Data Processing Agreement

Version 1.1 — effective 29 September 2026.

This Data Processing Agreement ("DPA") is between {{COMPANY_LEGAL_NAME}} (company number {{COMPANY_NUMBER}}), registered office {{REGISTERED_ADDRESS}}, trading as Commercial Intelligence Partners ("CIP", "we", "us"), and the business that accepts it (the "Client", "you").

How this agreement is accepted

You accept this DPA electronically, when an owner of your account ticks the box labelled with the DPA acceptance text during onboarding (or when prompted to accept an updated version) and continues. The person ticking the box confirms they are authorised to bind your business. Acceptance forms a binding contract in writing in electronic form, as Article 28(9) UK GDPR permits. We record who accepted, when, and which version. This DPA forms part of, and is incorporated into, our Terms of Service (the "Terms"). You can read and print the current version at any time at commercialintelligencepartners.co.uk/legal/dpa or by asking us at info@commercialintelligencepartners.co.uk. If you need a countersigned copy for your records, ask us and we will provide one on the same terms.

1. Definitions

1.1 Data Protection Law means the UK GDPR, the Data Protection Act 2018 ("DPA 2018"), the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), each as amended (including by the Data (Use and Access) Act 2025), and any other law about personal data that applies to the processing under this DPA.

1.2 Client Personal Data means personal data that CIP processes on your behalf when providing the Services, as described in Annex 1.

1.3 Services means the CIP web application, APIs, connectors and related support described in the Terms.

1.4 Sub-processor means a third party CIP engages to process Client Personal Data.

1.5 Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Personal Data.

1.6 Regulator means the Information Commission (which replaced the Information Commissioner on 30 September 2026) or any successor UK supervisory authority.

1.7 Restricted Transfer means a transfer of Client Personal Data to a country outside the UK that UK GDPR Chapter V restricts.

1.8 Other terms (such as controller, processor, data subject, personal data and processing) have the meanings given in the UK GDPR.

2. Roles and scope

2.1 For Client Personal Data, you are the controller and CIP is your processor.

2.2 CIP is a controller (not your processor) for: your account and billing relationship with us; login and authentication records of the people you invite; security and audit logs we keep to protect the Services; and records we must keep for our own legal and tax obligations. Our Privacy Notice covers that processing.

2.3 Annex 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

2.4 If this DPA conflicts with the Terms, this DPA wins on data protection matters.

3. Your responsibilities

3.1 You are responsible for having a lawful basis for the processing you instruct, and for giving the privacy information data subjects are entitled to (for example to your staff and your customers).

3.2 You are responsible for the lawfulness of the data you upload or connect, and of emails you ask us to send on your behalf (see clause 5).

3.3 You will not upload special category data or criminal offence data unless you have a lawful condition for it and the Services are suitable for it. The Services are not designed to hold health or other special category data. Ask your staff not to include such details in free-text fields such as holiday request notes.

4. CIP's obligations (UK GDPR Article 28(3))

4.1 Documented instructions — Article 28(3)(a).

(a) We process Client Personal Data only on your documented instructions, including about transfers to a third country, unless UK law requires us to do otherwise. If so, we will tell you before processing unless that law forbids it on important grounds of public interest.

(b) Your instructions are: this DPA; the Terms; your configuration and use of the Services (for example importing data, turning on AI features, sending an invoice or a reminder, inviting a user); and any further written instructions we agree.

(c) We will tell you immediately if, in our opinion, an instruction infringes Data Protection Law (Article 28(3), final paragraph). We may suspend the relevant processing until you confirm or change the instruction.

4.2 Confidentiality — Article 28(3)(b). Everyone we authorise to process Client Personal Data (employees, contractors and Sub-processors) is bound by a contractual or statutory duty of confidentiality, and only accesses it as far as needed to provide, support or secure the Services.

4.3 Security — Article 28(3)(c) and Article 32. We implement and maintain the technical and organisational measures in Annex 2. We may improve them over time but will not materially reduce the overall level of protection.

4.4 Sub-processors — Article 28(3)(d), 28(2) and 28(4).

(a) You give us general written authorisation to engage the Sub-processors listed on our sub-processors page (Annex 3).

(b) We will give at least 30 days' notice of any intended addition or replacement of a Sub-processor, as Annex 3 describes, and you may object during that period.

(c) Each Sub-processor is bound by a written contract imposing data protection obligations that give at least the same level of protection as this DPA, in particular sufficient guarantees of appropriate technical and organisational measures.

(d) We remain fully liable to you for the performance of each Sub-processor's data protection obligations.

4.5 Helping you with data subject rights — Article 28(3)(e).

(a) Taking into account the nature of the processing, we will help you, by appropriate technical and organisational measures so far as possible, to meet your obligation to respond to requests from individuals exercising their rights under Chapter III UK GDPR (access, rectification, erasure, restriction, portability and objection, and rights relating to automated decisions).

(b) Most requests can be handled by you directly in the Services (search, edit, export, delete). Where you cannot, we will help within a reasonable time, taking account of the timescales in Article 12 and Article 12A UK GDPR (including the "reasonable and proportionate search" standard).

(c) If we receive a request or a data protection complaint directly from one of your data subjects, we will pass it to you without undue delay and will not respond ourselves except to acknowledge it and redirect the person to you, unless you ask us to. We will help you meet your duty to handle complaints under section 164A DPA 2018.

4.6 Helping you with security, breaches, DPIAs and consultation — Article 28(3)(f).

(a) Taking into account the nature of the processing and the information available to us, we will help you meet your obligations under Articles 32 to 36 UK GDPR (security, breach notification, communication to data subjects, data protection impact assessments and prior consultation with the Regulator).

(b) Breach notification (Article 33(2)). We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach. We will send the notice to the account owner's email address. It will describe, as far as then known: the nature of the breach; the categories and approximate number of data subjects and records; the likely consequences; and the measures taken or proposed. We will provide further information in phases as it becomes available.

(c) Notifying a breach is not an admission of fault or liability.

(d) Unless the law requires otherwise, you decide whether to notify the Regulator or data subjects. We will not name you to a regulator or the public without your agreement, except where the law requires.

4.7 Deletion or return at the end — Article 28(3)(g).

(a) While your subscription is active, and for 12 months after it ends, you can export your data from the Services in a standard format.

(b) At the end of that 12-month period (or earlier if you ask us in writing to delete it), we will delete Client Personal Data, unless UK law requires us to keep it. Where you ask us to delete it, we will permanently delete your organisation's data within 30 days of your request. Backups roll off automatically when the database provider's point-in-time-restore window ends.

(c) Our Data Retention and Deletion Policy gives the full detail and forms part of your instructions.

4.8 Information and audits — Article 28(3)(h).

(a) We will make available to you all information necessary to demonstrate compliance with Article 28 UK GDPR, and allow for and contribute to audits, including inspections, by you or an independent auditor you appoint (bound by confidentiality).

(b) To keep this proportionate, we will first answer your written questions and provide our security documentation and relevant Sub-processor reports. If that does not reasonably satisfy you, or the Regulator requires it, you may carry out an audit on at least 30 days' written notice, no more than once in any 12-month period (except after a Personal Data Breach or where the Regulator requires), during business hours, without access to other clients' data, and at your cost.

4.9 Records and cooperation. We keep a record of processing activities carried out on your behalf (Article 30(2)) and will cooperate with the Regulator on request (Article 31).

4.10 Processing outside instructions. We will not sell Client Personal Data, use it for our own purposes, or combine it with other clients' data, except (a) as needed to provide, secure and support the Services, and (b) to create aggregated statistics that do not identify any individual or client. If we ever decided the purposes and means of processing in breach of this DPA, we would be treated as a controller for that processing (Article 28(10)).

5. Emails sent on your behalf

5.1 When you send invoices, payment reminders or similar messages to your own customers from the Services, we send them through our email Sub-processor as your processor. Replies go to you.

5.2 You are the controller for those messages. You are responsible for their content and for having a lawful basis to send them. Invoices and payment reminders about an existing transaction are service messages, not direct marketing. You must not add marketing content to them unless PECR and UK GDPR allow it (see our Acceptable Use Policy).

6. AI features

6.1 If you (or your plan) turn on AI features, we send the figures and context needed to write narrative commentary to our AI Sub-processor (Anthropic PBC). The figures are calculated by our own software. The AI model writes the words but does not calculate the numbers.

6.2 Our contract with Anthropic does not allow it to use your data to train its models. AI features are off unless you or your plan turn them on, and you can turn them off at any time.

6.3 AI commentary is information only. It is not a decision that produces legal or similarly significant effects on any individual (Articles 22A–22D UK GDPR).

7. International transfers

7.1 We host the Services' application compute in the UK (London) and the database in London, United Kingdom (AWS eu-west-2). Some Sub-processors are based in, or may access data from, the United States or other countries.

7.2 We will only make a Restricted Transfer (or allow a Sub-processor to make one) if it is covered by one of the following, applied in this order: (a) UK adequacy regulations, including those for the EEA and for the United States under the Data Protection (Adequacy) (United States of America) Regulations 2023 (the "UK Extension to the EU-US Data Privacy Framework"), where the recipient is actively self-certified for the UK Extension for the relevant type of data; (b) appropriate safeguards under Article 46 UK GDPR, namely the International Data Transfer Agreement ("IDTA") or the International Data Transfer Addendum to the EU Standard Contractual Clauses ("UK Addendum") issued under section 119A DPA 2018, in each case as updated by the Regulator from time to time; or (c) another mechanism permitted by Chapter V UK GDPR.

7.3 Where we rely on paragraph 7.2(b), we complete and keep up to date a transfer risk assessment (the "data protection test" in Chapter V UK GDPR as amended by the Data (Use and Access) Act 2025), to confirm the standard of protection in the destination is not materially lower than in the UK.

7.4 If a mechanism we rely on is withdrawn or invalidated (for example if the UK Extension ended), we will move to another valid mechanism without undue delay. Each Sub-processor's own DPA already includes the UK Addendum or IDTA as a fallback, as our sub-processors page shows.

7.5 You authorise the transfers described on our sub-processors page.

8. Liability

8.1 Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms, as if this DPA were part of the Terms.

8.2 Nothing in this DPA limits either party's liability where the law does not allow it to be limited, or affects any data subject's rights under Article 82 UK GDPR.

9. Term, changes and law

9.1 This DPA lasts for as long as we process Client Personal Data for you, including during the 12-month post-cancellation period.

9.2 We may update this DPA to reflect changes in law, Regulator guidance or updated transfer templates, or changes to the Services. We will give at least 30 days' notice of material changes by email to the account owner. A change required by law may take effect sooner. If a change materially reduces your protection, you may end your subscription before it takes effect and receive a pro-rata refund of any prepaid fees for the unused period.

9.3 This DPA is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction, but this does not stop either party seeking urgent relief elsewhere.

Annex 1 — Details of processing

• Subject matter: providing the CIP hospitality business-intelligence Services to the Client.

• Duration: for the term of the Client's subscription, then 12 months after it ends (for export), then until deletion is complete and backups have rolled off. Earlier deletion on written request, within 30 days of the request.

• Nature of processing: collection (by upload, CSV import, API and connectors), storage, organisation, retrieval, calculation, analysis, display, generation of reports and AI commentary (when enabled), transmission of emails on the Client's instruction, export, and deletion.

• Purpose: to provide the Services — financial and operational reporting across one or more venues; invoicing and payment reminders to the Client's customers; recording expenses and supplier bills; budgeting; managing the Client's users and staff records (including roles, reporting lines and holiday requests); storing uploaded files; producing AI narrative insights when enabled; support and security.

• Categories of data subjects: (a) the Client's owners, managers and other users of the Services; (b) the Client's staff (employees and workers), whether or not they are users; (c) the Client's customers (individuals, sole traders and contacts at business customers); (d) the Client's suppliers and their contacts; (e) any other individual named in data or files the Client uploads (for example on a receipt).

• Types of personal data: names, email addresses, postal addresses, phone numbers where provided; job title, role, venue, reporting line; holiday requests (dates, status, any notes entered); sales, cost, ledger, expense, supplier bill and budget data that may relate to identifiable individuals; invoice details (customer name, email, address, amounts, due dates, payment status); email delivery records for invoices and reminders (for example sent, delivered, bounced); uploaded files (logos, receipts) and anything they contain; AI-generated commentary; user activity records within the Client's account.

• Special category / criminal offence data: none intended. The Client must not upload it unless clause 3.3 is met.

• Frequency: continuous, for the term of the subscription.

• Sub-processors: see Annex 3.

Annex 2 — Technical and organisational measures

CIP maintains the following measures (Article 32 UK GDPR):

• Encryption in transit. TLS is used for all connections to the Services and between the Services and our providers.

• Encryption at rest. The database provider encrypts stored data at rest.

• Tenant isolation, enforced twice. Every client's data is separated (a) in our application code, which only accesses data through a tenant-scoped data layer, and (b) in the database itself, through Postgres row-level security applied under a non-privileged database role.

• Authentication. Sign-in is run by CIP on its own database, using one-time email codes, passkeys or (optionally) Google sign-in, or Microsoft where offered. Two-factor authentication (authenticator app) and passkeys are available to every user, and are required for CIP's own team (our platform administrators).

• Connector credentials. Credentials for third-party systems you connect are encrypted with AES-256-GCM.

• API keys. API keys are stored only in hashed form.

• Rate limiting. Requests are rate-limited to reduce abuse and brute-force attempts.

• Admin audit log. Actions by CIP administrators are recorded in an append-only audit log.

• Controlled support access. CIP support's "view as customer" access is time-limited (30 minutes) and audited, and each access is visible to the customer in their security activity. It is read-only unless it is used by designated senior staff, who can make changes.

• Signed webhooks. Payment webhooks from Stripe are verified by signature before they are acted on.

• Backups and recovery. The database provider provides daily point-in-time recovery.

• Separate environments. Testing and user-acceptance environments are kept separate from production and use scrubbed data.

• Secrets management. Secrets are held only in the hosting provider's encrypted environment settings and are never committed to source code.

• People. Access to production is limited to those who need it, under confidentiality obligations (clause 4.2).

• Supplier assurance. Sub-processors are bound by written data protection terms (clause 4.4).

Annex 3 — Sub-processors

3.1 Current list. The authorised Sub-processors are those listed on our sub-processors page at /legal/subprocessors (the "Sub-processors Page"), which forms part of this Annex. It sets out each Sub-processor's name, purpose, the data involved, location and transfer mechanism.

3.2 Notice of changes. Before adding or replacing a Sub-processor that will process Client Personal Data, we will (a) update the Sub-processors Page, and (b) email the account owner and anyone who has subscribed to change notices, at least 30 days before the new Sub-processor starts processing Client Personal Data.

3.3 Right to object. You may object on reasonable data protection grounds by emailing info@commercialintelligencepartners.co.uk within those 30 days. We will discuss your concerns in good faith and try to offer a reasonable alternative (for example, not using the new Sub-processor for your data, or letting you switch off the feature that uses it).

3.4 If we cannot resolve it. If we cannot reasonably accommodate your objection, you may end the affected Services (or your subscription) by written notice before the change takes effect. We will refund any prepaid fees for the unused period after termination.

3.5 Urgent replacement. If we must replace a Sub-processor urgently to protect the security or continuity of the Services (for example, because a provider fails or suffers a security incident), we may do so on shorter notice. We will notify you as soon as reasonably possible, and clauses 3.3 and 3.4 still apply.

3.6 Optional features. A Sub-processor used only for an optional feature (such as Anthropic for AI features) only processes your data if that feature is enabled for your account.

Legal basis

UK GDPR Art. 28 (processor contract terms, 28(3)(a)–(h), 28(2) and 28(4) sub-processing, 28(9) electronic form, 28(10)); Arts. 29, 30(2), 31, 32, 33(2), 34–36; Chapter III rights and Art. 12A (as inserted by the Data (Use and Access) Act 2025); Arts. 22A–22D (automated decision-making, as substituted by DUAA 2025); Art. 82. Chapter V UK GDPR (transfers) as amended by DUAA 2025 Sch. 7 ("data protection test", in force 5 February 2026 under SI 2026/82); Data Protection (Adequacy) (United States of America) Regulations 2023 (SI 2023/1028); IDTA and UK Addendum issued under s.119A DPA 2018 (in force 21 March 2022). DPA 2018 s.164A (complaints to controllers, inserted by DUAA 2025 s.103, in force 19 June 2026). DUAA 2025 ss.118–119 (Information Commission replaces the Information Commissioner from 30 September 2026, SI 2026/1015). ICO guidance: Contracts and liabilities between controllers and processors; International transfers guidance (including transfer risk assessments). Electronic contracting: Electronic Communications Act 2000 s.7; Law Commission, Electronic execution of documents (Law Com No 386, 2019).