Data Processing Agreement

2.1 We will process personal data only on the Customer's documented instructions, which are these Terms, this DPA and the Customer's use of the Service's features, unless required to do otherwise by UK law. In that case we will tell the Customer first, unless the law prohibits it.

2.2 We will tell the Customer if we believe an instruction breaches data protection law.

Everyone we authorise to process Customer personal data is bound by a written confidentiality agreement with Arj Global Ltd or a statutory duty of confidentiality.

We will maintain appropriate technical and organisational measures under Article 32, including: encryption in transit and at rest; logical separation of each customer's data using row-level security; role-based access controls; MFA and logged access for our administrative staff; regular backups; vulnerability management; and staff training. We may update these measures provided overall security is not reduced.

5.1 The Customer gives general authorisation for us to use the sub-processors in our Sub-processor list.

5.2 We will give at least 30 days' notice of any new or replacement sub-processor by email or on our website. The Customer may object on reasonable data protection grounds within that period. If we cannot reasonably resolve the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining period.

5.3 We will impose data protection terms on each sub-processor no less protective than this DPA and remain liable for their performance.

We will not transfer Customer personal data outside the UK or EEA unless appropriate safeguards are in place, such as adequacy regulations, the ICO's International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, which are incorporated by reference where required.

We will assist the Customer, through the Service's features and otherwise as reasonably needed, to respond to requests from individuals exercising their rights. If we receive a request directly, we will pass it to the Customer without undue delay and will not respond ourselves unless instructed.

We will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer personal data. We will provide the information the Customer reasonably needs to meet its own notification obligations and take reasonable steps to contain and remedy the breach.

We will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities relating to the Service.

10.1 Our authorised support staff may access the Customer's account to provide support or carry out actions the Customer requests. Such access requires a reason and support ticket reference and is recorded in a platform log available to the Customer on request.

10.2 Permanent deletion of records by our staff is carried out only on written instruction from the Customer's account owner or administrator.

10.3 The Customer can export its data at any time during the Subscription. Within 90 days after termination we will delete Customer personal data, including from backups as they rotate, unless UK law requires us to keep it. We will confirm deletion in writing on request.

We will make available the information reasonably needed to demonstrate compliance with this DPA, such as security documentation and responses to security questionnaires. Where that is not sufficient, the Customer may carry out an audit, no more than once a year, on at least 30 days' notice, during business hours, at its own cost and subject to confidentiality.

The limitations of liability in the Terms apply to this DPA. If this DPA conflicts with the Terms, this DPA prevails for matters of data protection.