Data Processing Agreement

Parties

This Data Processing Agreement ("DPA") forms part of the agreement for services (the "Principal Agreement") between:

• (1)BI22 I.T Consultancy Ltd, trading as CongruityDocs, a company registered in England & Wales (company number 10064896, ICO registration ZC206973) ("CongruityDocs", the "Processor"); and
• (2)the client identified in the Principal Agreement (the "Client", the "Controller").

CongruityDocs and the Client are each a "Party" and together the "Parties". Where CongruityDocs processes personal data contained in materials the Client supplies, it does so as the Client's processor. Terms such as "personal data", "processing", "controller", "processor" and "data subject" have the meanings given in the UK GDPR and the Data Protection Act 2018 (together, "Data Protection Law").

1. Scope and roles

1.1This DPA applies to CongruityDocs' processing of personal data on the Client's behalf in the course of providing consultancy and document-related services via the CongruityDocs portal.

1.2The Client is the controller and CongruityDocs is the processor in respect of the personal data described in Annex 1.

1.3The Client warrants that it has a lawful basis for the processing and for supplying the personal data to CongruityDocs, and that its instructions comply with Data Protection Law.

2. Processor obligations

2.1CongruityDocs shall process the personal data only on the Client's documented instructions (including as set out in this DPA and the Principal Agreement), unless required to do otherwise by law, in which case it shall inform the Client first unless legally prohibited.

2.2CongruityDocs shall promptly inform the Client if, in its opinion, an instruction infringes Data Protection Law.

2.3CongruityDocs shall ensure that persons authorised to process the personal data are bound by confidentiality.

2.4CongruityDocs shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex 2 (Article 32).

3. Sub-processors

3.1The Client grants general authorisation for CongruityDocs to engage the sub-processors listed in Annex 3, each of which is bound by a written contract imposing data-protection obligations substantially equivalent to those in this DPA.

3.2CongruityDocs shall inform the Client of any intended addition or replacement of a sub-processor by email or portal notice at least 14 days in advance. The Client may object within 14 days of the notice on reasonable data-protection grounds. If the Parties cannot resolve the objection, the Client may terminate the affected engagement; absent an objection within that period, the change is deemed authorised.

3.3CongruityDocs remains fully liable to the Client for the performance of each sub-processor's obligations.

4. International transfers

4.1Some sub-processors are located outside the UK (see Annex 3). Where personal data is transferred outside the UK, CongruityDocs shall ensure the transfer is subject to appropriate safeguards under Chapter V of the UK GDPR — namely the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or a valid adequacy basis.

4.2CongruityDocs has carried out a transfer risk assessment in respect of such transfers and applies supplementary measures where appropriate.

5. Assistance to the Client

5.1Taking into account the nature of processing, CongruityDocs shall assist the Client (so far as reasonably possible) in fulfilling data-subject rights requests.

5.2CongruityDocs shall assist the Client with data protection impact assessments, prior consultations, and its security and breach-notification obligations under Articles 32–36, taking into account the information available to CongruityDocs.

5.3CongruityDocs shall notify the Client without undue delay after becoming aware of a personal data breach affecting the Client's personal data, and shall provide the information the Client reasonably needs to meet its own notification obligations.

6. Audit and records

6.1CongruityDocs shall make available to the Client information reasonably necessary to demonstrate compliance with this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Client or an auditor mandated by the Client, on reasonable notice and subject to confidentiality. Certifications held by CongruityDocs or its sub-processors may be relied upon to reduce the scope of any audit.

7. Return and deletion

7.1Source documents and deliverables are retained for up to 90 days after delivery of the relevant work, to allow the Client to retrieve deliverables, after which CongruityDocs deletes them from its systems. The Client may request earlier deletion at any time via the portal. Engagement records (project details, messages and deletion audit entries) are retained in accordance with the Principal Agreement and applicable law. On termination of the services, or at the Client's request, CongruityDocs shall (at the Client's choice) delete or return the personal data and delete existing copies, unless retention is required by law.

7.2CongruityDocs maintains a record of such deletions.

8. General

8.1In the event of conflict between this DPA and the Principal Agreement on data-protection matters, this DPA prevails.

8.2This DPA is governed by the laws of England & Wales, and the Parties submit to the exclusive jurisdiction of the courts of England & Wales.

8.3This DPA takes effect on the effective date of the Principal Agreement and continues for as long as CongruityDocs processes personal data on the Client's behalf.

8.4This DPA may be accepted electronically. The Parties agree that the Client's acceptance recorded in the CongruityDocs portal — including the date, time, account under which acceptance was given and the version of this DPA accepted — constitutes valid execution of this DPA and is binding on the Parties, without the need for a handwritten signature.

Annex 1 — Description of processing

Annex 2 — Technical and organisational measures (Article 32)

• Encryption of personal data in transit (TLS) and at rest.
• Access control on a least-privilege basis; administrative access restricted to authorised personnel; row-level security on the database.
• Authentication managed via a dedicated identity provider; multi-factor authentication available.
• Data minimisation and short retention: source documents and deliverables deleted within 90 days of delivery, or earlier at the Client's request, with each deletion recorded in an audit log.
• Watermarking of preview deliverables; final deliverables released only after payment confirmation, or where the engagement is expressly agreed as complimentary (nil-fee).
• Segregation via reputable, security-certified infrastructure providers (see Annex 3).
• Regular review of access, secrets rotation, and vendor security posture.
• Breach detection and notification procedures.

Annex 3 — Authorised sub-processors

The following sub-processors are engaged in the provision of the services. Each is bound by data-protection terms substantially equivalent to this DPA, and by appropriate transfer safeguards where located outside the UK.

Acceptance

This DPA does not require a handwritten signature. As set out in clause 8.4, it is accepted electronically when the Client agrees to it in the CongruityDocs portal during onboarding. That acceptance is recorded together with the date, time, the account under which it was given, and the version of this DPA accepted, and is binding on both Parties from that point.