Introduction
This Data Processing Addendum (“DPA”) supplements the agreement entered into between the Client identified in the Order Form and Ancep Ltd (“Ancep”) for the provision of the Ancep Service, comprising the terms of service at https://www.ancep.com/terms and any Order Form or such other terms as the parties may agree (the “Agreement”), in relation to the transfer and processing of Covered Data in connection with the provision of the Ancep Service.
1. Definitions
1.1Capitalised terms used but not defined within this DPA will have the meaning set forth in the Agreement. The following capitalised terms used in this DPA will be defined as follows:
“Adequate Jurisdiction” means the UK, EEA or a country or territory deemed to provide adequate protection for the rights and freedoms of individuals, as set out in: (a) the Data Protection Act 2018 or regulations made by the UK Secretary of State under the Data Protection Act 2018; and (b) with respect to Data Subjects in the EEA, a decision of the European Commission.
“Anonymised Data” means data created using Covered Data that cannot reasonably be linked to such Covered Data, directly or indirectly.
“Applicable Data Protection Laws” means all applicable laws, rules, regulations, and governmental requirements relating to the privacy, confidentiality, or security of Personal Data, as they may be amended or otherwise updated from time to time, including (without limitation): the GDPR and the US Data Protection Laws.
“AI Inputs” means data, text, files, or other content submitted to the Ancep Service by or on behalf of the Client or Authorised Users for processing by the Ancep Service.
“Approved Addendum” means the template addendum, version B.1.0 issued by the UK Information Commissioner under S119A(1) Data Protection Act 2018 and laid before the UK Parliament on 2 February 2022, as it may be revised according to Section 18 of the Approved Addendum.
“CCPA” means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended, including its implementing regulations and the California Privacy Rights Act of 2020.
“Controller Purposes” means: (a) undertaking internal research and development to develop, test, improve and alter the functionality of the Ancep Service and machine learning model performance; (b) creating anonymised datasets for training or evaluation of the Ancep Service; and (c) administering the Client’s relationship with Ancep under the Agreement.
“Covered Data” means Personal Data that is: (a) contained in the Client Data and the Outputs; or (b) obtained, developed, produced or otherwise Processed by Ancep, or its agents or subcontractors, for the purposes of providing the Ancep Service, in each case as further described in Schedule 1.
“Data Subject” means a natural person whose Personal Data is Processed.
“EEA” means the European Economic Area.
“GDPR” means Regulation (EU) 2016/679 (the “EU GDPR”) or, where applicable, the “UK GDPR”, as defined in section 3 of the Data Protection Act 2018.
“Insurance Submission Data” means Covered Data that is necessarily included in Client Data for the purpose of processing insurance submissions, placements, quotes, or related insurance broking activities, which may include categories of data that would otherwise constitute Prohibited Personal Data.
“Outputs” means the results, analyses, responses, or other content generated by the Ancep Service in response to AI Inputs.
“Personal Data” means any data or information that: (a) is linked or reasonably linkable to an identified or identifiable natural person; or (b) is otherwise “personal data,” “personal information,” “personally identifiable information,” or similarly defined data or information under Applicable Data Protection Laws.
“Personnel” means employees, workers, contractors, agents, and other individuals engaged by a party in connection with the Agreement.
“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether by automated means or otherwise. “Process”, “Processes” and “Processed” will be interpreted accordingly.
“Prohibited Personal Data” means: (a) Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, criminal convictions and any other special categories of Personal Data identified in Article 9 of the GDPR or Personal Data that is otherwise sensitive Personal Data under Applicable Data Protection Laws; (b) biometric identifiers or templates; (c) financial information (including, without limitation, billing information and cardholder or sensitive authentication data, as those terms are defined under the Payment Card Industry Data Security Standard); (d) personally identifiable financial information, as defined by and subject to the Gramm-Leach-Bliley Financial Modernization Act of 1999; (e) national identification numbers (including, without limitation, Social Security Numbers, Social Insurance Numbers, driver’s license or passport numbers or other governmentally-issued identification numbers); (f) information relating to individuals under the age of 13; (g) education records, as defined under the Family Educational Rights and Privacy Act of 1974; (h) protected health information as defined by, and subject to, the Health Insurance Portability and Accountability Act — save in each case to the extent that such data constitutes Insurance Submission Data, in which case clause 5.2A shall apply.
“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to (including unauthorised internal access to), Covered Data.
“Standard Contractual Clauses” or “SCCs” means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.
“Sub-processor” means a Processor appointed by another Processor to Process Personal Data on its behalf.
“US Data Protection Laws” means all applicable federal and state laws, rules, regulations, and governmental requirements relating to data protection, the Processing of Personal Data, privacy and/or data protection in force from time to time in the United States, including (without limitation): the CCPA, the Virginia Consumer Data Protection Act, Code of Virginia Title 59.1 Chapter 52 § 59.1-571 et seq., the Colorado Privacy Act, Colorado Revised Statute Title 6 Article 1 Part 13 § 6-1-1301 et seq., the Utah Consumer Privacy Act, Utah Code § 13-6-101 et seq., Connecticut Senate Bill 6, An Act Concerning Personal Data Privacy and Online Monitoring (as such law is chaptered and enrolled).
1.2The terms “controller”, “processor”, “business” and “service provider” have the meanings given to them in the Applicable Data Protection Laws.
2. Interaction with the Agreement
2.1This DPA is incorporated into and forms an integral part of the Agreement. This DPA supplements and (in case of contradictions) supersedes the Agreement with respect to any Processing of Covered Data.
3. Role of the Parties
The parties acknowledge and agree that:
(a)save as set out in paragraph 3(b), Ancep acts as a processor or service provider in the performance of its obligations under the Agreement and this DPA and Client acts as a controller or business; and
(b)for the purposes of the GDPR, Ancep acts as a controller with respect to any Processing of Covered Data for the Controller Purposes.
4. Processing of Personal Data
4.1The details of the Processing of Personal Data under the Agreement and this DPA (including subject matter, nature and purpose of the Processing, categories of Personal Data and Data Subjects) are described in the Agreement and in Schedule 1 to this DPA.
(a)comply with its obligations under Applicable Data Protection Laws and any restrictions on Processing Covered Data in the Agreement;
(b)only Process the Covered Data:
(i)for the Controller Purposes; and
(ii)otherwise on behalf of and under the instructions of the Client, unless Processing is required to comply with applicable law in the UK (in which case Ancep shall inform the Client of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest).
4.3The Agreement and this DPA shall constitute the Client’s instructions for the Processing of Covered Data. Client may issue further written instructions in accordance with this DPA.
4.4Without limiting the foregoing, Ancep is prohibited from:
(a)selling Covered Data or otherwise making Covered Data available to any third party for monetary or other valuable consideration;
(b)sharing Covered Data with any third party for cross-context behavioural advertising;
(c)retaining, using, or disclosing Covered Data for any purpose other than for the business purposes specified in the Agreement;
(d)retaining, using, or disclosing Covered Data outside of the direct business relationship between the parties; and
(e)combining Covered Data with Personal Data that Ancep receives from or on behalf of another person or persons, or collects from its own interaction with the Data Subject.
(a)provide Client with information to enable Client to conduct and document any data protection assessments required under Applicable Data Protection Laws, including data protection impact assessments under Article 35 of the GDPR; and
(b)promptly inform Client if, in its opinion, an instruction from Client infringes Applicable Data Protection Laws.
4.6Data Protection Impact Assessments. Ancep shall provide reasonable assistance to the Client in connection with any data protection impact assessment that the Client is required to carry out under Applicable Data Protection Laws in relation to the Client’s use of the Ancep Service, including by providing information about Ancep’s Processing activities, technical and organisational measures, and the risks associated with the Processing.
5. Client Obligations
5.1Client shall comply with its obligations as a controller, business or equivalent term under the Applicable Data Protection Laws, and shall:
(a)provide such information to Data Subjects regarding the Processing of their Covered Data in connection with the Client’s use of the Ancep Service as required under Applicable Data Protection Laws; and
(b)to the extent required for the lawful Processing of Covered Data under Applicable Data Protection Laws, obtain valid consents from Data Subjects for such Processing in the form required under Applicable Data Protection Laws.
5.2Client shall not (and shall ensure that Authorised Users do not) include any Prohibited Personal Data in the Client Data, except as permitted under clause 5.2A.
5.2AInsurance Submission Data. Where the Client’s use of the Ancep Service necessarily involves Processing Insurance Submission Data, the Client shall ensure it has a lawful basis under Applicable Data Protection Laws for the Processing of such data. Ancep shall apply enhanced security measures to Insurance Submission Data, including encryption at rest and in transit, restricted access controls, and audit logging.
5.3Ancep will not be liable to Client, whether in contract, tort (including negligence) or restitution, or for breach of statutory duty or misrepresentation, or otherwise, for any loss arising under or in connection with Ancep’s Processing of Covered Data to the extent such loss was caused (in whole or in part) by Client’s failure to comply with its obligations under clause 5.1 or clause 5.2.
6. Confidentiality and Disclosure
(a)limit access to Covered Data to personnel who have a business need to have access to such Covered Data; and
(b)ensure that such personnel are subject to obligations at least as protective of the Covered Data as the terms of this DPA and the Agreement, including duties of confidentiality with respect to any Covered Data to which they have access.
7. Sub-Processors
7.1Ancep may Process Covered Data anywhere that Ancep or the Authorised Sub-processors maintain facilities, subject to the remainder of this clause 7 and the international transfer provisions in clause 13.
7.2Client grants Ancep general authorisation to engage any of the Sub-processors listed in Schedule 3, as amended in accordance with clause 7.4 (the “Authorised Sub-processors”), to Process Covered Data.
(a)enter into a written agreement with each Authorised Sub-processor imposing data protection obligations that, in substance, are no less protective of Covered Data than Ancep’s obligations under this DPA; and
(b)remain liable for each Authorised Sub-processor’s compliance with the obligations under this DPA.
7.4Ancep shall provide Client with at least thirty (30) days’ notice of any proposed changes to the Authorised Sub-processors. Client shall notify Ancep if it objects to the proposed change to the Authorised Sub-processors by providing Ancep with written notice of the objection within thirty (30) days after Ancep has provided notice to Client of such proposed change (an “Objection”).
7.5In the event Client submits an Objection to Ancep, Ancep and Client shall work together in good faith to find a mutually acceptable resolution to address such Objection. If Ancep and Client are unable to reach a mutually acceptable resolution within a reasonable timeframe, which shall not exceed thirty (30) days, Client may terminate the portion of the Agreement relating to the Services affected by such change by providing written notice to Ancep. If Ancep cannot provide sufficient evidence that a new sub-processor complies with the obligations under this Agreement and Applicable Data Protection Laws, Ancep shall refrain from engaging such sub-processor.
8. Data Subject Rights Requests
8.1Ancep will notify Client without undue delay, and in any event within five (5) business days, of any request received by Ancep or any Authorised Sub-processor from a Data Subject to assert their rights in relation to Covered Data under Applicable Data Protection Laws (a “Data Subject Request”).
8.2Other than in respect of any Processing of Covered Data for the Controller Purposes, Client will have sole discretion in responding to the Data Subject Request, and Ancep shall not respond to the Data Subject Request, save that Ancep may advise the Data Subject that their request has been forwarded to Client.
8.3Ancep will provide Client with reasonable assistance as necessary for Client to fulfil its obligation under Applicable Data Protection Laws to respond to Data Subject Requests.
9. Security
9.1Ancep will implement and maintain appropriate technical and organisational data protection and security measures designed to ensure security of Covered Data, including, without limitation, protection against unauthorised or unlawful Processing and against accidental loss, destruction, or damage of or to Covered Data.
9.2When assessing the appropriate level of security, Ancep shall take into account the nature, scope, context and purpose of the Processing as well as the risks that are presented by the Processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Covered Data.
9.3Ancep shall implement and maintain the following security measures:
(a)Regular encrypted backups of all Covered Data with secure off-site storage;
(b)Industry-standard encryption for Covered Data, both at rest and in transit;
(c)Up-to-date malware and virus protection systems across all relevant infrastructure components;
(d)Regular security awareness training for all personnel with access to Covered Data, covering data protection, security best practices, and threat identification; and
(e)Logical segregation of Client Data such that no Client Data is accessible to, or visible to, any other customer of Ancep in identifiable form.
9.4Ancep shall review and update these security measures at least annually to ensure they remain appropriate and effective.
10.1Ancep shall notify Client promptly if Ancep determines that it can no longer meet its obligations under Applicable Data Protection Laws.
10.2Client may take reasonable and appropriate steps to:
(a)ensure that Ancep uses Covered Data in a manner consistent with Client’s obligations under Applicable Data Protection Laws; and
(b)upon reasonable notice, stop and remediate unauthorised use of Covered Data.
(a)Upon Client’s written request (not more than once per twelve (12) month period, unless a Security Incident has occurred or a supervisory authority requires an additional audit), Ancep shall make available to the Client information reasonably necessary to demonstrate compliance with this DPA and shall permit and contribute to audits, including inspections, conducted by the Client or an independent third-party auditor mandated by the Client.
(b)The Client shall provide Ancep with at least thirty (30) days’ prior written notice of any audit request, and the parties shall cooperate in good faith to agree the scope, timing, and duration of the audit so as to minimise disruption to Ancep’s operations.
(c)Ancep may satisfy an audit request by providing the Client with: (i) a current SOC 2 Type II report (or equivalent third-party audit report) covering the systems and processes used to Process Covered Data; and (ii) written responses to reasonable follow-up questions from the Client relating to such report. Where the Client reasonably determines that such report does not adequately address its audit request, Ancep shall permit an on-site or remote audit as described in clause 10.3(a).
(d)The Client shall bear its own costs in connection with any audit. Where an audit reveals a material non-compliance by Ancep with this DPA, Ancep shall bear the reasonable costs of that audit and shall promptly remediate the non-compliance at its own expense.
11. Security Incidents
11.1Ancep shall notify Client in writing without undue delay, and in any event within forty-eight (48) hours, after becoming aware of any Security Incident.
11.2Ancep shall take reasonable steps to contain, investigate, and mitigate any Security Incident, and shall send Client timely information about the Security Incident, to the extent known to Ancep or as the information becomes available to Ancep, including, but not limited to, the nature of the Security Incident, the measures taken to mitigate or contain the Security Incident, and the status of the investigation.
11.3Ancep shall provide reasonable assistance with Client’s investigation of any Security Incidents and any of Client’s obligations in relation to the Security Incident under Applicable Data Protection Laws, including any notification to Data Subjects or supervisory authorities.
11.4Ancep’s notification of or response to a Security Incident under this clause 11 shall not be construed as an acknowledgement by Ancep of any fault or liability with respect to the Security Incident.
12. Term, Deletion and Return
12.1This DPA shall commence on the Commencement Date and, notwithstanding any termination of the Agreement, will remain in effect until, and automatically expire upon, Ancep’s deletion or anonymisation of all Covered Data as described in this DPA.
(a)if requested to do so by Client within sixty (60) days of expiry of the Agreement (the “Retention Period”), provide a copy of all Covered Data in such commonly used format as requested by Client, or provide a self-service functionality allowing Client to download such Covered Data; and
(b)on expiry of the Retention Period, delete all copies of Covered Data Processed by Ancep or any Authorised Sub-processors, other than: (i) any Covered Data Processed for the Controller Purposes, which shall be deleted within twelve (12) months of expiry of the Retention Period; and (ii) any Anonymised Data created in accordance with the Controller Purposes, which may be retained indefinitely.
13. International Transfers of Personal Data
13.1Ancep shall not transfer any Covered Data to a recipient outside of the UK unless:
(a)the recipient is in an Adequate Jurisdiction; or
(b)the transfer is governed by an agreement incorporating:
(i)standard data protection clauses approved under Section 119A of the Data Protection Act 2018; and
(ii)with respect to Data Subjects in the EEA, the Standard Contractual Clauses.
13.2The Approved Addendum shall, as further set out in Schedule 2, apply to the transfer of any Covered Data from Ancep to Client, and form part of this DPA, to the extent that the Client is not in an Adequate Jurisdiction.
13.3The parties agree that execution of the Agreement shall have the same effect as signing the Approved Addendum.
14. Anonymised Data
14.1If Ancep receives Anonymised Data from or on behalf of Client, Ancep shall:
(a)take reasonable measures to ensure the information cannot be associated with a Data Subject;
(b)publicly commit to Process the Anonymised Data solely in anonymised form and not to attempt to reidentify the information; and
(c)contractually obligate any recipients of the Anonymised Data to comply with the foregoing requirements and Applicable Data Protection Laws.
15. General
15.1The parties hereby certify that they understand the requirements in this DPA and will comply with them.
15.2The parties agree to negotiate in good faith any amendments to this DPA as may be required in connection with changes in Applicable Data Protection Laws.
Schedule 1 – Details of Processing
Categories of Data Subjects
- Authorised Users
- End Customers (individual purchasers, subscribers or other consumers of the Controller’s goods and services)
Categories of Personal Data
- Name and contact details (email address and phone number)
- Role and position at Client
- Content of communications from Personnel to Ancep (including requests and responses relating to IT support)
- Data relating to the Authorised User’s use of the Ancep Service (including log data)
- Where applicable, Insurance Submission Data as permitted under clause 5.2A
Special Categories of Personal Data
None, unless the Client is Processing Insurance Submission Data under clause 5.2A.
Frequency of Transfers (where applicable)
Continuous.
Nature of the Processing
Collection, storage, deletion, rectification, aggregation, automated analysis and classification by AI systems.
Purposes of the Processing
Provision of the Ancep Service for the Client, namely receiving and processing AI Inputs and generating and providing access to Outputs.
Retention Period
The duration of the Agreement, subject to the Retention Period specified in clause 12.2.
Sub-processors
As set out in Schedule 3.
Schedule 2 – Approved Addendum
With respect to any transfers referred to in clause 13, the Approved Addendum shall be completed as follows:
Exporter
Parties’ details: Ancep Ltd
Contact person: Gagan Khurana
Importer
Parties’ details: The Client (as further identified in the Order Form)
Contact person: The Client Contact identified in the Order Form
Addendum EU SCCs
The Approved EU SCCs, including the Appendix Information, and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum:
Module: 2 (Controller to Processor)
Module in operation: Yes
Clause 7 (Docking Clause): Yes
Clause 11 (Option): No
Clause 9a (Prior Authorisation or General Authorisation): General Authorisation
Clause 9a (Time period): 30 days
Is personal data received from the Importer combined with personal data collected by the Exporter? Yes
“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:
Annex 1A: List of Parties
Annex 1B: Description of Transfer – as set out in Schedule 1 to this DPA
Ending this Addendum when the Approved Addendum changes
Which Parties may end this Addendum as set out in Section 19: neither Party.
Schedule 3 – Authorised Sub-Processors
The sub-processors in Part A apply to all deployments. Part B sub-processors apply only to the extent the corresponding module is enabled for the Client’s deployment, as recorded in the applicable Order Form or Statement of Work. AI inference is performed exclusively via Amazon Bedrock; model providers (including Anthropic) have no access to Client Data under Bedrock’s Model Deployment Account architecture and are not sub-processors.
Part A – Core (all deployments)
| Name of Sub-processor | Description of Processing | Data Location |
|---|
| Amazon Web Services | Cloud infrastructure for document storage, application hosting, data processing, AI inference (Amazon Bedrock, EU cross-region inference profiles), optical character recognition, and operational logging | UK / EEA |
| Clerk, Inc. | Authentication metadata only for authorised users (name, work email address, sign-in session and device metadata). Clerk does not process, store or have access to Client Data (documents, messages, meeting content or other content submitted to the Service). | US (transfers subject to the UK Addendum and Approved EU SCCs at Schedule 2) |
| Sentry (Functional Software, Inc.) | Error monitoring and application performance tracking. Payloads are scrubbed at source to exclude Client Data and personal data before transmission; Sentry does not receive personally identifiable information. | EU (Frankfurt) |
| PostHog (Hiberly Ltd.) | Product analytics and usage tracking. Event payloads are scrubbed at source to exclude Client Data and personal data before transmission; PostHog does not receive personally identifiable information. | EU (eu-central-1, Frankfurt) |
Part B – Deployment Modules
The following sub-processors apply only where the corresponding module is enabled for the Client’s deployment.
| Module | Name of Sub-processor | Description of Processing | Data Location |
|---|
| Email & calendar capture | Unified.to | Integration layer for capture of Client email and calendar content from authorised user accounts | EU |
| Meeting capture | Recall.ai | Meeting recording bots; recorded audio, video and transcripts of meetings authorised users have elected to record | EU |
| Messaging capture | Meta Platforms Ireland Ltd. (WhatsApp Business API) | Message content and metadata delivered via WhatsApp Business webhooks | EU / US |
