18 OCTOBER 2026 · REVISION 1.5

Customer Data Processing Addendum

This addendum forms part of the Terms and Conditions. Operational verification actions are identified in the schedules. The initial subprocessor list includes attachmentAV for new file uploads; see the file-scanning information. Advance-notice rights for later provider changes remain unchanged.

Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement governing the customer’s use of The SOP Hub (“Agreement”) between:

1. Definitions and interpretation

“Data Protection Laws” means the UK GDPR, the Data Protection Act 2018, PECR where applicable, and any replacement or amending UK legislation. “Customer Personal Data” means personal data processed by Supplier on behalf of Customer through the Services. “Controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing” and “supervisory authority” have the meanings in Data Protection Laws. “Sub-processor” means another processor engaged by Supplier to process Customer Personal Data.

If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA prevails. The schedules form part of this DPA.

2. Roles and scope

Customer is the controller and Supplier is the processor for Customer Personal Data described in Schedule 1, except where Data Protection Laws require a different role.

Customer determines the purposes and essential means of processing and is responsible for lawful instructions, transparency, lawful basis, data minimisation and responding to individuals.

Supplier may process account administration, billing, fraud prevention, security and direct support data as an independent controller where described in its Privacy Notice.

3. Documented instructions

Supplier will process Customer Personal Data only on Customer’s documented instructions, including the Agreement, configured use of the Services and written support instructions, unless required by law.

If law requires processing outside Customer’s instructions, Supplier will inform Customer before processing unless law prohibits notice.

Supplier will promptly tell Customer if, in its reasonable opinion, an instruction infringes Data Protection Laws and may pause the affected processing while the parties resolve it.

4. Confidentiality and personnel

Supplier will ensure that people authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality, receive proportionate data-protection and security instruction, and access data only where needed for their role.

5. Security

Supplier will implement and maintain appropriate technical and organisational measures having regard to the state of the art, implementation cost, nature, scope, context and purposes of processing, and risk to individuals. Current measures are described in Schedule 2. Supplier may update them provided the overall level of protection is not materially reduced.

6. Sub-processors

Customer gives general written authorisation for the Sub-processors in Schedule 3. The providers disclosed in Schedule 3 when Customer first enters the Agreement form the initial authorised list. The advance-notice obligation below applies to later additions or replacements, not to that initial list.

Supplier will maintain an up-to-date Sub-processor list and give at least 30 days’ notice of a new or replacement Sub-processor that will process Customer Personal Data.

Customer may object on reasonable data-protection grounds within 14 days. The parties will work in good faith on a commercially reasonable solution; if none is available, either party may terminate the affected Service without penalty for the unused prepaid period.

Supplier will impose written data-protection obligations providing materially equivalent protection and remains responsible for each Sub-processor’s performance to the extent required by law.

7. International transfers

Supplier will not make a restricted transfer of Customer Personal Data unless a lawful transfer mechanism and required supplementary measures are in place. Depending on destination and supplier, this may include UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to EU Standard Contractual Clauses. Customer authorises transfers described in Schedule 3 subject to those safeguards. Transfer mechanisms and data locations require operational verification.

8. Assistance with individual rights

Taking account of the nature of processing, Supplier will provide appropriate technical and organisational assistance for requests concerning access, rectification, erasure, restriction, portability, objection and automated decision-making. If Supplier receives a request relating to Customer Personal Data, it will notify Customer without undue delay and will not respond except on Customer’s instructions or where legally required.

9. Breaches

Supplier will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and, where reasonably practicable, within 48 hours.

Notice will contain available information about nature, likely consequences, affected data and people, containment, remediation and a contact. Information may be provided in phases.

Supplier’s notice is not an admission of fault. Customer is responsible for deciding whether to notify the ICO or individuals; Supplier will provide reasonable assistance.

10. DPIAs and regulatory consultation

Supplier will provide reasonably available information and assistance needed for Customer’s DPIA and any required prior consultation, taking account of the processing and information available to Supplier. Additional bespoke work may be chargeable if agreed in advance.

11. Deletion and return

At Customer’s written choice and subject to legal retention duties, Supplier will delete or return Customer Personal Data at the end of the Services. Active-system deletion will be completed within 30 days and residual encrypted backups within 90 days. The technical deletion and backup process for these periods remains subject to implementation and testing; this revision does not confirm that it is operational. Supplier may retain a minimal record where required to establish, exercise or defend legal claims or comply with law.

12. Information and audit

Supplier will make available information reasonably necessary to demonstrate compliance, including this DPA, security summaries, relevant certifications and responses to proportionate questionnaires.

No more than once annually, unless following a breach or regulator request, Customer may request a remote audit on reasonable notice. On-site access is a last resort, during business hours, subject to confidentiality, safety, other customers’ security and reimbursement of reasonable costs.

Audit rights do not require disclosure of another customer’s information, penetration-test details that would create a security risk, privileged material or trade secrets beyond what is necessary.

13. Liability, term and changes

This DPA begins on the Effective Date and continues while Supplier processes Customer Personal Data. Liability is governed by the Agreement unless prohibited by Data Protection Laws. Changes required by law may be made on reasonable notice. Governing law and courts follow the Agreement.

Schedule 1 — Details of processing

Schedule 2 — Technical and organisational measures

Schedule 3 — Sub-processors and verification actions

Schedule 4 — Contacts