Data Processing Agreement.

This Data Processing Agreement (“DPA”) is between the customer identified in the order form (“Customer”) and [Dutira legal entity name — to confirm] (“Dutira”). It forms part of the agreement under which Dutira provides the Dutira AI Workspace (the “Agreement”). Publication of this DPA on the website is not execution: it binds the parties only when the order form or Enterprise Agreement incorporates it, and the version so incorporated prevails over any later published version unless the parties agree otherwise.

Data Protection Law

The UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended (including by the Data (Use and Access) Act 2025), and any applicable EU GDPR where the Customer is established in the EEA.

Customer Personal Data

Personal data within Customer Data (as defined in the Terms of Use) that Dutira processes on the Customer’s behalf in providing the Service, as described in Schedule 1.

Subprocessor

A third party engaged by Dutira to process Customer Personal Data.

Service

The Dutira AI Workspace and governance functions identified in the order form.

Other terms

“controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “processing” and “international organisation” have the meanings in Data Protection Law.

For Customer Personal Data the Customer is the controller (or, where the Customer acts for its own clients, a processor acting on its clients’ instructions, in which case Dutira is a subprocessor and the Customer warrants that its clients have authorised Dutira’s engagement). Dutira is the processor. For the limited data Dutira collects for its own purposes — account contacts, billing, security logs about the platform, and the data described in the Privacy Notice — Dutira is an independent controller, and this DPA does not apply to it.

This DPA applies to all processing of Customer Personal Data by Dutira in providing the Service, for the term of the Agreement and for as long afterwards as Dutira retains Customer Personal Data. Schedule 1 describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject, as Article 28(3) requires.

This DPA does not apply to the free FCA AI Governance Checker (which processes nothing on Dutira’s servers) or to the demonstration workspace, which is governed by the Terms of Use and the Privacy Notice and must not be used for real personal data.

Dutira will process Customer Personal Data only on the Customer’s documented instructions, including for transfers to a third country, unless required to do otherwise by UK law, in which case Dutira will tell the Customer before processing (unless the law prohibits it on important grounds of public interest).

The Customer’s documented instructions are: the Agreement and this DPA; the configuration the Customer’s administrators apply in the Service (policies, approved models and providers, retention periods, roles and permissions, governance settings); the use of the Service’s functions by the Customer’s authorised users; and any further written instruction the Customer gives that is consistent with the Agreement. Dutira may charge reasonable fees for instructions that require work outside the Service’s functions.

Dutira will inform the Customer without delay if, in its opinion, an instruction infringes Data Protection Law, and may suspend the processing concerned until the Customer confirms or amends the instruction. Dutira is not obliged to review the lawfulness of the Customer’s instructions.

The Customer is responsible for the lawfulness of the processing it instructs, including: having a lawful basis and, where relevant, an Article 9 or Article 10 condition; giving its employees and other data subjects the information Articles 13 and 14 require, including about monitoring; carrying out a data protection impact assessment where the monitoring or other processing is likely to result in a high risk; and keeping its configuration of the Service — detectors, approved models, retention periods, access permissions — appropriate to the data it processes.

The Customer warrants that it will not instruct Dutira to process special category or criminal offence data except where it has identified a lawful condition, and that it will use the Service’s controls (blocking and masking rules, access permissions) to limit such data appropriately.

The Customer is responsible for the acts and omissions of its users and administrators, and for decisions taken on the basis of the Service’s output.

Dutira will:

1. process Customer Personal Data only as section 3 permits;
2. ensure that persons authorised to process Customer Personal Data are bound by confidentiality (section 6);
3. implement the technical and organisational measures in Schedule 3 (section 7);
4. engage Subprocessors only as section 8 allows;
5. assist the Customer with data subject rights (section 10), security, breach notification, impact assessments and prior consultation (sections 11 and 12);
6. delete or return Customer Personal Data at the end of the Service (section 14);
7. make available the information necessary to demonstrate compliance and allow for audits (section 13);
8. maintain a record of its processing activities as a processor under Article 30(2);
9. not sell Customer Personal Data, use it to train machine-learning models, or process it for its own purposes other than the aggregated, de-identified statistics the Terms of Use permit.

Dutira will ensure that its personnel and contractors who have access to Customer Personal Data are subject to a contractual or statutory duty of confidentiality, have received appropriate training, and access Customer Personal Data only to the extent needed to provide, support and secure the Service.

Dutira staff do not have routine access to Customer Personal Data in the Service. Where support or security work requires it, access is limited to what is necessary, uses the Service’s own permission model and recorded reasons where applicable, and is logged.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, and the risks to data subjects, Dutira will implement and maintain the measures in Schedule 3 to ensure a level of security appropriate to the risk, as Article 32 requires. Dutira may update the measures from time to time provided the overall level of security is not reduced during the term; material changes are notified to the Customer.

Schedule 3 distinguishes measures in place today from measures that are planned. Planned measures are not commitments under this DPA until Dutira notifies the Customer that they are in place, after which they are.

The Customer gives Dutira general written authorisation to engage the Subprocessors listed in Schedule 2, and further Subprocessors subject to this section.

Dutira will give the Customer at least 30 days’ written notice (by email to the Customer’s administrator contact) before a new Subprocessor begins processing Customer Personal Data, identifying the Subprocessor, its location and the processing it will perform. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection in good faith within 30 days, the Customer may terminate the affected Service on notice without penalty, and Dutira will refund any prepaid fees for the period after termination.

Dutira will impose on each Subprocessor, by written contract, data protection obligations that provide at least the same level of protection as this DPA, and remains fully liable to the Customer for the performance of each Subprocessor’s obligations.

Model providers are Subprocessors in respect of the prompts and responses the Service sends them. Where the Customer elects in the order form to use its own provider agreement and endpoint, that provider acts under the Customer’s contract and is not Dutira’s Subprocessor.

Dutira will not transfer Customer Personal Data outside the United Kingdom, or permit a Subprocessor to do so, except: to a country covered by UK adequacy regulations; under the UK Extension to the EU–US Data Privacy Framework where the recipient is certified for the service concerned; or under the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment; or as otherwise permitted by Chapter V UK GDPR. Schedule 2 records the mechanism relied on for each Subprocessor.

The Customer acknowledges that the model providers listed in Schedule 2 are established in the United States, that the hosting region for production is [production hosting region — to confirm], and that the demonstration environment is hosted in the United States. Where the Customer requires that Customer Personal Data not leave the UK, it must say so in the order form, and Dutira will confirm whether and how that can be met (including the use of regional provider endpoints) before the Service begins.

Taking into account the nature of the processing, Dutira will assist the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects exercising their rights under Chapter III UK GDPR. The Service lets Customer administrators search for, export and (within retention rules) delete the records held about a person; Dutira will provide further assistance on request, at reasonable cost where the request requires work outside the Service’s functions.

If a data subject contacts Dutira directly about Customer Personal Data, Dutira will not respond substantively but will tell the data subject to contact the Customer and will notify the Customer within five business days, passing on the request where the data subject agrees.

Dutira will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data — [personal data breach notification period — to confirm] — providing, as it becomes available: the nature of the breach including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point. Dutira will cooperate with the Customer and take reasonable steps to contain and remediate the breach.

Notification by Dutira is not an admission of fault. The Customer is responsible for deciding whether and how to notify the Information Commissioner, the FCA and data subjects. Dutira will not notify a regulator or data subjects about a breach of Customer Personal Data on the Customer’s behalf unless the Customer instructs it to or the law requires it.

Dutira will provide reasonable assistance to the Customer with any data protection impact assessment and any prior consultation with the Information Commissioner that Articles 35 and 36 require in relation to the Service, taking into account the nature of the processing and the information available to Dutira. Dutira’s standard assistance is this DPA, the Security & Trust page, the Privacy Notice description of what the Service records, and answers to reasonable written questions; further assistance may be charged at reasonable rates.

Dutira will make available to the Customer all information necessary to demonstrate compliance with Article 28, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to the following: audits are limited to once in any twelve-month period unless required by a regulator or following a personal data breach; the Customer gives at least 30 days’ written notice and agrees a scope and plan with Dutira; audits take place during business hours, do not unreasonably disrupt Dutira’s operations and do not give access to other customers’ data; auditors are bound by confidentiality; and the Customer bears its own costs and reimburses Dutira’s reasonable costs where an audit exceeds two business days of Dutira’s time.

Dutira will first satisfy audit requests by providing documentation, the results of its own testing (including the automated security tests that run with every release), the Service’s evidence exports and audit-log integrity reports, and any third-party assessment reports it holds. Dutira does not currently hold ISO 27001 or SOC 2 reports or an independent penetration test report; when it does, those reports will be offered in place of an on-site inspection where they cover the scope requested.

The Customer may share this DPA and Dutira’s security information with its regulators and auditors, and Dutira will cooperate with reasonable requests from the Customer’s regulators, including the FCA and PRA, relating to the Service. Where the Customer is subject to the EU Digital Operational Resilience Act (DORA) as an EU financial entity, or to the UK operational resilience rules (SYSC 15A) or outsourcing requirements (SYSC 8), the parties will record in the order form any additional contractual provisions those regimes require; nothing in this DPA implies that Dutira is a designated critical third party under either regime.

During the term, the Customer controls retention through the Service: conversation content is deleted at the end of the retention period the Customer sets, and governance records carry retention dates the Customer configures.

On termination or expiry of the Agreement, Dutira will make Customer Data available for export in machine-readable form (JSON and CSV, including evidence packages with integrity hashes) for 30 days, and will then, at the Customer’s choice communicated in writing, delete all Customer Personal Data — including the per-tenant encryption keys, which renders encrypted content unrecoverable — or return it and then delete it, unless UK law requires storage of some data, in which case Dutira will keep that data confidential and process it only for that purpose. Dutira will confirm deletion in writing on request. Backups held by the hosting provider are overwritten in the ordinary course within the provider’s retention cycle.

Each party’s liability under this DPA is subject to the limitations and exclusions in the Agreement, except that nothing limits a party’s liability to data subjects under Article 82 UK GDPR or for a regulatory fine imposed on that party for its own breach of Data Protection Law. The parties may agree a separate limit for data protection liability in the Enterprise Agreement.

If there is a conflict between this DPA and the Agreement on a data protection matter, this DPA prevails. This DPA is governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction.

This DPA is executed by incorporation into a signed order form or Enterprise Agreement that identifies its version. It is not executed by publication on the website or by use of the Service.

Subject matter

Provision of a governed AI workspace and AI governance records for the Customer’s employees and AI agents.

Duration

The term of the Agreement, plus the export period and deletion in section 14.

Nature and purpose

Hosting, storing, encrypting, transmitting to approved model providers, checking against Customer policies, displaying to authorised users, exporting and deleting Customer Personal Data, so that the Customer can provide approved AI to its people, apply its policies, oversee use, investigate incidents and evidence its governance.

Categories of data subject

The Customer’s employees, contractors and other authorised users; the Customer’s administrators and senior managers; persons named in governance records (owners, approvers, reporters, subjects of incident reports); and any individuals referred to in content users submit, which may include the Customer’s own clients and customers.

Types of personal data

Identity and role data (name, work email, department, job title, line manager, role); AI activity data (prompts, model responses, extracted text of uploaded documents, policy decisions with masked previews, approvals, usage); compliance data (policy acknowledgements, training records and quiz results, attestation answers and declared exceptions, use case proposals, incident reports and investigation notes, control test results, senior management review records); AI agent records (owners, approvers, actions and decisions); audit log entries (who did what and when).

Special category data

Not intended. May occur in prompts, uploaded content or incident reports where the Customer permits; the Customer must configure blocking or masking rules and access controls accordingly and is responsible for the lawful condition.

Retention

As configured by the Customer: conversation content (default 90 days), decision and audit metadata and governance records (default 6 years).

[subprocessor list review — to confirm]. The list below reflects the Service as built; the transfer mechanism for each is confirmed before an order form incorporates this DPA.

Model providers process only the prompts and responses that pass the Customer’s gateway rules; blocked requests are never sent, and masked items are replaced before sending. Where the Customer uses its own provider agreement, that provider is removed from this schedule for that Customer.

Measures in place today (verified against the Service’s code and automated tests at each release):

Planned measures (not yet commitments — see section 7): KMS or HSM envelope encryption with customer-managed keys and key rotation; scheduled anchoring of the audit-log head to write-once storage; a documented security incident response plan with customer notification commitments and SIEM export; tested backup restores with recovery objectives; automatic deletion of governance metadata at the end of retention and a legal-hold control; SAML and SCIM; independent penetration testing; an ISO 27001 or SOC 2 programme.