Data Processing Agreement

1. Background and incorporation

This Data Processing Agreement ("DPA") is issued by StudioData Limited, a company registered in England and Wales under company number 17326272, whose registered office is at The Farmhouse, Broadstone Estate, Enstone, Chipping Norton, England, OX7 5QL ("StudioData", "we", "us" or "our").

This DPA applies whenever StudioData processes personal data on behalf of a PR or communications agency (the "Agency", "you" or "your") in the course of providing the Services under a PR Agency Subscriber Contract between StudioData and the Agency (the "Subscriber Contract"). This DPA is incorporated into, and forms part of, the Subscriber Contract by its Clause 8 (Data protection). Where this DPA conflicts with the Subscriber Contract on data protection matters, this DPA takes precedence; on all other matters, the Subscriber Contract governs.

The Agency agrees to this DPA by signing an Order Form under the Subscriber Contract; no separate signature is required for this DPA to take effect, although Clause 12 explains how an Agency can request a countersigned copy if its own governance process requires one.

2. Definitions

In this DPA, "Controller", "Processor", "Data Subject", "Personal Data", "Processing" and "Personal Data Breach" have the meanings given in the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. "Customer Personal Data" means personal data that StudioData processes on the Agency's behalf in providing the Services, as further described in Annex A. "Sub-processor" means a third party engaged by StudioData to process Customer Personal Data in providing the Services, as listed in Annex B.

3. Roles of the parties

In relation to Customer Personal Data, the Agency is the Controller and StudioData is the Processor. This reflects that the Agency decides why and how Customer Personal Data is processed within the Platform (for example, which Client data sources to connect, and what coverage or social records to enter), while StudioData processes that data only to provide the Services on the Agency's instructions.

This DPA does not apply to personal data for which StudioData is itself the Controller — for example, data about the Agency's own personnel collected in connection with the Website or the commercial relationship — which is instead addressed in StudioData's Privacy Policy.

4. Details of processing

The subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Annex A to this DPA.

5. StudioData's obligations as Processor

StudioData will:

• process Customer Personal Data only on the Agency's documented instructions (including as set out in the Subscriber Contract and this DPA), unless required to do otherwise by law, in which case StudioData will inform the Agency before processing unless prohibited from doing so;
• ensure that persons authorised to process Customer Personal Data are subject to a duty of confidentiality;
• implement appropriate technical and organisational security measures having regard to the nature of the data and the risk involved;
• taking into account the nature of the processing, reasonably assist the Agency in responding to Data Subject requests and in meeting its obligations regarding data protection impact assessments and prior consultation with the ICO where applicable;
• notify the Agency without undue delay, and in any event within 48 hours of becoming aware, of any Personal Data Breach affecting Customer Personal Data, and provide reasonable information to help the Agency meet its own notification obligations; and
• at the Agency's choice, delete or return all Customer Personal Data at the end of the Term of the Subscriber Contract, save to the extent StudioData is required by law to retain it.

6. Sub-processors

The Agency authorises StudioData to engage the Sub-processors listed in Annex B in connection with the Services. StudioData will give the Agency at least 30 days' prior notice of any intended change to Annex B (addition or replacement of a Sub-processor), during which the Agency may object on reasonable data protection grounds; if the Parties cannot resolve the objection, the Agency may terminate the affected Order Form without penalty. StudioData remains liable for each Sub-processor's acts and omissions as if they were StudioData's own.

7. International transfers

Where a Sub-processor processes Customer Personal Data outside the UK, StudioData will ensure an appropriate transfer mechanism is in place, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or reliance on adequacy regulations recognised under UK law.

8. Audit and information rights

StudioData will make available to the Agency information reasonably necessary to demonstrate compliance with this DPA, and will permit and contribute to audits, including inspections, conducted by the Agency or an auditor mandated by the Agency, on reasonable prior written notice, no more than once per year (or more frequently if required following a Personal Data Breach), subject to reasonable confidentiality protections.

9. Liability

Liability under this DPA is subject to the limitation of liability set out in the Subscriber Contract, save to the extent such limitation cannot lawfully apply to data protection liability.

10. Term

This DPA takes effect on the Effective Date of the first Order Form entered into under the Subscriber Contract, and continues until all Customer Personal Data processed under it has been deleted or returned in accordance with Clause 5 above, notwithstanding any earlier termination of the Subscriber Contract.

11. Updates to this DPA

Because this DPA is a standalone document rather than a fixed schedule, StudioData may update it from time to time — for example, to reflect a change of Sub-processor (subject to the notice and objection process in Clause 6), a change in applicable data protection law, or an improvement to StudioData's security measures. StudioData will not make changes that materially reduce the Agency's rights or StudioData's obligations under this DPA without the Agency's written consent. Each version of this DPA will be dated; the version in force at any given time is the one published at studiodata.ai/legal/dpa, and StudioData will provide the Agency with a dated copy alongside each Order Form and on request.

12. How this DPA is agreed, and where an Agency sees it

This DPA is referenced in, and incorporated by reference into, the Subscriber Contract, the Terms of Business and the Privacy Policy, and is published at a stable link on the StudioData website so it can be reviewed at any time. StudioData will also provide a dated copy of this DPA directly to a prospective Agency alongside its draft Order Form, so that the Agency's own data protection or procurement review can take place before signature rather than only being discoverable afterwards.

The Agency's signature on an Order Form under the Subscriber Contract constitutes its agreement to the version of this DPA then published, and satisfies the requirement under Article 28 UK GDPR for a written contract governing the Processor relationship — a separate signature on this DPA itself is not required. That said, where an Agency's internal governance requires a counter-signed copy of this specific document, StudioData will countersign on request.

13. General

13.1. Governing law and jurisdiction

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with it, consistent with the Subscriber Contract.

13.2. Notices

Notices under this DPA must be in writing and sent to the address or email address specified in the applicable Order Form, or to privacy@studiodata.ai, or such other address as a Party notifies to the other.

Contact