Data Processing Addendum

Where any Business Data is included in information you provide to the Service (for example, in describing an AI system used by one of your clients, or in a support ticket), you are the data controller: you decide why and how that data is collected and used in your own business, and you are responsible for having a lawful basis to have it processed. ComplyMark is your data processor for that data, to the extent we process it at all, and we process it only on your documented instructions (which include the features you use and the information you choose to enter) and only to provide the Service to you.

Subject matter: hosting and processing Business Data within the Service's account, ticketing, and inventory features. Duration: for as long as you maintain a ComplyMark account, and thereafter only as described in Section 7. Purpose: solely to provide, maintain, and improve the Service for you — never to build a profile of any third party for our own purposes, and never to sell Business Data.

As explained in Privacy Policy Section 1, your AI-system inventory, classification answers, generated disclosures, and compliance register — the features most likely to reference a client's AI system by name — are stored on our servers, tied to your organisation, alongside account data and support-ticket content. This DPA applies to all of it.

• We process Business Data only on your instructions, as reflected in the Service's features.
• We impose confidentiality obligations on personnel who can access Business Data.
• We implement the technical and organisational security measures described in our Privacy Policy.
• We assist you, where reasonably possible, in responding to a data subject request concerning Business Data.
• We notify you without undue delay, and in any event within 72 hours of becoming aware, if we become aware of a personal data breach affecting Business Data.

We use the sub-processors listed in Section 11 of our Privacy Policy to provide the Service, which may include processing Business Data. By using the Service, you authorise this general use of sub-processors. We will give you at least 30 days' advance notice before appointing a new sub-processor that will materially affect the processing of Business Data, during which you may contact us to discuss alternatives if you object.

Business Data may be transferred to and processed in the United Kingdom and, via the sub-processors in Section 5, other countries including the United States. Where required, this is done under appropriate safeguards — such as the UK International Data Transfer Addendum or equivalent Standard Contractual Clauses — consistent with Section 7 of our Privacy Policy.

Business Data belongs to your organisation, so it is not deleted automatically when an individual user deletes their own account — see Privacy Policy Section 13. On your written request, we will delete or return the Business Data held on our servers (or anonymise it where deletion isn't possible), subject only to any narrow legal retention obligations that apply to ComplyMark itself.

On reasonable written request, we will provide you with information reasonably necessary to demonstrate compliance with this DPA. We do not currently offer on-site audits given the scale of the Service; if you have a specific compliance requirement that needs one, contact us to discuss it.

Questions about this DPA can be sent to privacy@complymark.io.