Data Processing Agreement

Last updated: 11 September 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Atticus Intelligence Ltd, registered in England and Wales under number 16130885 ("Processor", "we", "us") and the customer identified in the account ("Controller", "you"), together the "parties".

It applies whenever we process personal data on your behalf in providing BetterForms (the "Service"). Where this DPA conflicts with the Terms of Service, this DPA prevails in relation to data protection.

1. Definitions

Data Protection Laws — the UK GDPR, the Data Protection Act 2018, the EU GDPR where applicable, and any other data protection or privacy laws applicable to a party's processing.

Customer Personal Data — personal data contained in responses submitted to your forms, and any other personal data we process on your behalf under the Terms of Service.

Sub-processor — any third party engaged by us to process Customer Personal Data.

Controller, processor, data subject, personal data, personal data breach, processing, and supervisory authority have the meanings given in the UK GDPR.

2. Roles of the parties

You are the controller of Customer Personal Data. We are your processor.

You determine what questions to ask, why, from whom, and for how long the data is retained. You are responsible for the lawfulness of your collection, for providing the information required by Articles 13 and 14, and for the accuracy of the instructions you give us.

We process Customer Personal Data only as set out in this DPA, the Terms of Service, and your documented instructions.

Separately, we act as controller of account, billing, and usage data relating to you and your team members. That processing is governed by our Privacy Policy, not this DPA.

3. Our obligations

We will:

(a) Process only on instructions. Process Customer Personal Data only on your documented instructions, including as to international transfers, unless required to do otherwise by law. Where law requires otherwise, we will inform you before processing unless that law prohibits it. Your use of the Service, including the configuration of your forms and the analysis features you enable, constitutes your documented instructions.

(b) Tell you about unlawful instructions. Inform you if, in our opinion, an instruction infringes Data Protection Laws. We may suspend performance of the instruction pending resolution.

(c) Ensure confidentiality. Ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations and receive appropriate data protection training. Access is limited to those who need it to provide the Service.

(d) Implement security measures. Implement and maintain the technical and organisational measures set out in Annex C, taking into account the state of the art, the costs of implementation, and the risks to data subjects.

(e) Assist you. Taking into account the nature of processing and the information available to us, provide reasonable assistance with:

• responding to data subject requests (see section 6);
• data protection impact assessments and prior consultation with supervisory authorities;
• security obligations under Article 32; and
• breach notification under Articles 33 and 34.

(f) Delete or return data. On termination, handle Customer Personal Data as set out in section 9.

(g) Demonstrate compliance. Make available the information reasonably necessary to demonstrate compliance with Article 28, and allow audits as set out in section 8.

(h) Not use data for our own purposes. We will not sell Customer Personal Data, use it for advertising, or use it to train artificial intelligence or machine learning models. We may generate aggregated, fully anonymised statistics that cannot identify you, any data subject, or any individual form, and use those to operate and improve the Service.

4. Your obligations

You will:

• ensure you have a lawful basis for collecting the data you request through your forms, and for instructing us to process it;
• provide data subjects with the information required by Data Protection Laws, including that a processor hosts and analyses their responses;
• not collect special category data (Article 9) or criminal offence data (Article 10) through the Service unless you have identified a valid condition for doing so, and you acknowledge that the Service is not specifically designed or certified for such data;
• not collect data from children unless you have obtained any consent required;
• not enter personal data into AI generation prompts;
• handle data subject requests addressed to you; and
• keep your account credentials secure and manage your users' access rights.

You acknowledge that we have no visibility into the lawfulness of your purpose and rely on your instructions.

5. Sub-processors

You give general authorisation for us to engage sub-processors. The sub-processors engaged at the date of this DPA are listed in Annex B.

Before adding or replacing a sub-processor, we will give you at least 30 days' notice by email to the account owner and by updating Annex B. You may object on reasonable data protection grounds within that period by writing to privacy@usebetterforms.com. If we cannot resolve your objection, you may terminate the affected part of the Service and receive a pro rata refund of prepaid fees for the unused term. That is your sole remedy.

We will impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.

6. Data subject requests

If we receive a request from a data subject relating to Customer Personal Data, we will not respond to it substantively. We will promptly forward it to you and confirm to the data subject that we have done so, unless legally prohibited.

The Service provides functionality allowing you to access, correct, export, and delete responses yourself. Where you cannot fulfil a request using that functionality, we will provide reasonable assistance at your cost, save where the request relates to our own failure.

7. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Customer Personal Data.

The notification will describe, to the extent known: the nature of the breach and the categories and approximate number of data subjects and records affected; the likely consequences; the measures taken or proposed; and a contact point for further information. We will provide further information as it becomes available.

We will take reasonable steps to contain and remediate the breach. Notification is not an acknowledgement of fault or liability.

You are responsible for notifying supervisory authorities and data subjects where required.

8. Audits

On reasonable written request, and no more than once in any 12-month period unless required by a supervisory authority or following a personal data breach, we will provide information reasonably necessary to demonstrate compliance with this DPA.

We will first seek to satisfy such requests by providing our security documentation and any third-party certifications or reports we hold. Where those are genuinely insufficient, you may conduct an audit yourself or through an independent auditor who is not our competitor, subject to:

• at least 30 days' written notice;
• conduct during business hours, without unreasonable disruption;
• the auditor signing confidentiality undertakings;
• scope limited to systems and records relevant to Customer Personal Data; and
• no access to other customers' data, our commercially sensitive information, or shared infrastructure controlled by sub-processors.

You bear the cost of audits unless they reveal a material breach of this DPA.

9. Deletion and return

You may export Customer Personal Data at any time during the term using the Service's export functionality, subject to the features available on your plan.

On termination or expiry, we will delete Customer Personal Data within 30 days, unless required by law to retain it. During that period you may request a copy in a machine-readable format.

Data in backups will be deleted on the ordinary backup rotation cycle, within 30 days of deletion from live systems. Backup copies remain subject to this DPA until deleted.

Free plan accounts are subject to a rolling 30-day response history; data outside that window is deleted automatically during the term.

10. International transfers

Some sub-processors listed in Annex B process Customer Personal Data outside the UK and the EEA.

Where we transfer Customer Personal Data out of the UK, we do so under the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses as supplemented by the UK Addendum, or on the basis of an adequacy regulation.

Where we transfer Customer Personal Data out of the EEA, we do so under the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Three (processor to processor) where we act as your processor, or on the basis of an adequacy decision.

The relevant clauses are incorporated into this DPA by reference and are deemed completed with:

• Data exporter: you, as controller.
• Data importer: us, as processor, or the relevant sub-processor.
• Annex I: the details in Annexes A and B of this DPA.
• Annex II: the measures in Annex C of this DPA.
• Governing law and forum: England and Wales for the UK IDTA; the Republic of Ireland for the EU SCCs.
• Optional clauses: the docking clause applies; Clause 17 Option 1 applies, with the law of the Republic of Ireland governing the EU SCCs.

We carry out transfer risk assessments where required and apply supplementary measures including encryption in transit and at rest.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except that nothing limits liability that cannot be limited under Data Protection Laws, including liability to data subjects under Article 82.

12. Term and general

This DPA takes effect when you accept the Terms of Service and continues until we have deleted all Customer Personal Data in accordance with section 9.

We may update this DPA to reflect changes in law, sub-processors, or the Service, on 30 days' notice, provided the changes do not materially reduce the protections it provides.

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, without prejudice to the governing law of any incorporated transfer clauses.

Annex A — Details of processing

Subject matter. Provision of an online form building, response collection, and automated analysis service.

Duration. The term of the Terms of Service, plus the deletion period in section 9.

Nature and purpose of processing. Collection, storage, structuring, retrieval, automated grouping and summarisation, transmission by email, deletion. Specifically: hosting forms; receiving and storing responses; generating numerical representations (embeddings) of open-text answers; grouping answers by similarity; sending a limited sample of answers to a language model to produce theme names and summaries; storing analysis outputs; delivering reports to recipients you designate.

Categories of data subjects. Respondents to forms created by you. These may include your customers, employees, members, students, service users, event attendees, or members of the public, as determined by you.

Categories of personal data. Determined by you through the questions you choose to ask. Typically: free-text opinions and comments; answers to closed questions; and, where you elect to collect them, name, email address, and other identifiers. We also process technical data associated with submissions, including IP address, user agent, and timestamp.

Special category data. Not required or expected by the Service. If you choose to collect it, you are responsible for identifying an Article 9 condition. You must notify us at privacy@usebetterforms.com before doing so at scale.

Frequency. Continuous, on submission of responses; and on a batch basis when a form closes and analysis runs.

Retention. As set out in section 9 and your plan's history setting.

Annex B — Sub-processors

AI providers are engaged under terms that prohibit use of submitted data for model training.

The current list is maintained in the Privacy Policy.

Annex C — Technical and organisational measures

Encryption. TLS 1.2 or above for all data in transit. AES-256 or equivalent for data at rest, including databases and backups.

Access control. Role-based access to production systems. Multi-factor authentication required for all personnel with production access. Access granted on a least-privilege basis, reviewed quarterly, and revoked within 24 hours of role change or departure.

Application security. Authentication and session management delegated to a specialist provider. Tenant isolation enforced at the data layer. Webhook callbacks between components authenticated by signed request.

Logging and monitoring. Append-only audit log recording significant account actions with actor and timestamp. Infrastructure and application logs retained for 12 months. Alerting on anomalous access patterns.

Resilience. Automated encrypted backups taken daily, retained 30 days, with restoration tested annually. Infrastructure hosted on providers with redundancy across availability zones.

Development practices. Code review before deployment. Dependency vulnerability scanning. Segregation of production from development and test environments. No production personal data used in testing.

Personnel. Confidentiality obligations in all contracts. Data protection training on joining and annually thereafter. Background checks where lawful and proportionate.

Sub-processor management. Due diligence before engagement. Contractual data protection terms no less protective than this DPA. Periodic review.

Incident response. Documented procedure covering detection, containment, assessment, notification, and post-incident review. Notification timeline as set out in section 7.

Deletion. Documented deletion procedures covering live systems and backup rotation.

_These measures may be updated as the Service evolves, provided the overall level of security is not reduced._

Signature block (for negotiated agreements)

Where a customer requires a signed DPA rather than acceptance by reference:

Controller Name: ********\_\_****** Title: ******\_\_****** Entity: ******\_\_****** Date: ******\_\_********

Processor — Atticus Intelligence Ltd Name: ********\_\_****** Title: ******\_\_****** Date: ******\_\_********