Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between:

(1)The Customer identified in the applicable Order ("Customer", "Controller"); and

(2)Build Your Vision Ltd, a company registered in England and Wales under company number 12595924, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("Build Your Vision", "Processor"),

together the "Parties", and forms part of, and is incorporated by reference into, the Terms and Conditions governing the Customer's use of People Hub (the "Agreement"). This DPA applies whenever Build Your Vision processes Personal Data on behalf of the Customer in connection with the Service, and reflects the requirements of UK GDPR, the Data Protection Act 2018, and, where applicable, the EU GDPR.

1.Definitions

"UK GDPR", "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" have the meanings given in the UK GDPR.

"Employee Data" means the Personal Data the Customer or its Authorised Users submit to, or generate within, the Service about the Customer's own employees, workers, and job applicants, including special category data such as health information.

"Sub-processor" means any third party engaged by Build Your Vision to process Employee Data in order to provide the Service.

"Standard Contractual Clauses" or "SCCs" means the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses as amended by the UK Addendum, as applicable to a given transfer.

2.Roles of the Parties

2.1As between the Parties, the Customer is the Controller and Build Your Vision is the Processor in respect of Employee Data. The Customer determines the purposes and means of processing Employee Data; Build Your Vision processes Employee Data only on the Customer's documented instructions, as set out in this DPA, the Agreement, and the Customer's configuration and use of the Service.

2.2The subject matter, duration, nature and purpose of processing, and the categories of Data Subjects and Personal Data, are set out in Annex 1 (Details of Processing).

2.3If Build Your Vision believes an instruction from the Customer infringes UK GDPR or other applicable data protection law, it will inform the Customer without undue delay, and may suspend performance of that instruction pending resolution.

3.Build Your Vision's Obligations

Build Your Vision shall:

• process Employee Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by UK law (in which case Build Your Vision will inform the Customer before processing, unless legally prohibited from doing so);
• ensure that persons authorised to process Employee Data are subject to a duty of confidentiality, whether contractual or statutory;
• implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as set out in Annex 2 (Security Measures);
• not engage a Sub-processor without prior general or specific written authorisation, as set out in Clause 4;
• taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as reasonably possible, to respond to requests from Data Subjects exercising their rights under UK GDPR, as set out in Clause 6;
• assist the Customer in ensuring compliance with its obligations relating to security, breach notification, data protection impact assessments, and prior consultation with the ICO, taking into account the nature of processing and information available to Build Your Vision;
• at the Customer's choice, delete or return all Employee Data at the end of the provision of the Service, and delete existing copies, as set out in Clause 8, unless UK law requires storage;
• make available to the Customer all information reasonably necessary to demonstrate compliance with this Clause 3, and allow for and contribute to audits, as set out in Clause 7.

4.Sub-processors

4.1The Customer provides general written authorisation for Build Your Vision to engage Sub-processors to support the provision of the Service, subject to the conditions in this Clause 4. Build Your Vision's current Sub-processors are listed in Annex 3.

4.2Build Your Vision will impose data protection terms on any Sub-processor that protect Employee Data to a standard no less protective than this DPA, and remains liable to the Customer for a Sub-processor's performance of its data protection obligations.

4.3Build Your Vision will give the Customer at least [30 · to be confirmed] days' prior notice of any intended change to its Sub-processors (via email or an in-app/website notice), giving the Customer the opportunity to object on reasonable data protection grounds. If the Parties cannot resolve the objection, the Customer may terminate the affected part of the Service as its sole remedy.

5.International Transfers

Where Build Your Vision or a Sub-processor transfers Employee Data outside the UK, it will ensure the transfer is subject to appropriate safeguards, such as an applicable UK adequacy regulation, the SCCs, or another lawful transfer mechanism recognised under UK GDPR, and will provide details of such safeguards to the Customer on request.

6.Assistance with Data Subject Rights

6.1Build Your Vision will, taking into account the nature of the processing, provide reasonable technical and organisational assistance to help the Customer respond to requests from Data Subjects exercising their rights under UK GDPR (including access, rectification, erasure, restriction, portability, and objection).

6.2If Build Your Vision receives a request directly from a Data Subject in relation to Employee Data, it will not respond to that request itself (other than to acknowledge receipt), and will promptly forward it to the Customer, who remains responsible for responding as Controller.

7.Audit and Records

7.1Build Your Vision will maintain records of its processing activities as required by Article 30(2) UK GDPR, and make available to the Customer information reasonably necessary to demonstrate compliance with this DPA, which may be satisfied by providing relevant certifications, audit summaries, or completed security questionnaires.

7.2On reasonable prior written notice (at least [30 · to be confirmed] days), and no more than once per year (except following a Personal Data Breach or where required by a supervisory authority), the Customer or its appointed auditor may carry out an audit of Build Your Vision's relevant policies, procedures, and records relating to this DPA, subject to reasonable confidentiality restrictions and during normal business hours, at the Customer's expense unless the audit identifies a material breach of this DPA.

8.Deletion and Return of Data

8.1On termination or expiry of the Agreement, Build Your Vision will, at the Customer's election, make Employee Data available for export in a commonly used format for a period of [30 · to be confirmed] days.

8.2Following that period, Build Your Vision will delete or anonymise all Employee Data, including copies held by Sub-processors, within a further [60 · to be confirmed] days, except to the extent UK law requires continued storage, in which case Build Your Vision will continue to protect it in accordance with this DPA and restrict further processing.

9.Personal Data Breach Notification

9.1Build Your Vision will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Employee Data.

9.2Notification will include, to the extent known at the time (and updated as further information becomes available): the nature of the breach, categories and approximate number of Data Subjects and records concerned, likely consequences, and measures taken or proposed to address the breach and mitigate its effects.

9.3Build Your Vision will cooperate with the Customer and take reasonable steps as directed by the Customer to assist in the investigation, mitigation, and remediation of a Personal Data Breach.

10.Liability

10.1Each Party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement.

10.2Nothing in this DPA relieves either Party of its own direct responsibilities and liabilities under UK GDPR.

11.Term

This DPA takes effect on the date the Customer first accesses the Service and remains in effect for as long as Build Your Vision processes Employee Data on the Customer's behalf, notwithstanding termination or expiry of the Agreement.

12.Governing Law

This DPA is governed by the laws of England and Wales, consistent with the governing law provisions of the Agreement.

Annex 1: Details of Processing

A. List of Parties

Controller: The Customer, as identified in the applicable Order. Contact details: as provided at account registration.

Processor: Build Your Vision Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact: info@buildyourvision.co.uk.

B. Description of Processing

Annex 2: Security Measures

Build Your Vision implements the following categories of technical and organisational measures.

• Encryption of Employee Data in transit (TLS) and at rest (AES-256).
• Role-based access controls within the Service, restricting special category data (e.g. medical forms) to appropriately permissioned roles.
• Multi-factor authentication for staff access to production systems and infrastructure.
• Logging and monitoring of access to production systems.
• Regular access reviews and the principle of least privilege for internal staff access.
• [Backup regime — frequency and retention of encrypted backups · to be confirmed]
• [Vulnerability management — patching cadence and penetration testing frequency · to be confirmed]
• Staff data protection and security training on induction and at least annually.
• Written agreements with Sub-processors imposing data protection obligations no less protective than this DPA.
• Incident response procedure as set out in the Company's internal GDPR / Data Protection Policy.
• Data hosted in the EU (Ireland) via Convex (database and file storage) and Vercel (application hosting).

Annex 3: Sub-processors

As at the date of this DPA, Build Your Vision engages the following Sub-processors.

Signatures

This DPA is incorporated into the Agreement and does not require separate signature unless requested by either Party. Where a signed copy is required: