Data Processing Schedule

1. When this Schedule applies

1.1 This Schedule applies only where XPLORATECH processes personal data on your behalf, as your processor, while delivering an Order. It does not apply to personal data we process as a controller for our own purposes.

1.2 Where we are your processor. Personal data about your customers, suppliers, staff and other individuals that is contained in the information you share with us so that we can deliver your Audit: documents and files you upload, examples you show or describe in the Intake and on the Audit Call, and your answers to our follow-up questions. In this Schedule, this is Customer Personal Data.

1.3 Where we are a controller, and this Schedule does not apply. The personal data we use to run our relationship with you and the people we deal with at your business: contact details, portal accounts and sign-in, Orders, invoices and payments, bookings, correspondence, our record of the Audit Call as a record of what was discussed with the people taking part, and our security and administration records. Our Privacy Notice covers this.

1.4 Annex 1 sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

2. Your obligations

2.1 You are responsible for having a lawful basis to share Customer Personal Data with us, and for giving the individuals concerned any information the law requires about that sharing.

2.2 You will share only the Customer Personal Data reasonably needed for the Audit. Where a representative sample or a redacted copy is enough, you will use one.

2.3 You will not share special category data or criminal offence data with us unless we have agreed in writing beforehand that it is needed.

3. Our obligations

We will:

3.1 process Customer Personal Data only on your documented instructions, including as to transfers outside the UK, unless the law requires otherwise, in which case we tell you first unless the law prevents it. The Terms of Business, the Order and this Schedule are your instructions. We tell you straight away if we believe an instruction infringes data protection law;

3.2 make sure everyone we authorise to process Customer Personal Data is bound by confidentiality;

3.3 take the technical and organisational security measures in Annex 3;

3.4 engage other processors only as section 4 allows;

3.5 taking into account the nature of the processing, help you by appropriate measures to respond to requests from individuals exercising their rights;

3.6 help you meet your obligations on security, personal data breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to us;

3.7 notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information we have and then further information as it becomes available;

3.8 at the end of the processing, delete or return Customer Personal Data as section 6 sets out;

3.9 make available to you the information reasonably needed to demonstrate compliance with this Schedule, and allow for and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice.

4. Sub-processors

4.1 You give us general authorisation to use the sub-processors listed in Annex 2.

4.2 We will tell you before we add or replace a sub-processor of Customer Personal Data, giving you the opportunity to object.

4.3 We impose on each sub-processor data protection obligations that are in substance no less protective than those in this Schedule, and we remain responsible to you for their performance.

5. Transfers outside the UK

5.1 Customer Personal Data is stored in Amazon Web Services' London region (eu-west-2), including our database, which Neon hosts there.

5.2 Google, which records and transcribes the Audit Call, may process Customer Personal Data outside the UK. That processing is covered by Google's Cloud Data Processing Addendum, which we have accepted, including its terms for UK data.

6. Retention, deletion and return

6.1 You instruct us to keep Customer Personal Data for the periods in Annex 1, which follow our retention schedule, and to delete it at the end of those periods.

6.2 When an Order ends, you may ask us to return Customer Personal Data we still hold, or to delete it sooner than Annex 1 provides, unless the law requires us to keep it.

7. Liability

Each party's liability under this Schedule is subject to section 18 of the Terms of Business.

---

Annex 1: Details of the processing

Retention, counted from the date we complete your Audit:

Annex 2: Sub-processors of Customer Personal Data

No AI model provider processes Customer Personal Data at present.

Annex 3: Security measures

• Our systems run in Amazon Web Services' London region. Recordings, transcripts and uploaded files are kept in a private storage bucket with encryption at rest and public access blocked.
• Information is sent to and from our systems over encrypted connections (HTTPS).
• Customer portal sign-in uses a password and an authenticator app (multi-factor authentication). Staff sign-in also requires multi-factor authentication.
• Uploads go directly to the evidence store through short-lived, single-file upload links, and each file is checked against its declared type, size and fingerprint.
• Refunds, payments, cancellations and access changes are restricted to authorised approvers.
• Changes to Audit records are written to an append-only history, and each signed-in write is logged with who made it and when.
• Access to Customer Personal Data is limited to XPLORATECH staff who need it for your Audit.