Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between Monospace ("we", "Processor") and the customer or organisation using the Monospace platform ("you", "Controller"). It governs how Monospace processes Personal Data on your behalf in connection with your use of the Monospace service (the "Services").

This DPA is required by Article 28 of the UK GDPR and EU GDPR where you act as a data controller and Monospace acts as a data processor. It takes effect automatically on the date you begin using the Services for business purposes and remains in force for as long as Monospace processes Personal Data on your behalf.

If you need a countersigned copy of this DPA for your own records (for example, for your own auditors), email privacy@monospace.page and we'll return a signed PDF within five business days.

Terms defined in the UK GDPR and EU GDPR (including controller, processor, processing, personal data, data subject, and personal data breach) have the same meaning in this DPA.

For clarity:

• Controller — the customer, organisation, or end user deciding the purposes and means of processing Personal Data through the Services.
• Processor — Monospace, acting on the Controller's documented instructions.
• Sub-processor — any third-party processor engaged by Monospace to process Personal Data on the Controller's behalf (such as infrastructure or email providers).
• Personal Data — any information relating to an identified or identifiable natural person that is processed through the Services under the Controller's instructions.
• Applicable Data Protection Law — the UK GDPR, the EU GDPR, the UK Data Protection Act 2018, and any successor legislation.

In relation to Personal Data processed under this DPA, the Controller determines the purposes and means of the processing and Monospace acts solely as a processor on the Controller's behalf.

Both parties shall comply with their respective obligations under Applicable Data Protection Law. Nothing in this DPA relieves either party of their own direct obligations under Applicable Data Protection Law.

The scope of processing performed under this DPA is set out below.

Monospace shall:

• Process Personal Data only on the documented instructions of the Controller, including as set out in this DPA, the Terms of Service, and the Controller's configuration of the Services — except where required by law (in which case we will notify the Controller, unless prohibited from doing so);
• Immediately inform the Controller if, in our opinion, an instruction infringes Applicable Data Protection Law;
• Ensure all personnel authorised to process Personal Data are bound by confidentiality obligations and have received appropriate data protection training;
• Implement and maintain the security measures described in Section 6 and Annex I;
• Assist the Controller in fulfilling obligations under Articles 32–36 of the GDPR (security, breach notification, DPIAs, prior consultation) taking into account the nature of the processing and the information available to us;
• Make available to the Controller all information necessary to demonstrate compliance with Article 28 obligations;
• On request, provide reasonable assistance with data subject rights requests (see Section 9);
• Promptly notify the Controller of Personal Data Breaches (see Section 10);
• Delete or return all Personal Data at the end of the Services (see Section 11).

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

A more detailed description of the current technical and organisational measures is available in Annex I (available on request at privacy@monospace.page).

The Controller authorises Monospace to engage sub-processors to deliver the Services. We take reasonable steps to ensure each sub-processor is bound by written data-protection obligations equivalent to those in this DPA.

Current sub-processors:

We will give the Controller at least 30 days' notice of any new or replacement sub-processor before it begins processing, giving you an opportunity to object. If the Controller has reasonable data-protection grounds to object, we will work in good faith to address the concern or, if no resolution is reached, either party may terminate the Services in accordance with the Terms of Service.

Where processing involves the transfer of Personal Data outside the UK or the European Economic Area, Monospace ensures that an appropriate transfer mechanism is in place, including:

• Transfers to an adequate country under the UK Adequacy Regulations or EU Commission adequacy decision;
• The UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses;
• The European Commission's Standard Contractual Clauses (Modules 2 or 3 as applicable);
• Any other valid transfer mechanism recognised under Applicable Data Protection Law.

The Standard Contractual Clauses and the UK IDTA are hereby incorporated into this DPA by reference, with Monospace as "data importer" and the Controller as "data exporter" for any transfers where Monospace is outside the Controller's jurisdiction.

Monospace provides tooling within the Services that enables the Controller to respond to data-subject requests (access, rectification, erasure, restriction, portability, objection) without requiring our involvement in most cases.

Where the Controller cannot fulfil a request using the Services directly, we will assist with reasonable technical and organisational measures, taking into account the nature of the processing. Requests received by Monospace directly from data subjects about Controller data will be forwarded to the Controller without substantive response.

Monospace will notify the Controller without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data Breach affecting the Controller's Personal Data. The notification will include:

• The nature of the breach, including (where known) the categories and approximate numbers of data subjects and records concerned;
• The likely consequences of the breach;
• The measures taken or proposed to address the breach, including measures to mitigate adverse effects;
• The contact point at Monospace where further information can be obtained.

It is the Controller's responsibility to notify the relevant supervisory authority and, where required, affected data subjects.

On termination of the Services, or earlier on written request, Monospace will — at the Controller's choice — either delete or return all Personal Data processed on behalf of the Controller and delete existing copies, unless applicable law requires further storage.

Deletion from live systems occurs within 30 days. Encrypted backups are rotated and overwritten within a further 30 days. Personal Data retained for legal-obligation purposes (e.g. tax records) is isolated and deleted when the obligation expires.

The Controller may export their own data in machine-readable format at any time using the in-app export tooling prior to account deletion.

Monospace will make available to the Controller all information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and allow for and contribute to audits and inspections conducted by the Controller or an auditor mandated by the Controller.

In practice, we satisfy audit requests by providing:

• Our current information-security documentation and sub-processor list;
• Copies of third-party audit reports from our sub-processors where available;
• Written responses to reasonable security questionnaires;
• On-site inspections or live audits where reasonably necessary, on at least 30 days' notice and during business hours, at the Controller's cost.

Each party's liability under this DPA is subject to the liability cap and exclusions set out in the Terms of Service. Nothing in this DPA limits either party's liability to data subjects under Applicable Data Protection Law.

This DPA takes effect on the date the Controller begins using the Services for business purposes and remains in force for as long as Monospace processes Personal Data on the Controller's behalf. On termination, Section 11 (Return & Deletion) applies.

This DPA is governed by and construed in accordance with the laws of England and Wales. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

We may update this DPA to reflect changes in applicable law, sub-processor arrangements, or our security practices. For material changes we will give at least 30 days' notice via email or an in-app notice. Continued use of the Services after a change takes effect constitutes acceptance of the updated DPA.

For questions about this DPA, data-protection matters, or to request a countersigned copy: