Data processing addendum.

1. Application

1.1 This data processing addendum (the “DPA”) forms part of whichever of the following applies (the “Main Terms”): the Jesmond Enterprise Agreement, the Jesmond Essentials Terms, the Jesmond Partner Agreement or the Jesmond Evaluation Terms of Service, between Jesmond AI (Defend This) Ltd, a company incorporated in England and Wales with company number 17367476 whose registered office is at Chequers House, Chequers Lane, Watford, England, WD25 0LG (“Jesmond”), and the customer or partner that has accepted the Main Terms (the “Customer”, referred to in the Main Terms as the “Customer”, “You” or the “Partner”). References in this DPA to Customer Data include Partner Data.

1.2 Capitalised terms not defined in this DPA have the meanings given in the Main Terms. The terms “controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing” and “special categories of personal data” have the meanings given in the Data Protection Legislation.

1.3 In the event of any conflict between this DPA and the Main Terms, this DPA governs with respect to its subject matter.

1.4 Jesmond may update this DPA only in the manner, and subject to the limits, that apply to updates of the Main Terms (clause 2.3 of the Enterprise Agreement, the Essentials Terms and the Partner Agreement; clause 1.3 of the Evaluation Terms of Service). No update may reduce the protection given to Customer Personal Data without the Customer’s written agreement.

2. Definitions

Customer Personal Data: personal data comprised in Customer Data and Content which Jesmond processes on behalf of the Customer under the Main Terms.

Restricted Transfer: a transfer of Customer Personal Data to a country or international organisation outside the United Kingdom which is not permitted under the Data Protection Legislation without appropriate safeguards (for example, because it is not covered by UK adequacy regulations).

Security Measures: the technical and organisational measures described in Annex 2, as updated in accordance with clause 5.2.

Subprocessor: any third party engaged by Jesmond to process Customer Personal Data.

UK Transfer Mechanism: the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission’s standard contractual clauses, each as issued under section 119A of the Data Protection Act 2018, or any other appropriate safeguard permitted for transfers under Chapter V of the UK GDPR.

3. Roles and instructions

3.1 The Customer is the controller and Jesmond is a processor of Customer Personal Data. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

3.1A Where a Partner uses the Service for a Partner Client and acts as that Partner Client’s processor, Jesmond acts as the Partner’s subprocessor. In that case: the Partner’s instructions under clause 3.2 are given on behalf of the Partner Client; the Partner warrants that it holds the Partner Client’s authorisation for the engagement of Jesmond and of the Subprocessors in Annex 3; notices that Jesmond must give under this DPA are given to the Partner, which is responsible for passing them to the Partner Client; and Jesmond has no direct obligation to any Partner Client.

3.2 Jesmond shall process Customer Personal Data only on the Customer’s documented instructions, including with regard to Restricted Transfers, unless required to do so by domestic law to which Jesmond is subject. In that case Jesmond shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.3 The Customer’s documented instructions are: (a) the Main Terms and this DPA; (b) the processing initiated by Authorised Users through their use of the Service; and (c) any other reasonable written instruction from the Customer that Jesmond agrees is consistent with the Main Terms and the functionality of the Service.

3.4 Jesmond shall immediately inform the Customer if, in its opinion, an instruction infringes the Data Protection Legislation. Jesmond is not obliged to undertake a legal review of the Customer’s instructions.

3.5 The Customer is solely responsible for: (a) establishing a lawful basis for the processing it instructs; (b) where special category personal data is processed, an Article 9 UK GDPR condition and, where required, an appropriate policy document under Schedule 1 to the Data Protection Act 2018; (c) where personal data relating to criminal convictions and offences is processed, a condition under Article 10 UK GDPR and Schedule 1 to the Data Protection Act 2018; (d) giving privacy information to its data subjects; and (e) carrying out any data protection impact assessment required by Article 35 UK GDPR, with Jesmond’s assistance under clause 8.2.

3.6 Jesmond shall not: (a) train any artificial intelligence model using Customer Personal Data, save that where a Jesmond Enterprise Order Form or statement of work so provides, Jesmond may configure the Service for the Customer using anonymised material the Customer supplies for that purpose, solely for the Customer’s own use; (b) sell Customer Personal Data or make it available to any third party except a Subprocessor in accordance with clause 6; or (c) process Customer Personal Data for its own purposes. Usage Data, which does not include Content or Customer Data, is governed by the Main Terms.

4. Personnel and access

4.1 Jesmond shall ensure that every person it authorises to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

4.2 Stored case content is encrypted on the Authorised User’s own device, and the keys are held by the Customer’s Authorised Users and by recovery key holders appointed by the Customer. Jesmond and its Affiliates do not hold, and have no means to enrol themselves for or recover, any key that would decrypt stored Content. Content sent to the artificial intelligence model to generate Output is not stored or logged by Jesmond. Jesmond personnel therefore cannot read stored Content, and Jesmond’s development and testing use synthetic or anonymised data only.

4.3 The Customer is responsible for appointing and keeping at least two recovery key holders. If all keys for an item of Content are lost, Jesmond cannot recover that Content.

5. Security

5.1 Jesmond shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 UK GDPR. At a minimum, Jesmond shall maintain the Security Measures.

5.2 Jesmond may update the Security Measures from time to time, provided that no update materially reduces the overall level of security of the Service.

6. Subprocessors

6.1 The Customer gives Jesmond general written authorisation to engage Subprocessors. The Subprocessors engaged at the date of this DPA are listed in Annex 3, which Jesmond will keep current on its website.

6.2 Jesmond shall give the Customer at least 30 days’ notice of any intended addition or replacement of a Subprocessor, by email to the Customer’s notice email address and by updating the list on its website.

6.3 The Customer may object to an intended change on reasonable data protection grounds by written notice within 14 days of Jesmond’s notice. The parties shall discuss the objection in good faith. If it is not resolved, the Customer may, before the change takes effect, terminate the Main Terms (or, under the Enterprise Agreement, the affected Order Form) on written notice and Jesmond shall refund any prepaid subscription fees for the period after termination. An evaluation customer’s remedy is to stop using the Service and terminate the Evaluation Terms of Service.

6.4 Jesmond shall engage each Subprocessor under a written contract imposing data protection obligations no less protective than those in this DPA, including obligations not to train any artificial intelligence model on Customer Personal Data and not to retain or log Customer Personal Data for human review. Jesmond remains fully liable to the Customer for the performance of each Subprocessor’s obligations.

6.5 Where a Subprocessor must be replaced urgently for reasons of security or service continuity, Jesmond may do so on notice given as soon as reasonably practicable. Clause 6.3 applies, with the 14-day objection period running from that notice.

7. International transfers

7.1 Jesmond shall host and store Customer Personal Data in the United Kingdom or the European Economic Area, as stated in the Order Form or Order (or, for an Enterprise pilot under the Evaluation Terms of Service, in the United Kingdom). Requests to the artificial intelligence model are processed through Amazon Bedrock in the region stated in Annex 3.

7.2 Jesmond shall not make a Restricted Transfer, and shall not permit a Subprocessor to make one, unless a UK Transfer Mechanism is in place and any required transfer risk assessment has been carried out. The Customer authorises the Restricted Transfers identified in Annex 3 on that basis.

8. Assistance

8.1 Taking into account the nature of the processing (including that Jesmond cannot read Content, so that searches and exports of Content for the purposes of a request must be carried out by the Customer through the Service), Jesmond shall assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer’s obligation to respond to requests from data subjects exercising their rights under the Data Protection Legislation, including subject access requests. If Jesmond receives such a request directly, it shall not respond except to direct the data subject to the Customer, and shall promptly pass the request to the Customer.

8.2 Taking into account the nature of the processing and the information available to it, Jesmond shall assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 UK GDPR (security, notification of personal data breaches, data protection impact assessments and prior consultation with the Information Commissioner).

8.3 Jesmond may charge its reasonable costs for assistance under this clause 8 that goes beyond the functionality of the Service, except where the assistance is needed because of Jesmond’s breach of this DPA.

9. Personal data breaches

9.1 Jesmond shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 The notice shall describe, so far as then known: the nature of the breach, including the categories and approximate numbers of data subjects and records concerned; the likely consequences; and the measures taken or proposed to address the breach and mitigate its effects. Where information is not available at once, Jesmond may provide it in phases without undue further delay.

9.3 Jesmond shall take reasonable steps to contain, investigate and mitigate the breach and shall cooperate with the Customer’s response. Jesmond shall not notify the Information Commissioner or any data subject on the Customer’s behalf unless the Customer instructs it to or the law requires it.

9.4 Jesmond’s notification of, or response to, a personal data breach is not an acknowledgement of fault or liability.

10. Return and deletion

10.1 During the term of the Main Terms, the Customer may export Content using the functionality of the Service, and Customer Personal Data is retained in accordance with the retention settings the Customer configures in the Service.

10.2 Within 30 days after termination of the Main Terms (or, under the Enterprise Agreement, of the final Order Form), or within 7 days where the Customer terminates within a money-back period under the Essentials Terms or the Partner Agreement, Jesmond shall delete all Customer Personal Data, unless the Customer has instructed otherwise or domestic law requires Jesmond to retain it. Where Customer Personal Data is held in encrypted form in write-once storage (including the audit record), Jesmond shall delete it by permanently destroying its encryption key, after which it cannot be decrypted by any person, and the encrypted copies shall be erased when their write-once retention period ends. Copies held in backups shall be deleted in the ordinary backup cycle, which shall not exceed 35 days, and shall be kept secure and beyond use until then. Jesmond shall confirm deletion in writing on the Customer’s request.

11. Audit and information

11.1 Jesmond shall make available to the Customer all information necessary to demonstrate compliance with Article 28 UK GDPR and this DPA, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, in accordance with this clause 11.

11.2 Jesmond may first respond to an audit request by providing: (a) a copy of its most recent external security audit report or relevant certification; and (b) answers to a reasonable written security questionnaire, not more than once in any 12-month period.

11.3 If the information provided under clause 11.2 is not sufficient to demonstrate compliance, or an audit is required by the Information Commissioner or follows a personal data breach, the Customer may carry out an audit: on at least 30 days’ written notice (or shorter notice where the Information Commissioner requires); not more than once in any 12-month period save after a personal data breach; during Business Days and normal business hours; through an independent auditor who is not a competitor of Jesmond and is bound by confidentiality obligations; without access to the data of Jesmond’s other customers; and at the Customer’s cost.

12. Liability

12.1 Each party’s liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability in the Main Terms, which apply in aggregate to the Main Terms and this DPA together. Nothing in this DPA limits or excludes any liability which cannot lawfully be limited or excluded.

13. General

13.1 This DPA takes effect with the Main Terms and continues for so long as Jesmond processes Customer Personal Data.

13.2 This DPA and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it are governed by the law of England and Wales and shall be resolved in accordance with the dispute resolution provisions of the Main Terms.

13.3 If any provision of this DPA is held unenforceable or invalid, it shall be limited to the minimum extent necessary and the remainder shall continue in full force.

Annex 1. Details of processing

Subject matter. Provision of the Service: an AI-assisted platform supporting the conduct of workplace grievance, disciplinary and related people processes.

Duration. The term of the Main Terms, plus the deletion period in clause 10.2.

Nature of processing. Hosting and storage of Content in encrypted form (encrypted on the Authorised User’s device, with keys held only by the Customer); requests to the AI model that are not stored or logged by Jesmond; retention of a content-free audit record of who did what and when; hosting, storage, retrieval, organisation, analysis and transmission of Customer Data; generation of Output using artificial intelligence models in response to Input; making Content available to Authorised Users; deletion.

Purpose. To provide the Service to the Customer under the Main Terms, to prevent or address service or technical problems, and to comply with law.

Categories of data subject. The Customer’s employees, former employees, workers, agency workers, contractors and job applicants; complainants, respondents and witnesses; investigators, hearing and appeal managers; companions and representatives, including trade union representatives; Authorised Users; and any other individual named in Customer Data.

Types of personal data. Identification and contact details; employment details (role, reporting line, dates of employment, terms, pay and benefits where relevant); conduct, performance, attendance and absence records; allegations, evidence, witness statements, interview notes, meeting minutes, transcripts, recordings, outcomes and appeals; workplace communications such as emails and messages; Authorised User account details.

Special category personal data. May include data concerning health (including sickness absence, disability and occupational health reports), racial or ethnic origin, religious or philosophical beliefs, sex life or sexual orientation, political opinions and trade union membership, where these appear in the material the Customer uploads. Genetic and biometric data are not permitted (Main Terms).

Criminal offence data. May be included where allegations involve conduct that is or may be criminal. The Customer is responsible for the condition under clause 3.5(c).

Frequency. Continuous during the term.

Location. United Kingdom or European Economic Area, as stated in the Order Form or Order. AI model requests are processed through Amazon Bedrock under zero data retention terms (Annex 3).

Annex 2. Security measures

1. Hosting on United Kingdom or European Economic Area infrastructure, as agreed with each customer.

2. Client-side encryption: stored case Content is encrypted on the Authorised User’s device and can be decrypted only by persons the Customer has authorised. Content sent to the AI model for processing is not stored or logged by Jesmond. Each authorised person holds their own sealed copy of the key, bound to their own sign-in.

3. Key custody with the Customer: the Customer holds a recovery key, and a second recovery key holder must be enrolled before normal use. Jesmond has no route to enrol itself or to recover a key.

4. All data encrypted in transit and at rest using industry-standard encryption.

5. Each customer tenant logically separated, with isolation enforced by the database and storage layers, and no cross-tenant access.

6. Sign-in by corporate login, with no public sign-up, using the fingerprint, face or PIN authentication built into the user’s device.

7. AI model requests processed by Claude on Amazon Bedrock under a zero data retention agreement, with request logging disabled; requests are not stored or logged by Jesmond.

8. A content-free audit record of who did what and when, encrypted on the Authorised User’s device and held in write-once storage for six years, and made permanently unreadable on deletion under clause 10.2.

9. Retention of Customer Data configurable by the Customer, with deletion on the Customer’s schedule; backup copies deleted in the ordinary backup cycle, which does not exceed 35 days.

10. Development and testing with synthetic or anonymised data only; no Jesmond staff member holds a key to customer Content.

11. Penetration testing of the Service before production launch, and independent penetration testing periodically after that.

12. A documented incident response plan.

Annex 3. Subprocessors

Amazon Web Services EMEA SARL (Amazon Bedrock). Function: Runs the Claude AI model that generates Output. Zero data retention; request logging disabled; no training. Location of processing: United Kingdom (or EEA, where agreed with the Customer). Transfer mechanism: Not required for UK; UK adequacy regulations for EEA.

Amazon Web Services EMEA SARL. Function: Hosting of the Service and storage of encrypted Content and the audit record. Location of processing: United Kingdom (or EEA, where agreed with the Customer). Transfer mechanism: Not required (UK) / UK adequacy (EEA).

3 Sided Cube Ltd (company number 05393027). Function: Development, maintenance and support of the Service. Access to account and usage data only; no access to Content. Location of processing: United Kingdom. Transfer mechanism: Not required.

Amazon Web Services EMEA SARL (Amazon Simple Email Service). Function: Account and notification emails (Authorised User contact details only). Location of processing: United Kingdom. Transfer mechanism: Not required.