Data Processing Agreement

1. Parties

2. Definitions

3. Subject Matter and Duration

3.1 Subject Matter

This DPA governs the processing of personal data by PICMS when providing compliance management services to the Customer, including:

• Storage and management of compliance documentation
• Processing of employee training records
• Management of audit and incident records
• Risk assessment and management data
• User account administration

3.2 Duration

This DPA shall remain in effect for the duration of the Customer's subscription to PICMS services and for as long as PICMS processes personal data on behalf of the Customer.

4. Nature and Purpose of Processing

PICMS processes personal data for the following purposes:

• Providing access to the PICMS compliance management platform
• Storing and organising compliance documentation
• Generating compliance reports and analytics
• Managing user accounts and access permissions
• Providing customer support services
• Sending service-related communications

5. Categories of Data Subjects

Personal data processed under this DPA may relate to:

• Customer employees and contractors
• Customer's clients (where included in compliance records)
• Third-party contacts (suppliers, auditors, regulators)
• Individuals mentioned in incident reports or risk assessments

6. Types of Personal Data

Categories of personal data processed may include:

• Identity Data: Names, job titles, employee IDs
• Contact Data: Email addresses, phone numbers, business addresses
• Professional Data: Qualifications, training records, certifications
• Compliance Data: Audit findings, incident reports, risk assessments
• Technical Data: IP addresses, login timestamps, usage logs

7. Processor Obligations

PICMS shall:

7.1 Processing Instructions

• Process personal data only on documented instructions from the Customer
• Inform the Customer if any instruction infringes UK GDPR
• Not process data for any purpose other than providing the agreed services

7.2 Confidentiality

• Ensure all personnel processing data are bound by confidentiality obligations
• Limit access to personal data to authorised personnel only
• Implement appropriate access controls and authentication measures

7.3 Security Measures

• Implement appropriate technical and organisational security measures
• Maintain TLS 1.2+ encryption for data in transit
• Apply AES-256 encryption for data at rest
• Conduct continuous automated security testing (weekly SAST + external DAST); independent third-party penetration testing from Q3 2026
• Maintain ISO 27001 aligned security practices

7.4 Sub-processing

• Not engage sub-processors without prior written authorisation
• Maintain a list of approved sub-processors
• Ensure sub-processors are bound by equivalent data protection obligations
• Remain liable for sub-processor compliance

7.5 Data Subject Rights

• Assist the Customer in responding to data subject requests
• Implement technical measures to facilitate rights exercise
• Provide data export functionality in machine-readable formats
• Support data portability and deletion requests

7.6 Data Breach Notification

• Notify the Customer of any personal data breach without undue delay
• Provide notification within 24 hours of becoming aware of a breach
• Assist with breach investigation and remediation
• Document all breaches and corrective actions taken

7.7 Data Protection Impact Assessments and Prior Consultation

Taking into account the nature of the processing and the information available to PICMS, PICMS shall:

• Provide reasonable assistance to the Customer with any Data Protection Impact Assessment the Customer is required to carry out under UK GDPR Article 35 in respect of processing performed by PICMS
• Provide reasonable assistance with any prior consultation with the Information Commissioner's Office under UK GDPR Article 36 arising from such an assessment

8. Controller Obligations

The Customer shall:

• Ensure lawful basis exists for all personal data provided to PICMS
• Provide clear processing instructions to PICMS
• Notify data subjects of data processing where required
• Respond to data subject requests within statutory timeframes
• Conduct Data Protection Impact Assessments where required

9. International Transfers

Customer data at rest is held in the UK (AWS eu-west-2, London). Certain sub-processors listed in §10 (AI, email, payments) process limited data in the United States, and the identity provider (Auth0, a UK-region tenant) is owned by a US company; for any such transfers:

• Transfers rely on the UK Addendum to the EU Standard Contractual Clauses (or the UK IDTA)
• Transfer Impact Assessments will be conducted
• Supplementary measures will be applied where required
• Customer will be notified of any new transfer destinations

10. Approved Sub-processors

The Customer authorises the use of the following sub-processors. The current canonical list (with locations and DPA terms) is also published at /trust#subprocessors and in the Privacy Policy §5; this DPA Annex must be read in line with that list:

Sub-processor	Purpose	Location
Amazon Web Services (AWS)	Cloud hosting (RDS, S3, ECS, ALB), transactional email (AWS SES); for organisations with UK-only AI processing, AI inference (Amazon Bedrock), dictation (Amazon Transcribe) and read-aloud (Amazon Polly)	eu-west-2 (London), United Kingdom
Supabase	AI knowledge base — stores vector embeddings of documents and learning material the AI assistant retrieves to answer questions in PICMS; AI agent memory	eu-west-2 (London), United Kingdom
Auth0 (Okta)	Authentication, identity, MFA	United Kingdom — Auth0 UK-region tenant (*.uk.auth0.com). Okta, Inc. is US-headquartered; any transfer outside the UK is under the UK addendum to EU SCCs
Anthropic (Claude API)	AI analysis & content drafting, when an AI feature runs: when someone uses one, when a document is uploaded and indexed, and for scheduled checks such as the Guardian scans. API content not used for model training under default API terms.	United States — UK addendum to EU SCCs
OpenAI (Embeddings, Vision, Chat and Speech-to-Text APIs)	Semantic search of customer documents (~1,000-character chunks); analysis of incident evidence photos when a user asks for it; some document drafting; transcribing voice dictation when a user dictates. API content not used for model training under default API terms.	United States — UK addendum to EU SCCs
ElevenLabs (Text to Speech API)	Spoken answers from PICMS BOSS, only when a user plays an answer aloud; receives the text being read	United States — UK addendum to EU SCCs
Resend	Transactional email (RAMS sends, invitations, weekly digest)	United States — UK addendum to EU SCCs
Stripe	Payment processing — PCI DSS Level 1; card data never touches PICMS servers	United Kingdom / United States
Telegram (Bot API, optional)	Digest/alerts — only when a User voluntarily links their Telegram account	Telegram global infrastructure

UK-only AI processing (optional). An organisation can have its AI processing kept in the UK. When it is switched on, Claude AI, incident photo analysis, voice dictation and read-aloud answers run on AWS in London (Amazon Bedrock, Amazon Transcribe and Amazon Polly, eu-west-2) instead of the US providers above, under the same AWS terms. OpenAI is still used to index that organisation’s documents for search. Transactional email (Resend) and payments (Stripe) are unchanged. Changes to the setting are recorded in the organisation’s own audit trail.

PICMS will notify the Customer at least 30 days before engaging any new sub-processor, allowing the Customer to object. Objections may be raised to privacy@picms.com.

11. Audit Rights

The Customer has the right to:

• Request evidence of PICMS compliance with this DPA
• Review security certifications and audit reports
• Conduct audits with reasonable notice (at Customer's expense)
• Request information about processing activities

Security documentation is available on request.

12. Data Retention and Deletion

12.1 During Subscription

PICMS will retain personal data for the duration of the Customer's subscription as necessary to provide the services.

12.2 Upon Termination

• Customer may export data within 30 days of termination
• PICMS will delete all personal data within 30 days of the export period
• Backup data will be purged within 90 days
• Certification of deletion available upon request

12.3 Exceptions

Data may be retained longer where required by law or for legitimate legal purposes (e.g., regulatory compliance records).

13. Liability

Each party's liability under this DPA shall be subject to the limitations set forth in the main Terms of Service, except that neither party excludes liability for:

• Death or personal injury caused by negligence
• Fraud or fraudulent misrepresentation
• Any liability that cannot be excluded by law

14. Amendments

This DPA may be amended:

• By mutual written agreement of the parties
• To reflect changes in applicable data protection laws
• To add or remove sub-processors (with 30 days notice)