Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the guardbook Terms of Service between Vertas AI Ltd (company number 17392826) ("we", "us", "Processor"), and the firm identified at signup or in the applicable order ("you", "your firm", "Controller"). It applies wherever we process personal data on your behalf as described in the Terms of Service.

1. Definitions

"UK GDPR", "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018. "Data Protection Legislation" means the UK GDPR, the Data Protection Act 2018, and any successor or related UK legislation. "Sub-processor" means any processor we engage to process personal data on your behalf in connection with the Service.

2. Roles and scope

As set out in section 7 of the Terms of Service, your firm is the controller and we are the processor for personal data contained in Customer Data. Annex 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subjects, as required by Article 28(3) UK GDPR.

3. Our obligations as processor

We will:

1. process personal data only on your documented instructions, including in relation to international transfers, unless required to do otherwise by UK law, in which case we will tell you before processing unless the law prohibits this;
2. tell you if, in our reasonable opinion, an instruction infringes the Data Protection Legislation;
3. ensure that anyone we authorise to process personal data is subject to a binding duty of confidentiality;
4. implement appropriate technical and organisational security measures, as set out in Annex 2, taking into account the risk to data subjects;
5. only engage sub-processors in accordance with clause 4;
6. taking into account the nature of the processing, assist you with responding to requests from data subjects exercising their rights under the Data Protection Legislation;
7. assist you in meeting your obligations around the security of processing, breach notification, and data protection impact assessments, taking into account the information available to us;
8. at your choice, delete or return all personal data to you at the end of the provision of Service, in accordance with section 12 of the Terms of Service (30 days to export, then deletion), except where the law requires us to retain it; and
9. make available to you the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint, on reasonable notice and no more than once a year unless a personal data breach has occurred.

4. Sub-processors

You give us general authorisation to engage the sub-processors listed in Annex 3 to help provide the Service. We will impose data protection obligations on any sub-processor that are substantially the same as those in this DPA, and we remain liable to you for a sub-processor's performance of those obligations.

If we intend to add or replace a sub-processor, we will give you reasonable notice before that sub-processor starts processing your data. You may object on reasonable data-protection grounds within 14 days of that notice; if you do, we will work with you in good faith to address the objection, which may include not making the change, or you ending the affected part of the Service without penalty.

5. International transfers

Where personal data is transferred outside the UK, whether by us or a sub-processor, we will ensure an appropriate safeguard is in place, such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism recognised under the Data Protection Legislation.

6. Personal data breach

We will notify you without undue delay, and in any case within 48 hours of becoming aware, of any personal data breach affecting your Customer Data, and will provide the information reasonably available to us to help you meet your own notification obligations to the ICO and to affected individuals.

7. Liability

The limitation of liability in section 14 of the Terms of Service applies to claims arising under this DPA in the same way it applies to claims arising under the Terms of Service generally.

8. Term

This DPA takes effect on the date you accept the Terms of Service and continues for as long as we process personal data on your behalf under the Terms of Service. Clauses that by their nature should survive termination (including clause 8, deletion and return of data, and clause 7, liability) continue to apply after termination.

9. General

This DPA, the Terms of Service, and the Privacy Notice together form the entire agreement between us regarding data protection. If there is a conflict between this DPA and the Terms of Service on a data protection matter, this DPA prevails. This DPA is governed by the law of England and Wales.

Annex 1: Details of processing

Subject matter: our provision of the guardbook service, an AI governance and compliance record-keeping tool for RICS-regulated surveying firms.

Duration: for the term of the Terms of Service, plus the 30-day export window and any further period required by law after termination.

Nature and purpose: to host, store, and make available the records your firm enters into guardbook (including the AI tool register, risk register, oversight log, and generated policy documents), and to operate, secure and support the Service.

Types of personal data: names, job titles and contact details of your firm's staff, surveyors, directors and administrative personnel; names of individuals recorded against oversight decisions and other compliance records; contact details for your firm's clients and suppliers where your firm chooses to enter them; and any other personal data your firm's users choose to enter into free-text fields within the Service (for example, notes on an AI output, which may contain a client name or property address).

Categories of data subjects: your firm's employees and personnel; your firm's clients; your firm's suppliers and subcontractors; and any other individual your firm's users name in records they enter into the Service.

Annex 2: Security measures

• Row Level Security enforced on every table in the underlying database, so access is restricted to the account it belongs to.
• Authentication and access control through our infrastructure provider's managed auth system.
• Encryption in transit (HTTPS) and at rest, as provided by our infrastructure providers.
• Audit logging of compliance-relevant actions, held on an immutable, soft-delete-only basis.
• Bot and abuse protection on account creation and login.
• Supplier management: sub-processors are limited to those in Annex 3 and reviewed under clause 4 before any change.

Annex 3: Sub-processors