Data Processing Agreement

01. About this Schedule

This Data Processing Schedule forms part of the OWIONE Platform Terms and Conditions between OWIONE Ltd (Company No. 17412632) and the Customer. It sets out how OWIONE processes Personal Data on the Customer's behalf when providing the Platform and is the data processing agreement, or DPA, referred to in the Terms. Capitalised terms used but not defined here have the meanings given in the Terms. If there is any conflict between this Schedule and the Terms about OWIONE's processing of Personal Data for the Customer, this Schedule applies.

02. Definitions

In this Schedule, capitalised terms used but not defined below have the meaning given to them in the Terms, and the following definitions apply:

Controller

has the meaning given in the UK GDPR, being the Customer in respect of the Protected Data processed under this Schedule.

Data Protection Laws

the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and all other applicable laws relating to the processing of personal data and privacy, in each case as amended or replaced from time to time.

Data Subject

an identified or identifiable natural person to whom Protected Data relates, of the categories described in the Processing Details.

International Transfer

a transfer of Protected Data to, or access to Protected Data from, a country or territory outside the United Kingdom.

Personal Data Breach

a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Protected Data.

Processing Details

the details of the processing set out in the Processing Details table in this Schedule, including the subject matter, duration, nature and purpose of the processing, the types of Protected Data and the categories of Data Subject.

Processor

has the meaning given in the UK GDPR, being OWIONE in respect of the Protected Data processed under this Schedule.

Protected Data

Personal Data contained within Customer Data that is processed by OWIONE on the Customer's behalf under or in connection with the Terms and this Schedule.

Sub-processor

any third party engaged by OWIONE (or by any other Sub-processor) to process Protected Data on OWIONE's behalf in connection with the Platform.

UK Addendum

the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018, as amended or replaced from time to time.

UK GDPR

the retained EU law version of the General Data Protection Regulation (Regulation (EU) 2016/679) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.

UK IDTA

the International Data Transfer Agreement issued by the Information Commissioner under section 119A of the Data Protection Act 2018, as amended or replaced from time to time.

03. Processing Roles and Scope

Roles of the parties. For the purposes of this Schedule and the Data Protection Laws, in respect of the Protected Data:

• where Protected Data is contained in Customer Data, including documents, employee records, job information, business records, evidence or other information supplied by the Customer or ingested through authorised integrations, the Customer is the Controller; and
• OWIONE is the Processor, processing that Protected Data only on the Customer's behalf to provide and support the Platform.

This Schedule does not apply to personal data that OWIONE processes as a controller in its own right, including account, registration, billing, platform administration, service management, usage analytics, legal compliance, business operations and OWIONE's own marketing communications personal data, which OWIONE processes in accordance with its Privacy Policy.

Compliance. Each party will comply with its obligations under the Data Protection Laws in connection with the processing of Protected Data. Nothing in this Schedule relieves either party of its own direct obligations or liabilities under the Data Protection Laws.

Processing Details. The subject matter, duration, nature and purpose of the processing, the types of Protected Data and the categories of Data Subject are set out in the Processing Details table below.

04. Processing Details

Subject matter

Processing of Protected Data contained in Customer Data to provide, operate, support and secure the Platform, including generating Platform Outputs.

Duration

For the duration of the Subscription Term and the Customer's Account, and thereafter only as set out in the clause dealing with deletion or return of Protected Data in this Schedule and the clause of the Terms dealing with Customer Data on termination.

Nature and purpose

Hosting, storage, organisation, retrieval, analysis, generation of Platform Outputs, and other operations reasonably necessary to provide and support the Platform, in each case on the Customer's documented instructions.

Types of Protected Data

Names; business contact details; job titles and roles; employee, contractor and subcontractor information; qualifications and training information; competence, certification and evidence information; customer and supplier information; job, project and site information; account and user identifiers where contained in Customer Data; and other personal data contained in documents, records, evidence or other business data supplied by the Customer or ingested through authorised integrations.

Categories of Data Subject

Authorised Users; employees; workers; contractors and subcontractors; customers and prospective customers; suppliers; business contacts; personnel whose evidence appears in connected records; and other individuals whose personal data appears in Customer Data or customer-provided or connected information.

05. Processor Obligations

OWIONE will, in relation to the Protected Data:

• process the Protected Data only on the Customer's documented instructions, including as set out in this Schedule and the Terms, unless required to process otherwise by applicable law, in which case OWIONE will (where lawful) inform the Customer of that legal requirement before processing;
• promptly inform the Customer if, in OWIONE's opinion, an instruction infringes the Data Protection Laws, without any obligation to actively monitor the Customer's compliance;
• ensure that persons authorised to process the Protected Data are bound by appropriate obligations of confidentiality;
• implement and maintain the technical and organisational measures described in the clause of this Schedule dealing with security measures;
• taking into account the nature of the processing, provide reasonable assistance to the Customer, by appropriate technical and organisational measures and so far as is possible, in responding to requests from Data Subjects and in complying with the Customer's obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to OWIONE;
• make available to the Customer the information reasonably necessary to demonstrate compliance with this Schedule and OWIONE's obligations under Article 28 of the UK GDPR; and
• not process the Protected Data for any purpose other than providing and supporting the Platform, save that OWIONE may create and use Usage Data derived from Customer Data on an aggregated and anonymised basis that does not identify the Customer or any individual.

Reimbursement for assistance. OWIONE may charge the Customer its reasonable costs for assistance provided under this Schedule that goes beyond the standard functionality of the Platform, provided OWIONE notifies the Customer of any material charges before incurring them.

06. Customer Obligations

The Customer:

• warrants that it has, and will maintain throughout the term, all necessary rights, consents, notices and lawful bases to authorise the processing of the Protected Data by OWIONE and any Sub-processor as contemplated by this Schedule and the Terms;
• is solely responsible for the accuracy, quality and legality of the Protected Data and the means by which it acquired the Protected Data;
• will ensure its instructions to OWIONE comply with the Data Protection Laws; and
• acknowledges that OWIONE is entitled to rely on the Customer's instructions and warranties, and will indemnify OWIONE against losses arising from the Customer's breach of this clause, subject to the liability provisions of the Terms.

07. Sub-processors

General authorisation. The Customer gives OWIONE general authorisation to engage the Sub-processors listed in Annex 1 (Approved Sub-processors) to process the Protected Data, and to appoint replacement or additional Sub-processors in accordance with this clause.

Changes to Sub-processors. OWIONE will give the Customer prior notice (which may be given by posting an updated list on the Platform or by email) of any intended appointment of a new or replacement Sub-processor, giving the Customer a reasonable opportunity to object on reasonable data protection grounds before that Sub-processor begins processing Protected Data.

Objection. If the Customer reasonably objects, the parties will discuss the objection in good faith. If OWIONE is unable to provide an alternative that reasonably addresses the objection, the Customer may, as its sole and exclusive remedy, terminate the affected subscription in accordance with the clause of the Terms dealing with termination.

Sub-processor terms. OWIONE will impose on each Sub-processor, by written contract, data protection obligations that are substantially equivalent to those imposed on OWIONE under this Schedule, and remains fully liable to the Customer for the performance of each Sub-processor's obligations.

08. Security Measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to Data Subjects, OWIONE will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to that risk, including the measures set out in Annex 2 (Security Measures).

OWIONE may update or modify the security measures from time to time, provided that any such change does not materially reduce the overall level of security of the Platform.

09. Personal Data Breaches

OWIONE will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting the Protected Data.

That notification will, to the extent then known and reasonably available to OWIONE, include:

• a description of the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records affected;
• the likely consequences of the Personal Data Breach; and
• the measures taken or proposed to be taken to address the Personal Data Breach and mitigate its possible adverse effects.

OWIONE will provide reasonable cooperation and assistance to the Customer in relation to the investigation, mitigation and remediation of the Personal Data Breach, and in relation to any notification the Customer is required to make to the Information Commissioner or affected Data Subjects. OWIONE will not notify any regulator or Data Subject on the Customer's behalf unless required by law or requested in writing by the Customer.

10. Audits

Reports and certifications. OWIONE will, on the Customer's reasonable written request and no more than once in any 12 month period (unless otherwise required by the Data Protection Laws or following a Personal Data Breach), make available to the Customer copies of relevant certifications, audit reports, security summaries or other documentation reasonably necessary to demonstrate compliance with this Schedule.

On-site audits. Where the reports and certifications clause above is not sufficient to demonstrate compliance, the Customer (or an independent auditor appointed by it and reasonably acceptable to OWIONE) may conduct an audit of OWIONE's processing of the Protected Data, subject to the following. Any such audit will:

• be conducted no more than once in any 12 month period (unless required by the Data Protection Laws or following a Personal Data Breach), on at least 30 days' prior written notice, during normal business hours;
• be limited in scope to information and systems relevant to the processing of the Protected Data, and must not disrupt OWIONE's operations or compromise the confidentiality or security of other customers' data;
• be subject to OWIONE's reasonable confidentiality, security and access policies; and
• be at the Customer's cost, save where the audit reveals a material breach by OWIONE of this Schedule, in which case OWIONE will bear its own reasonable costs of the audit.

11. International Transfers

OWIONE will not carry out, or permit any sub-processor to carry out, an International Transfer of the Protected Data unless it has taken such measures as are necessary to ensure the transfer is in compliance with the Data Protection Laws.

The Customer acknowledges that OWIONE may use the approved sub-processors listed in Annex 1, including infrastructure, email delivery, authentication and AI processing providers, for the purposes described in that Annex. Where any such use involves an International Transfer, OWIONE will ensure that the transfer is made in accordance with this clause.

Where an International Transfer takes place, OWIONE will ensure that at least one of the following applies:

• the transfer is to a country or territory that is the subject of adequacy regulations under the Data Protection Laws;
• the transfer is made under the UK IDTA, or under the EU Commission Standard Contractual Clauses as supplemented by the UK Addendum, in each case duly completed and executed between the relevant parties; or
• another lawful transfer mechanism under the Data Protection Laws applies.

Where required by the applicable transfer mechanism, OWIONE will carry out and document a transfer risk assessment and implement any supplementary technical, organisational or contractual measures reasonably necessary to ensure that the Protected Data receives an essentially equivalent level of protection to that provided under the Data Protection Laws.

OWIONE will ensure that each sub-processor that processes Protected Data is subject to written contractual obligations that provide an appropriate level of protection for the Protected Data, including obligations relating to confidentiality, security, data protection and international transfers where applicable.

12. Deletion or Return of Protected Data

On expiry or termination of the Customer's Account, subscription or any beta trial, the Customer may, within the 30-day period referred to in the clause of the Terms dealing with Customer Data on termination, elect for OWIONE to return and/or delete the Protected Data. This clause supplements, and is to be read together with, that clause of the Terms, which governs the export and deletion of Customer Data on termination.

Following the end of that 30-day period, or where the Customer has not made an election within that period, OWIONE will delete or de-identify the Protected Data within a reasonable period, unless retention is permitted under the following paragraph.

OWIONE may retain Protected Data to the extent, and for so long as, required by applicable law, or where the Protected Data is retained in routine backups. Where OWIONE retains Protected Data under this paragraph, OWIONE will continue to protect that Protected Data in accordance with this Schedule until it is deleted in the ordinary course.

13. General

Relationship with the Terms. This Schedule is a schedule to, and forms part of, the Terms. Except as expressly modified by this Schedule, the Terms continue in full force, including their provisions on liability, confidentiality, assignment, entire agreement, third parties, severance and waiver.

Order of precedence. In relation to the processing of Personal Data on the Customer's behalf, if there is a conflict between this Schedule and the body of the Terms, this Schedule prevails. In all other respects, the body of the Terms prevails.

Governing law and jurisdiction. This Schedule and any dispute arising out of or in connection with it are governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

14. Annex 1 — Approved Sub-processors

The Customer authorises OWIONE to engage the following sub-processors for the purposes of providing the Services. OWIONE remains responsible for the acts and omissions of its sub-processors to the extent required under applicable Data Protection Laws.

OWIONE is currently hosted on AWS in the Ireland eu-west-1 region. Its production infrastructure currently uses AWS ECS for application hosting, AWS RDS for database storage, AWS S3 for file and document storage, and AWS Cognito for authentication and role-based access.

OWIONE does not currently use an SMS provider. If SMS functionality is introduced in the future, OWIONE will update its applicable legal documentation, including this list of sub-processors where required, before that functionality goes live.

OWIONE may update this Annex 1 from time to time in accordance with the sub-processor notification and approval process set out in this Schedule or the Terms.

15. Annex 2 — Security Measures

OWIONE implements and maintains appropriate technical and organisational measures in respect of the Platform. Some measures are currently implemented, while others are planned to be implemented before the Platform's general beta launch, as set out below.

Measures currently implemented. OWIONE currently implements and maintains the following technical and organisational measures:

• Access control: role-based access controls, unique user credentials, and revocation of access on role change or departure, restricting access to Protected Data to personnel who need it to provide the Platform.
• Authentication: enforcement of strong authentication for access to relevant systems.
• Encryption: encryption of Protected Data in transit using industry-standard protocols, such as TLS, and encryption of Protected Data at rest where supported by OWIONE's hosting and infrastructure providers.
• Network and infrastructure security: use of secure hosting infrastructure, access restrictions, and system configuration measures designed to protect the Platform and Protected Data.
• Personnel: confidentiality obligations and appropriate access controls for personnel with access to Protected Data.
• Sub-processor management: due diligence on, and contractual security obligations imposed on, Sub-processors as required by this Schedule.

Additional measures intended to be implemented before general beta launch. OWIONE intends to implement and maintain the following additional technical and organisational measures before the Platform's general beta launch:

16. Annex 2 (continued) — Measures planned before general beta

• Authentication: support for multi-factor authentication for administrative access.
• Network and infrastructure security: additional firewalls, network segregation, intrusion detection and prevention, and hardening of systems and infrastructure, where appropriate.
• Resilience and backups: regular backups, disaster recovery arrangements, and measures designed to ensure the ongoing availability and integrity of the Protected Data.
• Vulnerability management: regular patching, vulnerability scanning, and periodic security testing of the Platform.
• Logging and monitoring: logging of relevant access and activity, and monitoring designed to detect and respond to security events.
• Personnel: security awareness training and appropriate vetting of personnel with access to Protected Data.
• Incident response: documented incident response and Personal Data Breach handling procedures.