Data Processing Agreement (DPA)

If you need a signed copy please contact support@chatthing.ai.

Last updated: 24 October 2026

Structure

This DPA is structured as follows:

Section A – Key Terms

The variables defined in Section A serve as definitions in Section B.

Section B – Legal Terms

1. Purpose and scope

(a) The purpose of this Data Processing Agreement (the "DPA") is to ensure compliance with Article 28(3) and (4) of the UK GDPR and, if and to the extent applicable to the processing, Article 28(3) and (4) of the EU GDPR and Article 9 of the Swiss Federal Act on Data Protection ("FADP").

(b) This DPA applies to the processing of personal data as specified in Section A.

(c) This DPA forms part of the Base Agreement. A signed copy is available on request.

2. Definitions and interpretation

(a) "Data Protection Laws" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and, if and to the extent applicable, the EU GDPR and the FADP, each as amended or replaced from time to time. "UK GDPR" has the meaning given in section 3(10) of the Data Protection Act 2018. "EU GDPR" means Regulation (EU) 2016/679. References in this DPA to "GDPR" are to the UK GDPR and, where applicable, the EU GDPR.

(b) Where this DPA uses terms defined in the Data Protection Laws (including "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority"), those terms have the same meaning as in those laws. For processing subject to the UK GDPR, the competent supervisory authority is the Information Commissioner's Office.

(c) This DPA shall be read and interpreted in the light of the Data Protection Laws.

(d) This DPA shall not be interpreted in a way that conflicts with rights and obligations provided for in the Data Protection Laws or prejudices the fundamental rights or freedoms of data subjects.

3. Hierarchy

In the event of a conflict between this DPA and the provisions of any other agreement between the Parties existing at the time this DPA is agreed or entered into thereafter, this DPA shall prevail, except where explicitly agreed otherwise in writing.

4. Description of processing

The details of the processing operations, in particular the categories of personal data and the purposes for which the personal data is processed on behalf of the Controller, are specified in Section A.

5. Obligations of the Parties

5.1 Instructions

(a) The Processor shall process personal data only on documented instructions from the Controller, unless required to do so by the law of the United Kingdom (or, where applicable, EU, EU Member State or Swiss law) to which the Processor is subject. The Controller's instructions are specified in Section A and the Base Agreement, and include the Controller's configuration of the platform. Where the Processor is required by law to process personal data otherwise than on the Controller's instructions, it shall inform the Controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest. The Controller may give subsequent instructions throughout the duration of the processing. Such instructions shall always be documented.

(b) The Processor shall immediately inform the Controller if, in the Processor's opinion, an instruction given by the Controller infringes the Data Protection Laws.

5.2 Purpose limitation

The Processor shall process the personal data only for the specific purposes of the processing set out in Section A.

5.3 Duration, erasure and return of data

(a) Processing by the Processor shall only take place for the duration specified in Section A.

(b) On termination of the provision of the services, or on termination under Clause 8, the Processor shall, at the Controller's choice, return all the personal data to the Controller and/or delete it, and delete existing copies, unless the law of the United Kingdom (or, where applicable, EU, EU Member State or Swiss law) requires storage of the personal data.

5.4 Security of processing

(a) The Processor shall implement the technical and organisational measures specified in Section C to ensure the security of the personal data, including protection against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to that data (a personal data breach), in accordance with Articles 5, 28(3)(c) and 32 GDPR and, where applicable, Article 8 FADP. In assessing the appropriate level of security, the Processor shall take due account of the risks involved in the processing, the nature of the personal data and the nature, scope, context and purposes of the processing.

(b) In the event of a personal data breach concerning data processed by the Processor, it shall notify the Controller without undue delay and at the latest within 48 hours after becoming aware of the breach. The notification shall contain the details of a contact point where more information can be obtained, a description of the nature of the breach (including, where possible, the categories and approximate number of data subjects and data records concerned), its likely consequences and the measures taken or proposed to mitigate its possible adverse effects. Where, and insofar as, it is not possible to provide all of this information at the same time, the initial notification shall contain the information then available and further information shall be provided as it becomes available, without undue delay.

(c) The Processor shall cooperate in good faith with and assist the Controller in any way necessary to enable the Controller to notify, where relevant, the competent supervisory authority and the affected data subjects, taking into account the nature of the processing and the information available to the Processor.

(d) The Processor shall grant its personnel access to the personal data only to the extent strictly necessary for the implementation, management and monitoring of the Base Agreement. The Processor shall ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

(e) If the processing involves personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data or biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person's sex life or sexual orientation, or data relating to criminal convictions and offences (special categories of data), the Processor shall apply specific restrictions and/or additional safeguards as reasonably required by the Controller.

5.5 Documentation and compliance

(a) The Parties shall be able to demonstrate compliance with this DPA.

(b) The Processor shall deal promptly and properly with all reasonable enquiries from the Controller that relate to the processing under this DPA.

(c) The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this DPA that stem directly from the Data Protection Laws and, at the Controller's request, allow for and contribute to reviews of data files and documentation, or audits of the processing activities covered by this DPA, in particular if there are indications of non-compliance.

(d) The Controller may choose to conduct the audit itself, to mandate an independent auditor at its own cost, or to rely on an independent audit mandated by the Processor. Where the Processor mandates an audit, it shall bear the costs of the independent auditor. The Controller's audit, access and inspection rights under this Clause are limited to the Processor's records (including, among others, the records of processing activities and the records of recipients of personal data) and do not extend to the Processor's physical premises. Any audit and request for information shall be limited to information necessary for the purposes of this DPA and shall give due regard to the Processor's confidentiality obligations and legitimate interest in protecting business secrets.

(e) The Processor and the Controller shall make the information referred to in this Clause, including the results of any audits, available to the competent supervisory authority on request if and to the extent required by the Data Protection Laws.

5.6 Use of sub-processors

(a) The Processor has the Controller's general authorisation to engage sub-processors. The list of sub-processors is referred to in Section A. The Processor shall inform the Controller in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 days in advance, giving the Controller the opportunity to object to such changes before the sub-processor concerned is engaged. Any such objection shall not be unreasonably raised. The Parties shall keep the list up to date.

(b) Where the Processor engages a sub-processor to carry out specific processing activities on behalf of the Controller, it shall do so by way of a contract that imposes on the sub-processor, in substance, the same data protection obligations as those imposed on the Processor under this DPA. The Processor shall ensure that the sub-processor complies with the obligations to which the Processor is subject under this DPA, Article 28(2) to (4) GDPR and, where applicable, Article 9(3) FADP.

(c) At the Controller's request, the Processor shall provide a copy of such a sub-processor agreement and any subsequent amendments to the Controller. To the extent necessary to protect business secrets or other confidential information, including personal data, the Processor may redact the agreement before sharing it.

(d) The Processor shall remain fully responsible to the Controller for the performance of the sub-processor's obligations under its contract with the Processor. The Processor shall notify the Controller of any failure by a sub-processor to fulfil its obligations under that contract.

5.7 International transfers

(a) Any transfer of personal data by the Processor to a country outside the United Kingdom (and, for processing subject to the EU GDPR or the FADP, outside the EEA or Switzerland) or to an international organisation shall be undertaken only if authorised in accordance with Section A, and shall take place in compliance with Chapter V of the UK GDPR and, where applicable, Chapter V of the EU GDPR and the FADP.

(b) The Controller agrees that where the Processor engages a sub-processor in accordance with Clause 5.6 to carry out specific processing activities on the Controller's behalf, and those activities involve a restricted transfer of personal data, the Processor and the sub-processor may rely on: (i) adequacy regulations made under section 17A of the Data Protection Act 2018 (including, where the sub-processor is certified, the UK Extension to the EU-US Data Privacy Framework) or, where applicable, an adequacy decision of the European Commission; or (ii) the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018 or, where applicable, the Standard Contractual Clauses adopted by the European Commission under Article 46(2) EU GDPR, provided the conditions for their use are met and a transfer risk assessment has concluded that the transfer provides an essentially equivalent level of protection.

6. Data subject rights

(a) The Processor shall promptly notify the Controller of any request received directly from a data subject. It shall not respond to that request itself unless and until it has been authorised to do so by the Controller.

(b) The Processor shall assist the Controller in fulfilling its obligations to respond to data subjects' requests to exercise their rights under Chapter III GDPR and, where applicable, Chapter 4 FADP, namely:

• the right to be informed, whether or not the personal data was obtained from the data subject;
• the right of access;
• the right to rectification;
• the right to erasure ("the right to be forgotten");
• the right to restriction of processing;
• the notification obligation regarding rectification or erasure of personal data or restriction of processing;
• the right to data portability;
• the right to object;
• the right not to be subject to a decision based solely on automated processing, including profiling; and
• the right to withdraw consent.

(c) The Processor shall assist the Controller if a data subject lodges a complaint with the competent supervisory authority that concerns data processed under this DPA.

(d) In addition to its obligation under Clause 6(b), the Processor shall assist the Controller in ensuring compliance with the following obligations, taking into account the nature of the processing and the information available to the Processor:

• the obligation to notify a personal data breach to the competent supervisory authority without undue delay after becoming aware of it (unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons), in accordance with Article 33 GDPR and, where applicable, Article 24(1) to (3) FADP;
• the obligation to communicate a personal data breach to the data subject without undue delay where it is likely to result in a high risk to the rights and freedoms of natural persons, in accordance with Article 34 GDPR and, where applicable, Article 24(4) FADP;
• the obligation to carry out a data protection impact assessment where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, in accordance with Article 35 GDPR and, where applicable, Article 22 FADP; and
• the obligation to consult the competent supervisory authority before processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the Controller to mitigate the risk, in accordance with Article 36 GDPR and, where applicable, Article 23 FADP.

(e) The technical and organisational measures by which the Processor assists the Controller under this Clause 6 are set out in Section C.

7. Notification of personal data breaches

(a) In the event of a personal data breach, the Processor shall cooperate in good faith with and assist the Controller in any way necessary for the Controller to comply with its obligations under Articles 33 and 34 GDPR and, where applicable, Article 24 FADP, taking into account the nature of the processing and the information available to the Processor.

(b) The Processor shall assist the Controller in notifying the personal data breach to the competent supervisory authority, where relevant. In particular, the Processor shall assist in obtaining the following information which, under Article 33(3) GDPR or, where applicable, Article 24(2) FADP, must be stated in the Controller's notification:

• the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
• the likely consequences of the personal data breach; and
• the measures taken or proposed to be taken by the Controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

8. Suspension and termination

(a) Without prejudice to the Data Protection Laws, if the Processor is in breach of its obligations under this DPA, the Controller may instruct the Processor to suspend the processing of personal data temporarily until the Processor complies with this DPA or the Base Agreement is terminated. The Processor shall promptly inform the Controller if it is unable to comply with this DPA, for whatever reason.

(b) The Controller shall be entitled to terminate this DPA where:

• the processing of personal data by the Processor has been suspended by the Controller under Clause 8(a), the Processor's breach is material, and compliance with this DPA is not restored within a reasonable time and in any event within one month of suspension;
• the Processor is in substantial or persistent breach of this DPA or its obligations under the Data Protection Laws, and the breach cannot reasonably be expected to be remedied; or
• the Processor fails to comply with a binding decision of a competent court or the competent supervisory authority regarding its obligations under this DPA or the Data Protection Laws.

(c) This DPA shall remain in full force and effect for as long as the Base Agreement remains in effect. Any provision of this DPA that expressly or by implication should come into or continue in force on or after termination of the Base Agreement in order to protect personal data shall remain in full force and effect.

9. Liability

Each Party's liability arising out of or related to this DPA shall be subject to the limitations and exclusions of liability set out in the Base Agreement, save that nothing in this DPA limits either Party's liability to data subjects or supervisory authorities under the Data Protection Laws.

10. Governing law and jurisdiction

This DPA and any dispute or claim arising out of or in connection with it shall be governed by the law of England and Wales. The courts of England and Wales shall have exclusive jurisdiction to settle any such dispute or claim.

11. Execution

Where the Parties sign a copy of this DPA, it may be executed electronically and in any number of counterparts, each of which is an original and which together constitute one agreement.

Section C – TOMs

Description of the technical and organisational security measures implemented by the Processor.

Organisational security measures

Security management

1. Security policy and procedures. The Processor has a documented security policy with regard to the processing of personal data.
2. Roles and responsibilities. Roles and responsibilities related to the processing of personal data are clearly defined and allocated in accordance with the security policy. During internal reorganisations, terminations and changes of employment, the revocation of rights and responsibilities, with the respective hand-over procedures, is clearly defined.
3. Access control policy. Specific access control rights are allocated to each role involved in the processing of personal data, following the need-to-know principle.
4. Resource and asset management. The Processor keeps a register of the IT resources used for the processing of personal data (hardware, software and network). A specific person is assigned the task of maintaining and updating the register.
5. Change management. The Processor makes sure that all changes to the IT system are registered and monitored by a specific person. This process is monitored regularly.

Incident response and business continuity

1. Incident handling and personal data breaches. An incident response plan with detailed procedures is defined to ensure an effective and orderly response to incidents involving personal data. The Processor will report to the Controller, without undue delay, any security incident that has resulted in the loss, misuse or unauthorised acquisition of any personal data.
2. Business continuity. The Processor has established the main procedures and controls to be followed to ensure the required level of continuity and availability of the IT system processing personal data in the event of an incident or personal data breach.

Human resources

1. Confidentiality of personnel. The Processor ensures that all personnel understand their responsibilities and obligations related to the processing of personal data. Roles and responsibilities are clearly communicated during the pre-employment and/or induction process.
2. Training. The Processor ensures that all personnel are adequately informed about the security controls of the IT system that relate to their everyday work. Personnel involved in the processing of personal data are also properly informed about relevant data protection requirements and legal obligations through regular awareness activities.

Technical security measures

Access control and authentication

1. An access control system applicable to all users accessing the infrastructure is implemented. The system allows user accounts to be created, approved, reviewed and deleted.
2. The use of shared user accounts is avoided. Where one is necessary, all users of the shared account have the same roles and responsibilities.
3. When granting access or assigning user roles, the need-to-know principle is observed, so that access to personal data is limited to those who require it to achieve the Processor's processing purposes.
4. Where authentication is based on passwords, passwords must be at least eight characters long and conform to strong password control parameters, including length, character complexity and non-repeatability.
5. Authentication credentials (such as user IDs and passwords) are never transmitted unprotected over the network.

Logging and monitoring

Log files are activated for each system and application used for the processing of personal data. They include all types of access to data (view, modification and deletion).

Security of data at rest

1. Database and application servers are configured to run using a separate account, with the minimum operating system privileges needed to function correctly.
2. Database and application servers process only the personal data that is actually needed to achieve the processing purposes.

Network and communication security

Whenever access is performed through the internet, communication is encrypted using cryptographic protocols.

Back-ups

1. Back-up and data restore procedures are defined, documented and clearly linked to roles and responsibilities.
2. Back-ups are given an appropriate level of physical and environmental protection, consistent with the standards applied to the originating data.
3. The execution of back-ups is monitored to ensure completeness.

Application lifecycle security

During the development lifecycle, recognised secure development practices and standards are followed.

Data deletion and disposal

1. Software-based overwriting is performed on media before disposal. Where this is not possible, physical destruction is performed.
2. Paper and portable media used to store personal data are shredded.