Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Opagio Ltd ("Processor", "we", "us") and the client ("Controller", "you") for the provision of the Opagio Intangibles services. This DPA is entered into pursuant to Article 28 of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the UK GDPR.

"Processing" means any operation performed on Personal Data, as defined in Article 4(2) of the UK GDPR.

"Data Subject" means the identified or identifiable natural person to whom the Personal Data relates.

"Sub-Processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

"Data Protection Laws" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and the Data (Use and Access) Act 2025, as amended from time to time.

2. Scope and Purpose of Processing

Subject Matter: The processing of Personal Data by the Processor on behalf of the Controller in connection with the provision of Opagio Intangibles.

Duration: The term of the service agreement between the parties, plus any retention period required by law or agreed in writing.

Nature and Purpose: The Processor processes Personal Data to provide the Opagio Intangibles services, which include productivity analysis, intangible asset valuation, growth forecasting, and related reporting and analytics capabilities for individual units of the Controller and the Controller's business as a whole. Aggregated reporting and analytics outputs are treated as Personal Data unless no individual can reasonably be identified from them, including by singling out within a small group; as a safeguard, workforce-derived groupings containing fewer than three individuals are suppressed on any output shared beyond the Controller.

Types of Personal Data: Employee names, job titles, departmental information, salary or compensation data (where provided for productivity analysis), performance metrics, and any other personal data uploaded to the platform by the Controller.

Categories of Data Subjects: Employees, contractors, and other personnel of the Controller whose data is uploaded to or processed within the platform. Where the Controller uses the Platform for a corporate group, Data Subjects may also include: employees of group entities whose names appear in uploaded financial data (e.g., payroll journals, expense reports), and beneficial owners or directors of group entities identified through publicly available corporate registry data (including GLEIF).

Automated Classification. The Processor shall process Personal Data through its Classification Engine to categorise financial data, generate analytical outputs, and produce decision-support information as part of the Platform services. This processing is performed using rule-based algorithms and, where deployed, proprietary machine learning models hosted within the Processor's infrastructure. For specific tasks that require large language model capabilities (such as summarisation, semantic search, structured extraction from unstructured materials, natural-language interpretation, and identifying and provisionally classifying a company's intangible assets from company research data), the Processor transmits limited, task-specific extracts of Personal Data to the AI Sub-Processors listed in Section 4 (currently Google LLC and Anthropic, PBC), each of which is bound by enterprise or paid-tier data-processing terms under which the provider does not use Controller data to train its general-purpose models, retains it for a limited period principally to detect and prevent misuse of its service and to meet legal obligations, and may permit its authorised personnel to review content flagged as potential misuse. The Processor does not transmit bulk Client Data or full general ledgers to these Sub-Processors. The Controller acknowledges that automated classification outputs are decision-support tools and do not constitute automated decision-making with legal or similarly significant effects within the meaning of Article 22 of the UK GDPR.

3. Obligations of the Processor

The Processor shall:

• Process Personal Data only on documented instructions from the Controller, unless required to do so by law, in which case the Processor shall inform the Controller of that legal requirement before processing (unless prohibited by law).
• Ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including: encryption of Personal Data at rest (AES-256) and in transit (TLS 1.2+); regular testing of security measures; access controls based on the principle of least privilege; daily automated backups with 7-day retention; point-in-time recovery (PITR) with a 7-day recovery window and near-zero recovery point objective (RPO); database-level delete protection; and authentication resilience with local JWT verification fallback.
• Assist the Controller in responding to requests from Data Subjects exercising their rights under Data Protection Laws.
• Assist the Controller in ensuring compliance with obligations relating to data protection impact assessments and prior consultation with the supervisory authority.
• At the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of services, and delete existing copies unless applicable law requires retention.
• Make available to the Controller all information necessary to demonstrate compliance with Article 28 of the UK GDPR and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.

4. Sub-Processors

The Controller provides general written authorisation for the Processor to engage Sub-Processors. The Processor shall:

• Maintain an up-to-date list of Sub-Processors, available upon request and published on our website.
• Inform the Controller of any intended changes concerning the addition or replacement of Sub-Processors, giving the Controller the opportunity to object to such changes within 14 days.
• Ensure that any Sub-Processor is bound by data protection obligations no less protective than those set out in this DPA.
• Remain fully liable to the Controller for the performance of the Sub-Processor's obligations.

Current Sub-Processors

5. International Data Transfers

The Processor's primary database is hosted in the Google Cloud eur3 multi-region, which stores data in Belgium and the Netherlands, with a replication witness in Finland. The Processor's application servers and file storage run in Google Cloud's Belgium region. Customer data held in the Processor's database and file storage is stored within the European Economic Area (EEA). Operational logs, which include IP addresses, may be stored outside the EEA. Some Sub-Processors listed above process limited categories of data outside the EEA, as set out below; those transfers are covered by the safeguards in this Agreement.

Certain Sub-Processors (Supabase, Stripe, Resend, Google and Anthropic) process limited categories of data in the United States (and, for Google and Anthropic, other countries where they operate) for authentication, payment processing, email delivery, and large language model processing respectively. The AI Sub-Processors (Google and Anthropic) process only task-specific extracts, not bulk Client Data, and operate under enterprise or paid-tier terms that prohibit training their general-purpose models on Controller data and limit retention principally to abuse prevention and legal obligations.

Where Personal Data is transferred outside the United Kingdom, the Processor shall ensure that appropriate safeguards are in place in accordance with Chapter V of the UK GDPR. This includes reliance on UK adequacy decisions, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as applicable. The Processor shall provide the Controller with at least 30 days' notice before changing the location of any processing activity.

6. Data Breach Notification

The Processor shall notify the Controller without undue delay, and in any event within 24 hours, after becoming aware of a Personal Data breach. The notification shall include:

• A description of the nature of the breach, including the categories and approximate number of Data Subjects and records concerned.
• The name and contact details of the Processor's data protection contact.
• A description of the likely consequences of the breach.
• A description of the measures taken or proposed to be taken to address the breach, including measures to mitigate its possible adverse effects.

7. Data Subject Rights

The Processor shall assist the Controller in fulfilling its obligations to respond to Data Subject requests under Data Protection Laws, including requests for access, rectification, erasure, restriction, portability, and objection. The Processor shall promptly inform the Controller if it receives a request from a Data Subject directly.

8. Audit Rights

The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller. Such audits shall be conducted with reasonable prior notice (at least 30 days) and during normal business hours, and shall not unreasonably disrupt the Processor's operations. The Controller may exercise this audit right no more than once per calendar year, unless an audit is triggered by a confirmed Personal Data breach or a request from a supervisory authority.

9. Data Deletion and Return

Upon termination of the service agreement, the Processor shall, at the Controller's election, return all Personal Data to the Controller in a structured, commonly used, machine-readable format (JSON or CSV) within 30 days, or securely delete all Personal Data within 60 days, and certify such deletion in writing. Automated daily backups are retained for 7 days on a rolling basis; deleted data will therefore be purged from backup systems within 7 days of deletion from the primary database. In all cases, deleted data shall be removed from all backup systems within 90 days of the deletion date. The Processor may retain copies where required by applicable law, but only for the minimum period and purpose required.

10. Liability

Each party's liability under this DPA shall be subject to the limitations and exclusions of liability set out in the service agreement between the parties, except that neither party may limit its liability for breaches of Data Protection Laws to the extent that such limitation is prohibited by applicable law.

11. Governing Law

This DPA shall be governed by and construed in accordance with the laws of England and Wales. Any disputes arising under this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

12. Contact

Data protection contact: privacy@opag.io

Data Protection Officer enquiries: dpo@opag.io

General enquiries: hello@opag.io

Our Privacy Lead is Tony Hillier; both privacy@opag.io and dpo@opag.io route to the Privacy Lead.

Opagio Ltd, registered in England & Wales, company number 13050381. VAT registration number 379077256.