Data Processing Agreement

In this DPA: "Data Protection Law" means every law on the protection of personal data that applies to the processing under this DPA, including the UK GDPR, the EU GDPR, the UK Data Protection Act 2018, and each national law implementing or supplementing the EU GDPR or Directive (EU) 2019/1937 (the "Whistleblowing Directive"), each as amended or replaced. "Controller", "processor", "sub-processor", "personal data", "special categories of personal data", "processing", "personal data breach", "data subject", and "supervisory authority" have the meanings given in the UK GDPR and the EU GDPR. "Customer Personal Data" means the personal data Provoxis processes as your processor under this DPA, described in Annex I; it comprises "report content" — everything a reporter submits and everything a case handler adds to a case — and "reporter data" — personal data relating to a person who submits, is named in, or is affected by a report. "Standard Contractual Clauses" or "SCCs" means the clauses in the Annex to Commission Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to those Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, and "UK IDTA" means the Commissioner's standalone International Data Transfer Agreement. "Restricted Transfer" means a transfer of Customer Personal Data to a country for which there is no relevant adequacy decision and which Data Protection Law permits only with a transfer mechanism of the kind listed in Article 46 of the UK or EU GDPR. Words defined in the Terms of Service keep that meaning here unless stated otherwise.

For report content and reporter data submitted through your reporting channel, you are the controller and Provoxis is your processor. You determine the purposes and means of the processing; Provoxis processes that data only to provide the service and only on your documented instructions. Provoxis is an independent controller, and not your processor, for a separate and limited set of business data described in its Privacy Policy: the identity and account records of your administrators and case handlers (name, email address, role, and authentication data), your billing records, and website-visitor statistics. That data is governed by the Privacy Policy, not this DPA. Where the same individuals' personal data instead forms part of a case record — a handler's name on a case note, or an entry in the audit log — it is Customer Personal Data and this DPA applies to it. A person who submits a report through your channel is a data subject under this DPA, never a party to it, and is never required to accept it.

Your complete documented instructions to Provoxis are: (a) these Terms of Service, this DPA, and the Privacy Policy; (b) the configuration choices your administrators make in the product (such as misconduct categories, retention settings within the permitted bounds, role assignments, legal holds, and erasure requests); and (c) any further written instruction you give that the parties agree to in writing. Processing Customer Personal Data only within the region assigned to your account, as described in section 11, is part of those instructions. Provoxis will process the data only for the purposes of operating the report-intake channel, case management, the reporter portal, and the related notifications and audit logging described in the Privacy Policy, and will not process Customer Personal Data for its own purposes or those of any third party. Provoxis will inform you if, in its opinion, an instruction infringes Data Protection Law, and may suspend the affected processing until the instruction is confirmed or changed.

The subject matter of the processing is the operation of a whistleblowing report-intake and case-management service. Its nature and purpose, the types of personal data, the categories of data subjects, and the frequency of the processing (continuous, for the duration of the subscription) are set out in Annex I. The processing lasts for as long as your subscription is active, and then for the additional period needed to complete the return-and-deletion steps in section 14.

Provoxis ensures that every person it authorises to process Customer Personal Data — whether an employee or an approved contractor — is bound by an appropriate contractual or statutory duty of confidentiality that survives the end of their engagement, receives training appropriate to their role on the protection of personal data, and is granted access only to the extent needed to operate or support the service. Within the product, access to report content is restricted by role and enforced at the application's access-control layer, not just the interface. Provoxis personnel do not access the content of your cases except where you ask for support that requires it, or where access is strictly necessary to maintain the security or integrity of the service; every such access is limited to what the task requires and is recorded in the audit log available to you.

Provoxis implements and maintains the technical and organisational measures set out in Annex II, taking into account the state of the art, the costs of implementation, and the risks of the processing — in particular the risk that a whistleblowing report contains special-category data or would identify a reporter. Provoxis may update these measures over time, provided the level of protection is not reduced, and provides a current copy of Annex II and responds to a reasonable security questionnaire on request under section 13.

You give Provoxis general written authorisation to engage the sub-processors listed in Annex III and in the sub-processor registry below. Provoxis imposes data-protection obligations on each sub-processor that are no less protective than those in this DPA, and remains fully liable to you for their performance. Each sub-processor is used only for the specific data flow described for it; a new purpose requires a fresh disclosure. Provoxis will announce any intended addition or replacement of a sub-processor by updating the "Changes to this list" log on the same page, at least 30 days before the new sub-processor begins processing. If you raise a reasonable data-protection objection within that period, the parties will work in good faith to resolve it. If they cannot within 30 days, you may terminate the part of the service that requires the objected-to sub-processor on written notice, and Provoxis will refund any prepaid fees covering the period after termination for that part.

Taking into account the nature of the processing, Provoxis assists you by appropriate technical and organisational measures, so far as possible, in fulfilling your obligation to respond to requests to exercise data-subject rights — including requests for access, rectification, erasure, restriction of processing, data portability, objection to processing, and the right not to be subject to a decision based solely on automated processing. Because report content and reporter data stay under your control, the primary tools are in your hands: your administrators can export a full case file, place or release a legal hold, and carry out a reason-required, audit-logged manual erasure of a case at any time, and this functionality is available throughout the term at no additional charge. If a data subject contacts Provoxis directly about data it processes for you, Provoxis will not respond substantively but will refer them to you and pass the request on without undue delay.

Provoxis notifies you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting data it processes for you. The notification is sent to your account administrators, describes — to the extent known, and in stages as information becomes available — the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed, and identifies a contact point for more information. A notification under this section is not an acknowledgement by Provoxis of fault or liability. Provoxis does not notify a supervisory authority or data subjects on your behalf unless you instruct it to in writing.

Taking into account the nature of the processing and the information available to it, Provoxis provides reasonable assistance with any data protection impact assessment and any prior consultation with a supervisory authority that you are required to carry out in relation to your use of the service. The security information in Annex II, the retention model, and the audit-log capability are intended to support this.

(a) Data location. Provoxis stores and processes report content and staff-account data only in the region assigned to your account. Each region is a self-contained stack; that data is not routed through, replicated into, or backed up to another region. (b) Provoxis as a UK processor. Provoxis Ltd is established in the United Kingdom and its personnel administer and support each regional stack from the United Kingdom; your acceptance of this DPA instructs and authorises that access. At the date of this DPA the European Commission's adequacy decision of 28 June 2021 for the United Kingdom is in force, so this access is not a Restricted Transfer. If that decision lapses, is suspended, or is not renewed, the SCCs (Module Two, controller to processor) are incorporated into this DPA by reference and apply from that date to Provoxis's processing of EU-region Customer Personal Data, completed as follows: Annex I and Annex II of this DPA populate the SCC annexes; the optional docking clause (Clause 7) is not used; under Clause 9 the parties select general written authorisation with the notice period in section 7; the optional redress clause (Clause 11) is not used; under Clause 17 the Clauses are governed by the law of Ireland; under Clause 18 disputes are resolved before the courts of Ireland; and the competent supervisory authority is identified in Annex I. (c) Sub-processor transfers. Where a sub-processor in Annex III processes Customer Personal Data outside the UK and the EEA in connection with a permitted data flow, Provoxis ensures that transfer is covered by an appropriate safeguard under Article 46 of the UK or EU GDPR — the SCCs with the UK Addendum, or the UK IDTA — and by a transfer risk assessment. Of the current sub-processors, AWS (Frankfurt) and Mailgun (EU infrastructure) process in the EEA; Stripe processes billing data primarily in the United States under its own SCCs and UK Addendum. (d) New transfers. Provoxis will not begin any new transfer of Customer Personal Data to a third country without a valid transfer mechanism and, where required, supplementary measures in place. (e) Switzerland. Where the Customer is established in Switzerland, or the processing is otherwise subject to the Swiss Federal Act on Data Protection ("FADP"), and the fallback in paragraph (b) is triggered, the SCCs incorporated under that paragraph apply to that Customer Personal Data with the adaptations issued by the Swiss Federal Data Protection and Information Commissioner ("FDPIC"): references to the EU GDPR are read as references to the FADP so far as the FADP grants no lower level of protection; the term "member state" is read to include Switzerland, so that a data subject in Switzerland may enforce the Clauses in their place of habitual residence; and the competent supervisory authority is the FDPIC.

If Provoxis receives a legally binding request from a public authority, including a law-enforcement authority, to disclose Customer Personal Data, Provoxis will, unless legally prohibited: notify you without undue delay and, where possible, before disclosing; inform the authority that Provoxis is a processor, that you have not authorised the disclosure, and that the authority should address its request to you; challenge a request that is unlawful, overbroad, or inconsistent with international comity, and seek interim measures where available; and disclose only the minimum data actually required, on a reasonable interpretation of the request. Where Provoxis is prohibited from notifying you, it will use reasonable efforts to obtain a waiver of that prohibition and will document the efforts it made so it can make them available to you. Provoxis keeps a record of the requests it receives and, to the extent it is lawfully able to, provides you with a summary on request.

Provoxis makes available to you the information reasonably necessary to demonstrate compliance with Article 28 and this DPA, and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate. In the first instance Provoxis satisfies this by providing its security documentation, a completed Annex II, and its sub-processor list on request, and — for data it processes for you — by the tenant-accessible audit log, which records every read of a report, note, evidence file, or audio recording and every privileged action; once Provoxis holds a current third-party audit report (such as SOC 2 or ISO 27001), providing that report also satisfies a request. Provoxis does not currently hold a SOC 2 or ISO 27001 certification; the platform is built to the access-control and audit-evidence controls those frameworks examine, but Provoxis will not claim a certification it does not hold. You bear your own costs of an audit and reimburse Provoxis's reasonable time-and-materials costs of supporting an on-site audit that goes beyond providing documentation. An auditor you mandate must not be a competitor of Provoxis and must be bound by confidentiality obligations at least as protective as those in this DPA. An on-site audit may be carried out no more than once a year (unless a supervisory authority requires otherwise or a breach has occurred), on reasonable notice, during business hours, and in a way that does not give you access to another tenant's data.

On expiry or termination of your subscription, Provoxis keeps the report data available for you to export, through the in-product case-file export, for 30 days. After that period, and in any event within 60 days of termination, Provoxis deletes the report data and existing copies and instructs its sub-processors to do the same, unless Data Protection Law requires it to be kept — in which case Provoxis isolates and protects that data and deletes it when the requirement ends. Deletion otherwise follows the retention rules in the Privacy Policy: a case under active or reasonably anticipated legal or disciplinary proceedings is retained until those proceedings conclude, and any legal hold you have placed suspends deletion entirely. Encrypted backups are purged on their normal rolling cycle and are not retained beyond it. Report content, its object storage, and any associated access tokens are hard-deleted, not merely hidden. Provoxis confirms deletion in writing on request.

Provoxis provides the assistance described in sections 8 to 13 as part of the service. Where a request for assistance is manifestly unfounded or excessive, in particular because of its repetitive character, or where the need for assistance arises from your own act or omission, Provoxis may charge a reasonable fee based on its administrative cost, having first told you and given you the chance to withdraw or narrow the request.

Provoxis does not sell Customer Personal Data and does not use it for advertising or for its own commercial purposes. Provoxis does not use report content or reporter data to train, fine-tune, or evaluate machine-learning or artificial-intelligence models. Provoxis may create and use aggregated statistics about the operation of the service (such as request volumes and error rates) provided they contain no personal data and do not identify you, a reporter, or any other data subject.

Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms of Service; any cap on a party's aggregate liability in those terms applies to its liability under the Terms of Service and this DPA taken together, not as a separate additional cap. Nothing in this DPA or the Terms of Service limits either party's liability to a data subject or a supervisory authority under Data Protection Law, or any liability that cannot lawfully be limited.

Provoxis maintains a record of the processing it carries out on your behalf, as required by Article 30(2) of the UK and EU GDPR, and cooperates, on request, with a supervisory authority in the performance of its tasks in relation to that processing.

You enter into this DPA on your own behalf and, to the extent required by Data Protection Law, in the name and on behalf of your affiliates whose personal data is processed through your account. You remain the single point of contact for all instructions, requests, and communications with Provoxis under this DPA, and are responsible for the acts and omissions of those affiliates as if they were your own. Provoxis's total combined liability to you and all such affiliates is subject to section 17.

Notices under this DPA are given in writing. Provoxis gives notice to you by email to your account administrators, or through the product; you give notice to Provoxis at support@provoxis.com. A notice is treated as received on the day it is sent if that is a business day, and otherwise on the next business day. It is your responsibility to keep your registered contact details current.

Provoxis may update this DPA from time to time — for example to reflect a change in law, a new sub-processor, a change to the service, or a new transfer mechanism. For a change that does not materially reduce your rights or materially increase your obligations, Provoxis updates the "last updated" date above. For a change that does, Provoxis gives your account administrators at least 30 days' notice before it takes effect; if you notify Provoxis within that period that you object and the parties cannot agree an alternative, you may terminate the affected service on written notice before the change takes effect, and Provoxis will refund any prepaid fees covering the period after termination. Continued use of the service after a change takes effect is acceptance of it. A change required by law takes effect on the date the law requires.

This DPA takes effect when you accept the Terms of Service and continues for as long as Provoxis processes Customer Personal Data for you. Section 14 (return and deletion), section 17 (liability), and any provision that by its nature is intended to survive, survive termination until they have been fully performed.

This DPA is governed by the law that governs the Terms of Service, and the same courts have jurisdiction, except that where the SCCs apply under section 11(b) their own governing-law and forum clauses prevail for the matters they cover. Nothing in this section deprives a data subject of the protection of the mandatory law of their country of residence.

You warrant, for as long as you use the service, that: you have established and operate your whistleblowing reporting channel in accordance with Data Protection Law and the national law implementing the Whistleblowing Directive that applies to you; you have a valid lawful basis for the processing you instruct Provoxis to carry out, including for any special-category or criminal-offence data a report may contain; you have carried out any data protection impact assessment the law requires of you before bringing your channel into use; and you have given the people who may use your channel — reporters, and where required the subjects of and witnesses to a report — the information about the processing that Articles 13 and 14 of the UK and EU GDPR require, including that Provoxis acts as your processor. You are responsible for the configuration choices, retention settings, role assignments, and legal holds your administrators make, and for keeping your account's administrator and contact details current so that the notices this DPA provides for reach you. Provoxis relies on these warranties in providing the service.

This section applies only where, and to the extent that, Customer Personal Data is subject to a United States state privacy law such as the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). For that data Provoxis acts as your "service provider" (or "processor" where that term is used), not as a "third party". Provoxis processes that data only to provide the service under your instructions and for no other purpose; does not "sell" or "share" it; does not retain, use, or disclose it outside the direct business relationship with you or for any purpose other than the service; and does not combine it with personal information from another source except as a permitted business purpose allows. Provoxis will tell you if it determines that it can no longer meet its obligations under the applicable law, and you may take reasonable steps to stop and remediate any unauthorised processing. Provoxis certifies that it understands and will comply with the restrictions in this section. Nothing in this section makes Provoxis the controller or "business" for that data, or extends a United States state law to processing that the law does not by its own terms govern.

A. Parties and roles. The Controller is the Customer: the organisation identified in the Provoxis account registration, acting as controller of the report content and reporter data submitted through its reporting channel. The Processor is Provoxis Ltd, company number 17472067, registered office Grosvenor House, 3 Chapel Street, Congleton, England, CW12 4AB, acting as the Customer's processor for that data. Contact points: for the Customer, its account administrators as recorded in the account; for Provoxis, support@provoxis.com. B. Description of the processing. Categories of data subjects: people who submit a report through a tenant's reporting channel (reporters), whether identified or anonymous; people named or described in a report (including the subject of an allegation and any witnesses); and the tenant's own administrators and case handlers, to the extent their actions on a case are recorded. Categories of personal data: the free-text content of a report; optional evidence attachments; an anonymised audio recording where the oral channel is used; messages exchanged between a reporter and a case handler; case metadata (reference code, category, status, timestamps, SLA clocks); and any identity or contact details a reporter chooses to provide. Special categories of personal data (Article 9): a report may, by its nature, reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health data, or data concerning a person's sex life or sexual orientation, and — because the oral channel captures a person's voice — may include biometric data; personal data relating to criminal convictions and offences or related allegations (Article 10) may also be processed. The safeguards applied to that data are in Annex II. Frequency of processing: continuous, for the duration of the subscription. Nature and purpose: receiving, acknowledging, triaging, investigating, and responding to reports of wrongdoing under the Customer's whistleblowing programme and the Whistleblowing Directive or equivalent national law, and retaining the resulting records for the periods required. Duration: the term of the subscription plus the return-and-deletion period in section 14, subject to the retention rules in the Privacy Policy and to any retention limits imposed by the national law implementing the Whistleblowing Directive that applies to the Customer. C. Competent supervisory authority. Where the SCCs apply under section 11(b), the competent supervisory authority is that of the EU member state in which the Customer is established or, where the Customer has designated a representative under Article 27 of the EU GDPR, that of the member state of the representative; where the Customer is not established in the EU and has no such representative, the supervisory authority of the member state in which Provoxis's own Article 27 representative ([GDPR ART. 27 EU REPRESENTATIVE — NOT YET APPOINTED]) is established.

Data residency and isolation: each tenant is pinned at provisioning to a single region and routed there at the DNS and edge layer; application servers, database, cache, queue workers, and object storage are a complete, independent stack per region, and report data is never routed through or replicated into another region. Encryption: report narrative and any reporter identity fields, together with the reporter's own optional notification address, are encrypted at rest at the application layer; evidence files and audio recordings are encrypted at rest with a per-tenant data-encryption key wrapped by a regional key-management service; the database is additionally protected by disk-level encryption; all traffic to and from the service is encrypted in transit with TLS. Access control: every user is a named individual account, authenticated per tenant; report content is visible to any authenticated member of the tenant's own team once a report is submitted, with case assignment, legal hold, manual erasure, and access-control changes restricted to the tenant's administrators, while day-to-day case-status and retention-tier changes are available to any authenticated team member. A report submitted anonymously captures no identity field at all — not merely a hidden one — so there is nothing to expose regardless of who views it. Personnel security: named individual accounts with multi-factor authentication on all Provoxis administrative access, least-privilege authorisation, no shared credentials, joiner/leaver process, and background checks on personnel with access to production to the extent lawful. Secure development: peer code review, dependency and static analysis scanning, change management, separated environments, and no production report content in development or test environments. Vulnerability management: regular patching, periodic vulnerability scanning, and at least annual third-party penetration testing of the platform, with material findings remediated on a risk-prioritised basis. Logging and monitoring: centralised infrastructure and application logging within the region and alerting on anomalous or privileged access. Auditability: an immutable audit log records every read of report content and every privileged action (legal hold set or released, manual erasure, retention or access-control change, audit-log export). Data minimisation: no identity field is required to submit a report; identifying metadata (EXIF/GPS, document author and revision history) is stripped from uploaded evidence server-side on upload, with no unscrubbed copy retained. Oral reports: audio is pitch- and formant-shifted in-house before storage; raw audio is never retained and no third-party transcription service is used. Incident response: a documented plan with defined roles, customer notification under section 9, and a post-incident review. Resilience and continuity: automated encrypted database backups per region with periodic restore testing; the service runs a single instance per region without automatic failover and gives no recovery-time or recovery-point commitment beyond backup-based recovery. Organisational: confidentiality obligations on all personnel, data-protection training, least-privilege access for support staff, and a documented sub-processor register kept in sync with production with contractual terms no less protective than this DPA.

The current authorised sub-processors, their purpose, and their processing locations are set out in the sub-processor registry below, which forms part of this Annex. As at the last-updated date of this DPA they are: Amazon Web Services (cloud hosting, encrypted evidence and audio storage, key management, and DNS; EEA processing in Frankfurt); Stripe (subscription billing and payment-card processing; primarily United States, under its own Standard Contractual Clauses and UK Addendum); and Mailgun (delivery of transactional email, from EU infrastructure, containing only case metadata and a link back into the product, never full report content). Changes are governed by section 7 and recorded in the "Changes to this list" log on the same page.

Questions about this DPA, or a request for a countersigned copy, can be sent to support@provoxis.com. Provoxis's Data Protection Officer is [DATA PROTECTION OFFICER — NOT YET APPOINTED / REQUIREMENT NOT YET DETERMINED]. Provoxis's representative in the European Union for the purposes of Article 27 of the EU GDPR is [GDPR ART. 27 EU REPRESENTATIVE — NOT YET APPOINTED].