Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into by and between AI Empowerment Ltd, company number 15515185, registered in England and Wales, with its registered office at 124 City Road, London, EC1V 2NX, trading as "Algominds" ("Algominds", "we", "us", "Processor"), and the customer that has accepted the Algominds Terms of Service or that has otherwise agreed to this DPA in writing (the "Customer", "you", "Controller"). Algominds and the Customer are each a "Party" and together the "Parties".

Algominds is registered with the UK Information Commissioner's Office (the "ICO") under data protection registration reference ZC082052.

---

1. Background and relationship to the Terms

1.1 This DPA is incorporated into and forms part of the agreement between the Parties for the provision of the Services (the "Terms" or "Agreement"), including any order form, subscription, statement of work, or managed-service engagement under which Algominds processes personal data on the Customer's behalf.

1.2 This DPA records the Parties' agreement on the processing of Personal Data in connection with:

(a) Algominds Signals (app.algominds.ai), the self-serve B2B SaaS platform for AI signal intelligence, prospect sourcing, enrichment, and AI outreach copy, where the Customer connects its own mailbox and LinkedIn account through Unipile and processes prospect data through the platform; and

(b) Managed / done-for-you outbound services, where Algominds runs outbound email (through Smartlead) and LinkedIn outreach (through HeyReach and Unipile) on the Customer's behalf under the Customer's instructions; and

(c) any related AI SDR tooling, automation, software and web development, and digital marketing services where Algominds processes Personal Data on the Customer's behalf,

(together, the "Services").

1.3 Roles. For the processing described in clause 1.2, the Customer is the Controller and Algominds is the Processor, except where clause 1.4(b) applies (joint controllership) or clause 1.4(a) applies (Algominds' independent-controller processing). The allocation of roles is described more fully in clause 3 and Annex 1. Where this DPA refers to "the relevant Service" it means the specific Service in connection with which the Personal Data is processed.

1.4 Independent and joint roles. Nothing in this DPA limits the roles Algominds holds in its own right, consistent with the published Algominds Privacy Policy. In particular:

(a) Algominds is an independent Controller for its websites, the Signals account relationship, billing, its own marketing, analytics and prospecting, suppression and do-not-contact lists, deliverability, abuse and fraud prevention, legal claims, and privacy-protective product improvement.

(b) For some discovery and enrichment steps, Algominds and the Customer may act as joint Controllers; where this is the case, clause 3.6 applies.

(c) Stripe acts as an independent Controller for the processing of payments. Algominds never stores full card data. Stripe is listed in Annex 3 for transparency only and is not a Sub-processor of the Customer's prospect data.

1.5 Order of precedence. In the event of any conflict between this DPA and the Terms on a data-protection matter, this DPA prevails. In the event of any conflict between this DPA and the Standard Contractual Clauses or the UK transfer mechanisms referenced in Annex 4, those transfer mechanisms prevail to the extent of the conflict on international-transfer matters. Except as expressly amended by this DPA, the Terms remain in full force and effect.

---

2. Definitions

2.1 In this DPA, the following terms have the meanings set out below. Capitalised terms not defined here have the meaning given in the Terms or in Data Protection Law.

---

3. Scope, roles, and instructions

3.1 Processing on instructions. Algominds shall process Personal Data only on the documented instructions of the Customer, including with regard to transfers of Personal Data to a third country, unless required to process by UK or EU law to which Algominds is subject. In that case, Algominds shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.2 Documented instructions. The Customer's documented instructions are set out in this DPA (including Annex 1), the Terms, and the Customer's configuration and use of the Services (including campaign settings, target lists, suppression entries, and any written instructions the Customer gives through the platform or its account team). Additional or different instructions must be agreed in writing and may be subject to changes in scope, fees, or timelines.

3.3 Unlawful instructions. Algominds shall inform the Customer without undue delay if, in its opinion, an instruction infringes Data Protection Law. Algominds may suspend the affected processing (without liability) until the instruction is confirmed, amended, or withdrawn, but is not obliged to carry out an independent legal review of the Customer's instructions.

3.4 Customer responsibilities and lawful basis. The Customer is the Controller of the Personal Data it processes through the Services and of the prospect data it instructs Algominds to process. The Customer warrants that:

(a) it has a lawful basis under Article 6 (and, where Special Category Data is involved, Article 9) for the processing it instructs, and that its instructions comply with Data Protection Law;

(b) it has provided all notices and obtained all consents and rights necessary to enable the lawful processing of the Personal Data by Algominds and its Sub-processors for the purposes of the Services;

(c) for B2B cold outreach, it understands that such outreach typically relies on legitimate interests (Article 6(1)(f)) supported by a documented Legitimate Interests Assessment ("LIA"), that an easy opt-out and right to object (Article 21) must be honoured, and that suppression lists operate as the enforcement layer; and

(d) it will comply with restricted-jurisdiction controls. The Customer acknowledges that certain jurisdictions (including Germany under the UWG, and similar EU member states) may require prior consent for commercial electronic communications, and warrants that it has the lawful basis and any consent required by local law before instructing outreach into those jurisdictions. Algominds has received a German GDPR/UWG demand and operates restricted-jurisdiction controls accordingly.

3.5 Algominds independent processing. The Customer acknowledges that Algominds processes certain Personal Data as an independent Controller as described in clause 1.4(a), including maintaining suppression and do-not-contact lists, managing deliverability, preventing abuse and fraud, billing, pursuing or defending legal claims, and improving its products in a privacy-protective manner. This processing is governed by the Algominds Privacy Policy and not by this DPA.

3.6 Joint controllership. Where, for specific discovery or enrichment steps, the Parties determine the purposes and means of processing together and therefore act as joint Controllers within the meaning of Article 26, the Parties shall act in accordance with the following allocation: (a) Algominds is responsible for providing transparency information about the discovery and enrichment functionality of the Services and for honouring Data Subject objections through suppression; (b) the Customer is responsible for the lawful basis, for any Article 13/14 notices to the Data Subjects it targets, and for the downstream use of enriched data; and (c) each Party shall make available to Data Subjects the essence of this allocation and shall promptly forward to the other any request or complaint it cannot itself resolve. Data Subjects may exercise their rights against either Party.

---

4. Processor obligations (Article 28(3))

Algominds, as Processor, agrees to and warrants the following.

4.1 (a) Documented instructions

Algominds shall process the Personal Data only on the Customer's documented instructions, as set out in clause 3, including with regard to international transfers, unless required to do otherwise by UK or EU law (in which case clause 3.1 applies).

4.2 (b) Confidentiality of personnel

Algominds shall ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Algominds shall ensure that access to Personal Data is limited to personnel who need it to perform the Services.

4.3 (c) Security of processing (Article 32)

Algominds shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to Data Subjects. The current measures are set out in Annex 2. Algominds may update its TOMs from time to time provided that the updates do not materially reduce the overall level of security.

4.4 (d) Sub-processors

(a) General authorisation. The Customer gives a general written authorisation for Algominds to engage Sub-processors to process Personal Data in connection with the Services. The current Sub-processors are listed in Annex 3.

(b) Changes, advance notice, and right to object. Algominds shall give the Customer at least thirty (30) days' prior notice (by email, in-product notice, or by updating a published Sub-processor list) before any intended addition or replacement of a Sub-processor takes effect, so that the Customer has a reasonable opportunity to object, on reasonable data-protection grounds, before the new Sub-processor begins processing Personal Data, consistent with Clause 9(a) of the SCCs. If the Customer objects on reasonable grounds within the notice period and the Parties cannot agree a resolution, the Customer may, as its remedy, suspend or terminate the part of the Services that cannot be provided without the objected-to Sub-processor (including, where that Sub-processor is essential to the Service, the affected Service in whole) in accordance with the Terms.

(c) Flow-down. Where Algominds engages a Sub-processor, it shall do so under a written contract that imposes data-protection obligations substantially equivalent to those in this DPA, in particular the obligation to implement appropriate technical and organisational measures and, where the Sub-processor is in a third country, the onward-transfer protections set out in clause 7.4 and Annex 4.

(d) Liability. Algominds remains fully liable to the Customer for the performance of each Sub-processor's data-protection obligations under this DPA.

4.5 (e) Assistance with Data Subject rights

Taking into account the nature of the processing, Algominds shall assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer's obligation to respond to requests by Data Subjects exercising their rights under Chapter III of the UK GDPR and EU GDPR (including the rights of access, rectification, erasure, restriction, portability, and objection). Clause 6 sets out how requests are handled.

4.6 (f) Assistance with Articles 32 to 36

Taking into account the nature of the processing and the information available to Algominds, Algominds shall assist the Customer in ensuring compliance with the Customer's obligations under Articles 32 to 36, namely: security of processing (Article 32); notification of a Personal Data Breach to the Supervisory Authority (Article 33) and communication to Data Subjects (Article 34); data protection impact assessments (Article 35); and prior consultation with the Supervisory Authority (Article 36).

4.7 (g) Deletion or return

At the choice of the Customer, Algominds shall delete or return all Personal Data to the Customer after the end of the provision of the Services relating to the processing, and delete existing copies, unless UK or EU law requires storage of the Personal Data. Clause 11 sets out the detail. The retention periods that apply to Algominds in its independent-controller roles (for example, account data and payment records) do not override the Customer's right under this clause 4.7 to require deletion or return of the Personal Data that Algominds processes as Processor.

4.8 (h) Information and audits

Algominds shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 and this clause 4, and shall allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer, in accordance with clause 8.

---

5. Personal Data Breach

5.1 Algominds shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data.

5.2 The notification shall, to the extent known and as it becomes available, include: (a) a description of the nature of the breach, including, where possible, the categories and approximate number of Data Subjects and records concerned; (b) the likely consequences of the breach; (c) the measures taken or proposed to address the breach and mitigate its effects; and (d) the name and contact details of a relevant contact point.

5.3 Algominds shall provide reasonable assistance to the Customer in connection with the Customer's own breach-notification and communication obligations under Articles 33 and 34. Where Algominds acts as Processor, notification of the breach to the Supervisory Authority and to Data Subjects remains the Customer's responsibility, and Algominds will not notify on the Customer's behalf unless instructed to do so. Where Algominds acts as an independent Controller for its own infrastructure and its independent processing (clause 1.4(a)), Algominds maintains its own breach-response procedures, including notification to the ICO within 72 hours where required.

5.4 Algominds's notification of, or response to, a Personal Data Breach is not an acknowledgement of fault or liability.

---

6. Data Subject requests

6.1 If Algominds receives a request from a Data Subject (or from a Supervisory Authority or other third party acting on a Data Subject's behalf) in respect of Personal Data that Algominds processes for the Customer, Algominds shall, without undue delay, notify the Customer and shall not respond to the request itself except on the documented instructions of the Customer or as required by law to which Algominds is subject.

6.2 Algominds shall provide reasonable assistance to the Customer, by appropriate technical and organisational measures and insofar as possible, to enable the Customer to respond to such requests within the timescales required by Data Protection Law.

6.3 Where Algominds receives an opt-out, objection, or do-not-contact request relating to outreach, it shall, for Personal Data it processes as Processor, forward the request to the Customer and assist the Customer in responding. In addition, Algominds may add the relevant contact to its own suppression and do-not-contact lists, which it maintains as an independent Controller (clause 1.4(a)), in order to honour the opt-out across its systems. Algominds shall notify the Customer of any such request.

---

7. International transfers

7.1 The Customer authorises Algominds to transfer Personal Data outside the United Kingdom and the European Economic Area, including to its Sub-processors (many of which are based in the United States), where this is necessary to provide the Services, provided that an appropriate transfer mechanism is in place.

7.2 Each such transfer shall be made under one or more of the mechanisms set out in Annex 4, namely: (a) an adequacy decision under Article 45 where one applies; (b) the EU-US Data Privacy Framework (and the UK Extension) where the relevant importer is actively certified for the relevant data type; (c) the EU SCCs, Module Two (controller to processor) for transfers from the Customer (as Controller) to Algominds (as Processor), and Module Three (processor to processor) for onward transfers from Algominds to its Sub-processors, in each case together with the UK Addendum or, for UK-only transfers, the UK IDTA, as completed in Annex 4; and (d) any successor or replacement mechanism approved under Data Protection Law.

7.3 Where the EU SCCs apply, they are incorporated into this DPA by reference and completed by Annexes 1 to 4. Where there is a conflict between the SCCs (or the UK transfer mechanisms) and this DPA, the SCCs or UK transfer mechanisms prevail on international-transfer matters.

7.4 Onward transfers. Algominds shall ensure that onward transfers to Sub-processors are made on terms that provide an equivalent level of protection to that required by Data Protection Law and this DPA, including, where applicable, the SCCs (Module Three), the UK Addendum, or the UK IDTA as set out in Annex 4.

7.5 Transfer risk assessment and supplementary measures. Algominds has assessed the laws and practices of the destination countries relevant to transfers under this DPA and applies supplementary measures (including the encryption in transit and at rest and access controls described in Annex 2) where required to ensure a level of protection essentially equivalent to that guaranteed within the UK and EEA, consistent with the EDPB Recommendations 01/2020 on supplementary measures.

---

8. Audit rights

8.1 Algominds shall make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28, which may be satisfied (where available) by providing up-to-date third-party certifications, audit reports, or completed security questionnaires.

8.2 In addition to the information made available under clause 8.1, the Customer (or an independent auditor mandated by the Customer and reasonably acceptable to Algominds) may, on reasonable request, conduct an audit, including an inspection, of Algominds's processing of the Customer's Personal Data. Where the Customer reasonably considers that the appointed auditor should not be a competitor of Algominds, the Customer may instead mandate an independent third-party auditor.

8.3 Audits shall be conducted: (a) no more than once in any twelve (12) month period, except where required by a Supervisory Authority or reasonably necessary following a Personal Data Breach; (b) on at least thirty (30) days' prior written notice (or shorter where a Supervisory Authority or a breach requires); (c) during normal business hours; (d) in a manner that minimises disruption to Algominds's business; and (e) subject to appropriate confidentiality obligations.

8.4 Each Party shall bear its own costs of an audit conducted under this clause 8. Where the Customer requests assistance that goes materially beyond the standard information and reasonable cooperation contemplated by this clause, the Parties shall agree in advance any reasonable additional costs, charged at Algominds's then-current professional rates, save that no such additional costs shall be charged where the audit reveals a material breach by Algominds of this DPA. Nothing in this clause shall be applied so as to deter the Customer from exercising its audit rights under Article 28(3)(h) or Clause 8.9 of the SCCs.

---

9. United States state privacy addendum

9.1 This clause 9 applies to the extent Algominds processes "personal information" of Data Subjects protected by US state privacy laws on the Customer's behalf, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, and any other comprehensive US state privacy law in force from time to time (for example, the Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota, Tennessee, Indiana, Kentucky, and Rhode Island comprehensive privacy laws), in each case as amended (together the "US State Laws"). Terms used in this clause have the meanings given in the applicable US State Laws.

9.2 For the purposes of the US State Laws, the Customer is the "business" / "controller" and Algominds is the "service provider" / "processor". Algominds processes personal information solely on the Customer's behalf and for the limited and specified business purposes set out in this DPA and Annex 1. The purposes described in Annex 1 are the "business purposes" for which the personal information is disclosed within the meaning of section 1798.140(e) of the CCPA/CPRA, and Algominds shall not process the personal information for any "commercial purpose" outside those business purposes.

9.3 Algominds shall:

(a) not sell or share personal information, and not process it for "cross-context behavioural advertising" or "targeted advertising", as those terms are defined in the US State Laws;

(b) not retain, use, or disclose personal information for any purpose other than the specific business purposes of performing the Services set out in Annex 1, or as otherwise permitted by the US State Laws, and not outside the direct business relationship between the Parties;

(c) not combine the personal information it receives from, or on behalf of, the Customer with personal information it receives from, or on behalf of, any third party, or collects from its own interactions with the Data Subject, except as permitted under the US State Laws;

(d) comply with the applicable obligations of a service provider / processor under the US State Laws, provide the same level of privacy protection as required of the Customer, and notify the Customer if it determines it can no longer meet those obligations; and

(e) assist the Customer in responding to verifiable consumer requests, including requests to delete, correct, or access personal information and requests to opt out of sale, sharing, or targeted advertising, and assist the Customer in honouring the Global Privacy Control and other recognised opt-out preference signals that the Customer receives. Where Algominds honours the Global Privacy Control in its own right, it does so in its independent-Controller capacity (clause 1.4(a)) and not as a Processor.

9.4 Algominds hereby certifies that it understands and will comply with the restrictions set out in this clause 9.

9.5 The Customer may take reasonable and appropriate steps under the US State Laws to ensure that Algominds uses personal information in a manner consistent with the Customer's obligations, including the right, on reasonable notice, to monitor Algominds's compliance and to stop and remediate any unauthorised use of personal information. The monitoring and remediation rights in this clause 9.5 are not subject to the frequency or notice limits in clause 8.

---

10. Liability and indemnity

10.1 Subject to clauses 10.3 and 10.4, each Party's liability arising out of or related to this DPA, whether in contract, tort (including negligence), or under any other theory of liability, is subject to the limitations and exclusions of liability set out in the Terms. For business customers, the aggregate cap on liability is the greater of (a) the fees paid for the relevant Service in the twelve (12) months before the event giving rise to the liability, or (b) GBP 500, as stated in the Terms.

10.2 The cap and exclusions referred to in clause 10.1 apply to the Parties' aggregate liability across the Terms and this DPA taken together, and not separately.

10.3 Nothing in this DPA or the Terms limits or excludes either Party's liability where it cannot be limited or excluded under applicable law, including liability that the SCCs or the UK transfer mechanisms require not to be limited as between the Parties or in respect of Data Subjects. Where the Terms provide that data-protection liability is governed by this DPA, the cap in clause 10.1 applies only to the extent permitted by Data Protection Law and the transfer mechanisms; it does not limit any liability that Data Protection Law or those mechanisms require to remain unlimited.

10.4 As between the Parties, each Party is responsible for the Data Protection Law liabilities arising from its own role and instructions. The Customer shall indemnify Algominds against losses, fines, regulatory penalties, and reasonable costs arising from the Customer's breach of its warranties in clause 3.4 (including the absence of a lawful basis, missing consents, or instructing outreach into a restricted jurisdiction without the required consent). This indemnity given by the Customer is not subject to the cap in clause 10.1, and the cap in clause 10.1 applies only to Algominds's liability to the Customer.

10.5 Consumers retain their statutory rights, which are not affected by this clause.

---

11. Term, termination, return, and deletion

11.1 Term. This DPA takes effect on the date the Customer accepts the Terms or otherwise agrees to this DPA, and continues for as long as Algominds processes Personal Data on the Customer's behalf.

11.2 Return and deletion. On termination or expiry of the relevant Service, or on the Customer's earlier written request, Algominds shall, at the Customer's choice, return or delete the Personal Data it processes on the Customer's behalf, and delete existing copies, save where retention is required by law.

11.3 Retention. The following retention periods apply. The first row concerns Personal Data that Algominds processes as Processor on the Customer's behalf; the remaining rows concern data that Algominds retains in its independent-Controller roles (clause 1.4(a)) and do not override the Customer's deletion or return right in clauses 4.7 and 11.2 over processor-role Personal Data.

11.4 Algominds may retain Personal Data to the extent required by law, and may retain suppression and do-not-contact data as an independent Controller in order to continue honouring opt-outs. The independent-Controller retentions in clause 11.3 are governed by the Algominds Privacy Policy and are reproduced here for transparency and consistency only.

11.5 Survival. Clauses 2, 5 (in respect of breaches occurring during the term), 7, 9, 10, 11, and 12, and any provision that by its nature should survive, continue after termination.

---

12. General

12.1 Governing law and jurisdiction. This DPA is governed by the laws of England and Wales. Disputes between the Parties are subject to the dispute-resolution provisions of the Terms, namely arbitration under the rules of the London Court of International Arbitration (LCIA), seated in London, for business customers; consumers may bring proceedings in the courts. Such arbitration applies only as between the Parties. It does not bind, and never restricts, a Data Subject exercising third-party-beneficiary rights under the SCCs, including the Data Subject's choice of forum under Clause 18 of the SCCs. The choice of governing law and forum does not deprive a Data Subject of any protection to which they are entitled under mandatory provisions of the law applicable to them, and does not override the governing-law and jurisdiction terms of the SCCs where those apply.

12.2 Notices. Notices under this DPA shall be sent to Algominds at [email protected] (privacy contact: Edward Albazii) or [email protected], and to the Customer at the contact details associated with its account. Operational notices (such as Sub-processor change notices and breach notifications) may be given by email or in-product notice.

12.3 Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions continue in full force, and the invalid provision shall be replaced by a valid provision that most closely reflects the Parties' intention.

12.4 Precedence. Clause 1.5 governs precedence between this DPA, the Terms, and the transfer mechanisms.

12.5 Variation. Algominds may update this DPA to reflect changes in Data Protection Law, regulatory guidance, or its processing operations, provided that any such update does not materially reduce the protection afforded to the Customer or to Data Subjects.

12.6 Signature. Where this DPA is accepted electronically through acceptance of the Terms, no separate signature is required and the DPA binds the Parties on that acceptance. Where a signed copy is required, the Parties may execute it below.

---

Annex 1: Details of Processing

Subject matter of the processing. The provision of the Services described in clause 1.2, namely AI signal intelligence, prospect sourcing, data enrichment, AI outreach copy generation, and the sending and management of outbound email and LinkedIn outreach, on the Customer's behalf.

Duration of the processing. For the duration of the relevant Service, plus any period required to return or delete the Personal Data in accordance with clause 11.

Nature and purpose of the processing. Collection, organisation, structuring, storage, enrichment, analysis, retrieval, use (including generation of outreach copy), transmission (sending of email and LinkedIn messages), suppression, and deletion of Personal Data, for the purpose of enabling the Customer to identify, research, and contact business prospects and to manage the resulting conversations. For some discovery and enrichment steps, the Parties may act as joint Controllers in accordance with clause 3.6.

Categories of Data Subjects. The Customer's business prospects and contacts, including: individuals at target companies (decision-makers, employees, and other professional contacts); the Customer's own personnel and authorised users of the Services; and individuals who reply to or interact with the Customer's outreach.

Categories of Personal Data.

Special Category Data. The Services are not intended to process Special Category Data, and the Customer must not instruct Algominds to process Special Category Data through the Services. To the extent any Special Category Data is incidentally present in prospect data supplied or generated, the Customer remains the Controller of it and warrants that it has an Article 9 condition for its processing.

Frequency of the processing. Continuous and on an ongoing basis for the duration of the relevant Service.

Retention. As set out in clause 11.3. Prospect data processed as Processor is retained per the Customer's instructions and is typically deleted within 30 days of campaign completion.

---

Annex 2: Technical and Organisational Measures

Algominds maintains the following technical and organisational measures, which it reviews and updates from time to time in line with clause 4.3.

1. Encryption. Personal Data is encrypted in transit (TLS) and at rest. OAuth tokens for connected mailboxes and LinkedIn accounts are encrypted at rest.

2. Access control and least privilege. Role-based access controls are applied so that personnel and systems can access only the Personal Data they need. Access follows the principle of least privilege and is reviewed periodically. Administrative access is restricted and protected.

3. Authentication. Access to systems requires individual authentication. Sign-in to connected services uses scoped OAuth tokens only; Algominds never collects or stores end-user passwords for connected mailboxes or LinkedIn accounts.

4. Logging, monitoring, and intrusion detection. Systems maintain logs of relevant activity, with logging and intrusion-detection measures to identify and respond to anomalous or unauthorised activity.

5. Network and infrastructure security. Hosting is provided by reputable cloud and infrastructure providers (see Annex 3) with their own certified security controls. Algominds applies network controls, security patching, and segregation appropriate to the risk.

6. Resilience, backup, and recovery. Measures are in place to support the availability and recoverability of Personal Data, including backups and the ability to restore access in a timely manner following an incident.

7. Pseudonymisation and minimisation. Algominds minimises the Personal Data it processes to what is necessary for the Services and applies pseudonymisation or aggregation where appropriate, including for privacy-protective product improvement.

8. Vendor due diligence. Algominds carries out due diligence on Sub-processors and binds them to data-protection obligations substantially equivalent to those in this DPA.

9. Personnel. Personnel with access to Personal Data are bound by confidentiality obligations and receive guidance on their data-protection responsibilities.

10. Breach management. Algominds maintains breach-detection and response procedures, including notification to the Customer without undue delay (clause 5) and notification to the ICO within 72 hours where Algominds is the responsible Controller and notification is required.

11. AI model providers. Where AI model providers are used (see Annex 3), Personal Data sent for processing is not used to train those providers' public or foundation models. Providers may retain inputs for a limited period (typically around 30 days) for abuse monitoring before deletion.

---

Annex 3: Approved Sub-processors

The Customer gives a general written authorisation to the Sub-processors below. They are grouped by function. Many are based in the United States; transfers are made under the mechanisms in Annex 4. The "Transfer mechanism" column indicates the primary basis relied on for transfers outside the UK and EEA: "Adequacy" (an Article 45 decision applies), "DPF" (the importer is actively certified under the EU-US Data Privacy Framework and, for UK data, the UK Extension), or "SCCs + UK Addendum / IDTA" (the SCCs supplemented by the UK Addendum, or the UK IDTA for UK-only transfers). Where an importer is not actively DPF-certified for the relevant data type, transfers fall to the SCCs + UK Addendum / IDTA. The position is reviewed from time to time as vendors' certifications change.

Algominds will give prior notice of any change to this list in accordance with clause 4.4(b).

---

Annex 4: Transfer Mechanisms

This Annex sets out the mechanisms relied on for transfers of Personal Data outside the United Kingdom and the European Economic Area in connection with the Services. Two distinct transfer flows are addressed: (i) the Customer (as Controller) to Algominds (as Processor); and (ii) Algominds to its onward Sub-processors (processor to processor).

1. Order of mechanisms. For each transfer, the Parties rely on the first applicable mechanism below:

(a) Adequacy. Where the importer's country (or a sector or framework within it) benefits from an adequacy decision under Article 45 of the UK GDPR or EU GDPR, the transfer is made in reliance on that decision. For transfers from the EEA to the United Kingdom, the Parties rely on the European Commission's UK adequacy decision; for transfers from the United Kingdom to the EEA, the Parties rely on the relevant UK adequacy regulations.

(b) EU-US Data Privacy Framework. Where the importer is actively certified under the EU-US Data Privacy Framework for the relevant data type, the transfer is made in reliance on that certification. For UK-origin data, reliance on the UK Extension to the EU-US DPF applies only to importers certified for it and only while the UK-US data bridge (the Data Protection (Adequacy) (United States of America) Regulations 2023) remains in force.

(c) Standard Contractual Clauses and UK transfer tools. Where neither (a) nor (b) applies, the transfer is made under the EU SCCs, using Module Two (controller to processor) for Customer-to-Algominds transfers and Module Three (processor to processor) for onward Algominds-to-Sub-processor transfers. For combined EU and UK transfers, the EU SCCs are supplemented by the UK Addendum. For UK-only transfers where the EU SCCs are not otherwise in use, the UK IDTA applies instead. The SCCs and the UK transfer tools are incorporated into this DPA by reference.

2. Completion of the SCCs (where they apply).

Module Two (Customer to Algominds).

Module Three (Algominds to onward Sub-processors). The same completions above apply, save that: the data exporter is Algominds (Processor, acting on the Customer's behalf); the data importer is the relevant Sub-processor listed in Annex 3 (processor); and the description of processing, TOMs, and any further sub-processors are as agreed in Algominds's contract with that Sub-processor, consistent with Annexes 1 to 3 of this DPA.

3. UK Addendum. Where the UK Addendum is used with the EU SCCs: Table 1 (parties) is completed by Annex 1 and clause 1 of this DPA; Table 2 selects the EU SCCs as completed above (Module Two for Customer-to-Algominds transfers and Module Three for onward transfers); Table 3 is completed by Annexes 1 to 3 of this DPA; and in Table 4, neither Party may end the Addendum as set out in section 19 of the Addendum, except as permitted by it.

4. UK IDTA. Where the UK IDTA is used for UK-only transfers, it is completed by reference to the Parties and the processing described in clause 1 and Annexes 1 to 3 of this DPA, with the ICO as the competent Supervisory Authority and the law and courts of England and Wales applying. The IDTA applies only where the EU SCCs and UK Addendum are not otherwise in use for the same transfer.

5. Onward transfers. Onward transfers to Sub-processors are made on terms providing an equivalent level of protection, consistent with clauses 4.4(c) and 7.4 and using Module Three of the SCCs (with the UK Addendum or the UK IDTA) where required.

6. Successor mechanisms. If any transfer mechanism in this Annex is invalidated, replaced, or superseded, the Parties shall, without undue delay, put in place an alternative lawful mechanism so that transfers may continue.