In particular we do not use it to train models, we do not use one customer’s data to serve another, and we do not sell or share it other than to the sub-processors in Annex III.

We process personal data only on your documented instructions, including in relation to transfers to a third country. Your instructions are: this agreement, the Terms of service, the configuration choices you make in the platform, and anything else you tell us in writing.

Using the platform — uploading a document for extraction, running a report, sending an investor notice — is an instruction to carry out that processing. Where an action sends data to a sub-processor, that is disclosed in Annex III; AI extraction in particular transmits document content to Anthropic, and clause 06 of the Privacy notice states this plainly.

If we are required by law to process personal data otherwise than on your instructions we will tell you before doing so, unless the law prohibits us from telling you. If we consider an instruction to breach Data Protection Law we will tell you promptly.

Access to your personal data is limited to personnel who need it to provide or support the platform. Those people are bound by written confidentiality obligations that survive their employment or engagement.

Our administrative access is itself gated: platform-administration functions are restricted to an explicit allowlist rather than to a role anyone can be granted into, and privileged actions are recorded in the immutable audit trail described in Annex II.

Our onboarding, background-check and data-protection training arrangements are [to confirm: document the personnel vetting and training programme].

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, having regard to Article 32. Those measures are set out in Annex II, which describes what the platform does rather than what is conventional to claim.

We may change a measure, provided the change does not materially reduce the overall level of security. Annex II is versioned by the date at the top of this page.

You give us general authorisation to engage the sub-processors listed in Annex III, and to engage others subject to this clause.

• —We impose data protection obligations on every sub-processor that are no less protective than those in this agreement.
• —We remain responsible to you for a sub-processor’s performance as if it were our own.
• —We will give you at least [to confirm: notice period for new sub-processors — 30 days is common] written notice before a new sub-processor starts processing your personal data, and you may object on reasonable data-protection grounds. The mechanism for giving that notice — a subscribable page, or email to your nominated contact — is [to confirm: decide and commit to a sub-processor change-notification mechanism].
• —If you object and we cannot offer a reasonable alternative, you may terminate the affected part of the service.

Annex III is maintained from the application itself rather than from memory. Two entries are conditional: an accounting integration processes data only if you connect it, and a malware scanner and an e-signature provider are engaged only where configured.

Where a data subject exercises a right in respect of personal data we process for you, we will assist you in responding, taking into account the nature of the processing.

What that looks like in practice

• —If a request reaches us directly, we will not respond to it substantively. We will tell the person to approach you and forward the request to you promptly, because you are the controller and it is your decision.
• —Access and portability: the platform exports registers, ledgers, valuations and reports directly, so in most cases you can satisfy a request yourself without involving us.
• —Rectification and erasure: records in your workspace are editable and deletable by you, subject to the audit-trail limitation in clause 09 and clause 07 of the Privacy notice.
• —Where a request cannot be satisfied through the platform, we will help by reasonable means and will tell you if we consider a charge appropriate before incurring it.

Personal data breach

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process for you, and in any event within [to confirm: commit to a breach notification window — 24 or 48 hours is typical] of becoming aware. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

We will not notify a supervisory authority or affected data subjects on your behalf unless you instruct us to. That is the controller’s decision and its timing is your legal exposure, not ours to pre-empt.

We operate an internal incident register that classifies incidents by severity and tracks them from detection through remediation, so a breach has a defined path rather than an improvised one.

DPIAs and prior consultation

We will provide reasonable assistance with a data protection impact assessment and with any prior consultation with a supervisory authority, to the extent it relates to our processing and taking into account the information available to us. Annex II and Annex III are written to be usable directly as DPIA input — that is much of the reason they are as specific as they are.

On expiry or termination we will, at your choice, delete or return the personal data we process for you, and delete existing copies, unless we are required by law to retain something. You may export your data from the platform at any time before access ends, and on request we will provide a copy in a machine-readable format.

The audit trail is a stated exception

Deal Scout’s audit log is append-only and enforced as such in the database: updates and deletes are rejected outright, including by our own administrators. That is a deliberate fiduciary control, because an audit trail that can be quietly edited is not an audit trail.

The consequence is that deletion cannot remove the record that a named person approved a given action at a given time. We consider retention of that record necessary for compliance with legal obligations and for establishing and defending legal claims. It is raised here rather than in a footnote because it is the kind of thing an auditor should hear from us first, and because the precise legal footing should be settled with counsel: [to confirm: confirm the retention basis for immutable audit records on termination].

We will make available to you the information reasonably necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections.

• —In the first instance we will satisfy an audit request with documentation: this agreement, its annexes, and any third-party assurance report we hold.
• —Where documentation is genuinely insufficient, we will permit an audit on reasonable prior notice, no more than once a year unless a breach or a regulator’s instruction makes more necessary, during business hours, and subject to confidentiality.
• —An audit must not compromise the confidentiality or security of another customer’s data — tenant isolation is a control we cannot set aside for an inspection.

Third-party certifications and assurance reports we hold: [to confirm: state which of SOC 2, ISO 27001 or an independent penetration test exists, or state plainly that none does yet]. An honest “none yet, and here is the roadmap” survives procurement better than a vague implication of certification.

Some sub-processors in Annex III operate outside the United Kingdom and the European Economic Area. Where we transfer personal data outside those areas we do so under a lawful transfer mechanism, which is [to confirm: confirm mechanism per sub-processor: UK IDTA / Addendum, EU SCCs, or adequacy].

Where the UK International Data Transfer Agreement or the EU Standard Contractual Clauses apply, they are incorporated into this agreement and this document’s annexes populate their appendices. The module and role selections, and the docking clause position, are [to confirm: select SCC modules and complete the transfer-mechanism appendices with counsel].

Hosting and data-residency regions for the two providers that hold the bulk of the data are [to confirm: Supabase project region and Railway region]. This is the first question in most procurement reviews and should not remain open.

Liability under this agreement is subject to the limitations in clause 13 of the Terms of service — which is itself still open, and noted there.

This agreement is governed by [to confirm: governing law], matching the Terms of service.

Access control and authentication

Integrity of financial actions

Data protection in transit, at rest and in transfer

Application security

Organisational measures

Locations of processing, and the transfer mechanism relied on for each, are [to confirm: complete per sub-processor: country of processing and transfer mechanism]. This table and clause 11 should be completed together.