Ergobot UK Data Processing Agreement (DPA)

• Data Protection Laws: UK GDPR and the Data Protection Act 2018, plus applicable guidance and codes of practice issued by the UK ICO.
• Other capitalised terms have the meanings given in the UK GDPR (e.g., Personal Data, Processing, Controller, Processor, Data Subject, Personal Data Breach).

• The Customer is the Controller of Customer Personal Data.
• The Supplier acts as Processor when it processes Customer Personal Data on the Customer’s behalf under the Agreement.
• Processing details are set out in Annex 1.

The Supplier will:

1. process Customer Personal Data only on documented instructions from the Customer (including as needed to provide the Services), unless required by law;
2. ensure personnel who process Customer Personal Data are subject to appropriate confidentiality obligations;
3. implement appropriate technical and organisational measures (“TOMs”) to protect Customer Personal Data (Annex 2);
4. take reasonable steps to ensure ongoing confidentiality, integrity, availability and resilience of systems and services;
5. notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data;
6. assist the Customer (taking into account the nature of processing) with Data Subject requests, DPIAs, and consultations with the ICO, to the extent reasonably required and legally necessary; and
7. at the Customer’s choice, return or delete Customer Personal Data at the end of the Services, unless retention is required by law.

If Customer Personal Data is transferred outside the UK, the Supplier will ensure appropriate safeguards are in place (for example, the UK IDTA or the UK Addendum to the EU SCCs, as applicable).

5.1 General authorisation

The Customer gives the Supplier a general authorisation to appoint subprocessors, provided the Supplier:

• maintains a list of subprocessors (see Annex 3); and
• ensures each subprocessor is bound by written terms providing at least the same level of protection as this DPA.

5.2 Changes to subprocessors

If the Supplier intends to add or replace a material subprocessor, it will give the Customer at least 30 days’ prior notice. If the Customer objects on reasonable data protection grounds within 15 days, the parties will work in good faith to resolve the concern. If unresolved, the Customer may terminate the affected part of the Services before the new subprocessor starts processing.

On reasonable request, the Supplier will provide information (and where appropriate third‑party assurances) demonstrating compliance with this DPA. Any audit will be subject to reasonable scope, confidentiality, and security requirements.

Liability relating to this DPA is dealt with in the parties’ main agreement, unless mandatory law requires otherwise.

The Supplier maintains appropriate measures, including:

• Role‑based access and least privilege
• MFA for admin accounts
• Encryption in transit (TLS)
• Encryption at rest
• Logging and monitoring
• Vulnerability management
• Backups and disaster recovery
• Secure development practices
• Incident response processes

See /legal/subprocessors for the live list. Snapshot below: