DATA PROCESSING AGREEMENT

This Data Processing Agreement ("DPA") forms part of the agreement between Analytix Labs Ltd, a company registered in England and Wales under company number 14275466, trading as UserSearch ("UserSearch"), and the customer subscribing to the UserSearch services ("Customer"). It applies where UserSearch processes personal data on the Customer's behalf.

It should be read alongside our Privacy Policy and our Terms of Service. Customers who need a signed copy can request one at [email protected].

1. Definitions

1.1 "Data Protection Law" means the UK GDPR, the Data Protection Act 2018, and, where it applies to the Customer, Regulation (EU) 2016/679.

1.2 "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" and "Supervisory Authority" have the meanings given in Data Protection Law.

1.3 "Customer Personal Data" means personal data processed by UserSearch on the Customer's behalf in providing the Services.

1.4 "Sub-processor" means a processor engaged by UserSearch to process Customer Personal Data.

1.5 "Standard Contractual Clauses" means the clauses annexed to European Commission Implementing Decision 2021/914, and "UK Addendum" means the International Data Transfer Addendum issued by the Information Commissioner under section 119A of the Data Protection Act 2018.

2. Roles and scope

2.1 The Customer is the Controller and appoints UserSearch as Processor in respect of Customer Personal Data. The Customer is responsible for complying with the obligations that Data Protection Law places on controllers, including having a lawful basis for each search it runs.

2.2 The subject matter, nature, purpose, duration, categories of data subject and categories of personal data are set out in Annex 1.

2.3 Where the Customer is itself acting as a processor for a third-party controller, the Customer is UserSearch's single point of contact, must hold the necessary authority from that controller, and gives all instructions on its behalf.

2.4 UserSearch also processes data relating to the operation and use of the Services — account management, billing, support, security, and product development — as a Controller in its own right. That processing is described in the UserSearch Privacy Policy and is outside this DPA.

3. Instructions

3.1 UserSearch will process Customer Personal Data only to provide the Services and on the Customer's documented instructions, which are set out in this DPA and the Terms of Service.

3.2 The Customer may issue further reasonable instructions necessary for compliance with Data Protection Law. UserSearch may charge a reasonable fee for acting on instructions that go beyond the Services.

3.3 UserSearch will tell the Customer if it believes an instruction infringes Data Protection Law, and may pause that processing until the instruction is confirmed or amended in writing.

3.4 Where UserSearch is required by law to process Customer Personal Data otherwise than on the Customer's instructions, it will inform the Customer beforehand unless the law prohibits it from doing so.

4. Confidentiality

4.1 UserSearch will ensure that everyone authorised to process Customer Personal Data is bound by an obligation of confidentiality, and that access is limited to those who need it to provide the Services.

5. Security

5.1 UserSearch will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including those set out in Annex 2.

5.2 UserSearch will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide the information reasonably needed for the Customer to meet its own notification obligations.

6. Sub-processors

6.1 The Customer gives general authorisation for UserSearch to engage the Sub-processors listed in Annex 3.

6.2 UserSearch will impose on each Sub-processor, by written contract, obligations equivalent to those in this DPA, and remains responsible to the Customer for its Sub-processors' performance.

6.3 UserSearch will give the Customer at least thirty days' notice before adding or replacing a Sub-processor. The Customer may object on reasonable data protection grounds within that period. If the objection cannot be resolved, the Customer may terminate the affected part of the Services without penalty.

6.4 The third-party data sources queried at the Customer's direction act on their own account under their own terms, and are not Sub-processors under this DPA.

7. Assistance

7.1 Taking into account the nature of the processing and the information available to it, UserSearch will assist the Customer with: responding to requests from data subjects exercising their rights; carrying out data protection impact assessments and any prior consultation with a Supervisory Authority; and meeting its security and breach notification obligations.

7.2 If a data subject contacts UserSearch directly about Customer Personal Data, UserSearch will pass the request to the Customer rather than responding on the Customer's behalf, except where UserSearch is able to act on it under its own Privacy Policy.

7.3 UserSearch may charge a reasonable fee for assistance that goes beyond what is proportionate to the Services.

8. Audit

8.1 UserSearch will make available the information reasonably necessary to demonstrate compliance with this DPA.

8.2 The Customer may audit that compliance once in any twelve-month period, or more often if required by a Supervisory Authority. Audits are on at least thirty days' written notice, during normal business hours, by an independent auditor both parties agree to, and conducted so as to cause minimal disruption.

8.3 The Customer and its auditor are bound by confidentiality as to the conduct and results of the audit, and must comply with UserSearch's security rules while on site.

8.4 The Customer bears the cost of any audit it requests.

9. International transfers

9.1 UserSearch's hosting and several of its Sub-processors are located in the United States, as shown in Annex 3.

9.2 The Customer authorises those transfers. UserSearch will make them only under an adequacy decision, the UK Addendum to the Standard Contractual Clauses, the Standard Contractual Clauses, or another lawful transfer mechanism under Data Protection Law.

9.3 If a transfer mechanism is invalidated or replaced, the parties will work together in good faith to put an alternative in place.

10. Return and deletion

10.1 This DPA ends when the Customer's subscription ends.

10.2 The Customer may export or request a copy of Customer Personal Data for ninety days after termination. After that period, UserSearch will delete it in accordance with the retention periods in its Privacy Policy, except where it is required by law to keep it.

10.3 Copies held in backups are deleted as those backups are overwritten in the normal cycle.

11. General

11.1 Notices under this DPA go to [email protected] and to the email address on the Customer's account.

11.2 UserSearch may update this DPA on reasonable notice where necessary to reflect a change in the Services, its Sub-processors or the law. Changes that materially reduce the Customer's protection require the Customer's agreement.

11.3 If any provision is invalid or unenforceable, the rest continues to apply.

11.4 This DPA is governed by the law of England and Wales, and disputes are subject to the exclusive jurisdiction of the courts of England and Wales.

11.5 Where this DPA conflicts with the Terms of Service on the processing of Customer Personal Data, this DPA prevails.

Annex 1 — description of the processing

Annex 2 — security measures

Annex 3 — sub-processors