This Data Processing Agreement ("DPA") forms part of the agreement between Bainary Ltd (company number 16085415) ("Bainary") and the Firm under Bainary's Terms of Service at www.bainary.ai/terms (the "Terms"). It applies to personal data Bainary processes for the Firm through the Service. Terms defined in the Terms have the same meaning here. "UK GDPR", "personal data", "special category data", "personal data breach", "controller", "processor" and "restricted transfer" have the meanings in the UK GDPR and the Data Protection Act 2018. "Client Personal Data" means personal data within Customer Data.

1. Roles

1.1 The Firm is the controller of Client Personal Data. Bainary is its processor.

1.2 Bainary is a controller of personal data about the Firm's Users and contacts (account, billing, support and security data), which it handles under its privacy notice at www.bainary.ai/privacy. This DPA does not apply to that data.

2. Instructions

2.1 Bainary processes Client Personal Data only on the Firm's documented instructions, unless the law requires otherwise (in which case it will tell the Firm first where lawful). The Terms, any Order Form, this DPA and the Firm's use of the Service's features are the Firm's complete instructions. Additional instructions need Bainary's written agreement and may be charged for.

2.2 Bainary will tell the Firm if it believes an instruction breaches data protection law, and may suspend the processing concerned until it is resolved.

2.3 Bainary will not sell Client Personal Data, process it for its own purposes, or use it to train AI models. Creating and using System Data under the Terms is not processing for Bainary's own purposes in breach of this clause.

2.4 The Firm is responsible for the lawfulness of the processing it instructs, including having a lawful basis and any condition needed for special category and criminal offence data, and for giving its clients the information the law requires.

3. Staff

Bainary ensures that everyone it authorises to process Client Personal Data is bound by confidentiality and accesses it only as needed to provide, secure and support the Service.

4. Security

Bainary will maintain appropriate technical and organisational measures under Article 32 UK GDPR, including those in Schedule 2. Bainary may update its measures, provided the overall level of protection is not materially reduced.

5. Sub-processors

5.1 The Firm gives general authorisation for Bainary to use the sub-processors on its list at www.bainary.ai/subprocessors (the "List"). Schedule 3 summarises the List at the version date above.

5.2 Bainary will give at least 10 days' notice before adding or replacing a sub-processor, by updating the List and emailing the Firm's notices contact. The Firm may object in writing, on reasonable data protection grounds, within 30 days of the update; otherwise the change is accepted. If Bainary cannot resolve an objection, for example by offering a reasonable alternative, the Firm may terminate the affected Service by notice, and receive a refund of the price of its unused, unexpired credits, as its sole remedy.

5.3 Bainary will put in place a written contract with each sub-processor that imposes data protection obligations appropriate to the services it provides, and remains responsible to the Firm for each sub-processor's performance of those obligations, subject to the Terms.

6. International transfers

6.1 Client Personal Data is stored at rest in the UK (London). Some processing, including AI model processing, takes place outside the UK, as the List shows.

6.2 Bainary will make a restricted transfer only where it is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified) or by an appropriate safeguard under Article 46 UK GDPR, such as the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. Assistance

7.1 Taking into account the nature of the processing and the information available to it, Bainary will provide reasonable assistance to the Firm with requests from individuals exercising their rights, and with security, breach notification, data protection impact assessments and prior consultation with the ICO. The Service's features (viewing, exporting and deleting matters) are the main way the Firm meets these requests.

7.2 If Bainary receives a request from an individual about Client Personal Data, it will pass it to the Firm without undue delay and will not respond itself except to say it has done so.

7.3 Bainary may charge its reasonable costs for assistance beyond what the Service's features provide.

8. Personal data breaches

8.1 Bainary will notify the Firm without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data, by email to the Firm's notices contact.

8.2 The notice will describe, as far as then known, the nature of the breach, the categories and approximate numbers of individuals and records concerned, the likely consequences and the measures taken or proposed. Bainary will provide further information as it becomes available and take reasonable steps to contain and remedy the breach.

8.3 Notifying or responding to a breach is not an acknowledgment of fault or liability.

9. Retention, return and deletion

9.1 Uploaded documents and the text read from them are deleted when the application's filing run completes. The Firm can delete any matter, including its documents and extracted facts, at any time in the Service.

9.2 On termination of the agreement, or closure of an inactive account under the Terms, the Firm may ask for an export of its client files within 30 days. Bainary then deletes the remaining Client Personal Data within a further 60 days, unless the law requires it to be kept, and confirms deletion in writing on request.

9.3 Data in backups and logs is overwritten on the normal cycles of Bainary's providers and is not restored except for disaster recovery.

10. Audits

10.1 Bainary will make available the information reasonably necessary to demonstrate compliance with Article 28 UK GDPR. Bainary will first answer a written request by providing its security documentation, completed questionnaires or relevant third-party reports.

10.2 If that is not enough to meet a requirement of data protection law, the Firm may conduct an audit, or appoint an independent auditor bound by confidentiality, on at least 30 days' notice, no more than once in any 12 months (unless after a breach affecting the Firm or at a regulator's request), during business hours, without access to other customers' data, and at the Firm's cost (including Bainary's reasonable costs).

11. Liability and precedence

11.1 Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms, and counts towards the same cap.

11.2 If this DPA and the Terms conflict on the processing of personal data, this DPA prevails. Governing law and jurisdiction are as set out in the Terms.

Schedule 1: Processing details

Schedule 2: Security measures

1. Hosting and storage in London, with private document storage. Documents are served only to signed-in Users through authenticated routes, never by public URL.
2. Encryption in transit (TLS) and at rest. GOV.UK account passwords created by the Service are additionally encrypted at the application level.
3. Access control: sign-in required for all matter data; signed, HttpOnly session cookies; staff access limited to what is needed.
4. Agent controls: each filing run is isolated, with network access limited to the services it needs, and a technical guard stops the agent from signing, declaring, paying or submitting.
5. Deletion: documents and their text are deleted when filing completes; Users can delete matters at any time.
6. Operations: secrets held in the hosting platform's secret store; provider-managed backups; incidents handled under clause 8.

Schedule 3: Sub-processors

The current List is at www.bainary.ai/subprocessors. At the version date: