Data Processing Agreement.

1. Parties and purpose

This Data Processing Agreement ("DPA") forms part of the agreement between Tinybox Creative Ltd, trading as BowerVault (Company No. 15747529, VAT No. GB470161908, registered office at Henleaze House Business Centre, 13 Harbury Road, Henleaze, Bristol, UK, BS9 4PN) ("the Processor", "we", "us") and the subscriber ("the Controller", "you") under the BowerVault Terms and Conditions.

It sets out how we process personal data on your behalf as part of providing the Service, specifically the data of your leads, the visitors who complete your Tool. It is intended to meet the requirements of Article 28 of the UK GDPR.

This DPA applies only to the data of your leads. It does not cover your own account data (your business details, login, billing), where we act as controller in our own right, as set out in the Terms and Conditions, clause 3.

If the Service is transferred to another company, as the Terms and Conditions, clause 30, allow, references to the Processor mean that company from the date of the transfer.

2. Roles and duration

2.1. You are the data controller for your leads' personal data. You decide to run the Tool, you receive the leads it produces, and you are responsible for how you use them afterwards.

2.2. We are the data processor. We process your leads' data only to provide the Service to you, on your instructions as set out in the Terms and Conditions and this DPA, and not for our own separate purposes.

2.3. Other than delivering the report a lead has asked for, and any email strictly necessary to do so, we will never contact your leads, for marketing or for any other purpose, at any point. We will never use their data for our own marketing, and we will never sell or share it. This is a standing commitment, not conditional on this DPA.

2.4. This DPA applies for as long as we process your leads' data, including the retention periods in section 6, and ends when that data has been deleted.

3. What data is processed

• Whose data. Your leads: members of the public who visit your website and complete your Tool. They do not have a BowerVault account.
• Name and email address. Collected from the lead at the end of the Tool. Used for personalising and delivering the report, and for recording the lead in your dashboard.
• Answers to the Tool's questions. Collected from the lead during the Tool. Used for calculating a score and tier, and for generating personalised report commentary. All questions are multiple choice from a fixed list; there are no free-text fields.
• Marketing consent record. Created when the lead ticks the consent box, which they must do before a report is produced. We store the date and time they agreed and a reference to the exact wording they were shown, so the consent can be evidenced afterwards. Both appear on the lead in your dashboard and in your CSV export.
• Generated report content. Produced by the Service. Delivered to the lead and to you, and held for your dashboard and CSV export.

We do not collect any data from your leads beyond what is needed to run the Tool and produce the report. Their IP address is checked by our bot protection and seen by our hosting provider's request logs and our application monitoring (section 5), but is not stored with their record. No special category data, as defined under the UK GDPR, is knowingly collected.

4. How we process it, step by step

1. A lead completes your Tool on your website. Their answers are submitted to our systems.
2. A score and tier are calculated using fixed rules. No third party is involved in this step, and no artificial intelligence is used in it.
3. The lead's answers and your brand context (not their name or email address) are sent to Anthropic to generate the report's written commentary.
4. The completed report is shown to the lead as soon as it is ready, and sent to them by email as a PDF, using BowerVault's own Brevo account (not any Brevo account you may separately connect yourself). If you have authenticated your own sending domain, that email is sent from your address rather than ours; it still passes through BowerVault's Brevo account.
5. You are notified by email of the new lead (name, email address, Tool, and time, not their answers, score, or tier), also sent via BowerVault's own Brevo account.
6. The lead's full answers, score, tier, consent record, and report remain available to you in your dashboard, and are exportable as a CSV file.
7. If you have separately connected your own Brevo account (an optional feature, entirely distinct from steps 4 and 5 above), the lead's name, email address, and any custom attributes you've configured are also sent to your own Brevo account, using your own API key. We do not send their score, tier, answers, consent record, or the report itself to your Brevo account.

5. Sub-processors

You give us general authorisation to use the sub-processors below. Each is listed with what it does, what data reaches it, and where it operates.

• Anthropic. Generates the written commentary in each lead's report. Receives the lead's answers and your brand context, not the lead's name or email address. Processed via Anthropic's API. Anthropic's commercial terms prohibit it from training its models on data submitted through its API. United States, under Anthropic's data processing addendum, which covers transfers from the UK with the Standard Contractual Clauses and the UK International Data Transfer Addendum.
• Brevo (BowerVault's own account). Sends the report PDF to your lead, and the notification email to you. Receives the recipient's name, email address, and the report content. European Union.
• Laravel Cloud. Hosts the application and the database, which hold your leads' names, email addresses, answers, consent records, and reports, and the daily backups of that database. United Kingdom.
• Cloudflare R2, through Laravel Cloud Object Storage. Holds uploaded brand assets such as your logo, and no lead data of any kind. No report document is stored: each one is produced at the moment it is needed. European Union. A separate, private storage bucket holds a list of deleted lead references (an internal reference number and a date, never a name or email address), used to keep deletions in force if a backup is ever restored. European Union.
• Cloudflare. Bot protection on the public-facing Tool, to stop automated abuse. Receives the visitor's IP address and a security challenge token. Global network.
• Laravel Nightwatch. Application performance and error monitoring, used to detect faults in the Service. Receives page addresses and the IP address of each request, database query statements (without the values in them), and error details including stack traces. It records that an email was sent and its subject, not who it was sent to. Capture of submitted form contents is disabled, so leads' answers, names, and email addresses are not routinely sent to it; they could appear incidentally within the detail of an error. European Union (Frankfurt).
• Stripe. Processes your subscription payment. Receives your business's name, email address, billing address, and card details, sent directly to Stripe rather than through us. This does not touch lead data and is listed for completeness.

5.1. Where a sub-processor is located or operates outside the UK, any transfer of data to it is made on a lawful basis, including reliance on UK adequacy regulations for transfers to the EU and EEA, or appropriate safeguards recognised under UK data protection law where adequacy does not apply.

5.2. Each sub-processor that handles your leads' data is bound by data protection obligations equivalent in substance to those in this DPA. We remain responsible to you for how our sub-processors handle your leads' data.

5.3. We will give you at least 30 days' notice, by email, before adding or replacing a sub-processor that handles your leads' data. If you object on reasonable data protection grounds, tell us within that period and we will try to address the concern. If we cannot, you may cancel your subscription as described in the Terms and Conditions, clause 9.

6. Where data is held and for how long

6.1. Your leads' data, meaning their names, email addresses, answers, consent records, and reports, is held in our database, hosted by Laravel Cloud in the United Kingdom. It is not stored outside the United Kingdom. Reports are produced at the moment they are needed rather than kept as files, so no report document is stored anywhere. The Cloudflare R2 storage described in section 5, in the European Union, holds uploaded brand assets only. The separate private bucket described there, also in the European Union, holds deleted lead references only.

6.2. A lead's record is deleted automatically two years after they complete the Tool, whether or not your subscription is still active.

6.3. After your subscription ends, your leads' data is retained for 90 days to allow you to reactivate or export it, then permanently and automatically deleted. Full detail is set out in the Terms and Conditions, clause 9.4.

6.4. Where both 6.2 and 6.3 apply, whichever falls first is the one that takes effect.

6.5. If you delete your account entirely (a distinct action from cancelling, as set out in the Terms and Conditions, clause 20), your leads' data is deleted immediately, not held for the 90-day window.

6.6. You may delete any individual lead at any time, which removes their name, email address, answers, consent record, and report immediately and permanently. See section 10.

6.7. Backups. Our database is backed up daily, and each backup is kept for 30 days. Every deletion described in this section takes effect on our live systems immediately. A backup taken before a deletion still holds that record until the backup expires, 30 days at most. Nothing is read from a backup in the meantime, and if a backup is ever restored, the Service deletes again every lead that had been deleted, automatically, using the references described in section 5.

7. Security measures

7.1. We maintain technical and organisational measures appropriate to the nature of the data processed. These include:

• isolation of each subscriber's data from every other subscriber's;
• encrypted connections throughout, and encryption of stored credentials such as your Brevo API key;
• rate limiting and bot protection on public-facing endpoints;
• two-factor authentication, required on every staff administrator account;
• an audit log of sign-ins, exports, deletions, and administrative actions;
• automatic alerts to us when a staff account signs in from an address it has not used before, or when an account exports or downloads leads in unusual volume;
• daily database backups, kept for 30 days.

7.2. Access to your leads' data by our staff is restricted to what is needed to operate and support the Service. Staff cannot sign in as you, and cannot read your leads' answers or reports. When resolving a failed report or CRM sync, they can see the name and email address of the lead concerned.

7.3. Everyone at or working for the Processor who can access your leads' data, including contractors, is bound by a written duty of confidentiality.

7.4. Further detail on our security practices is available on request.

8. Personal data breaches

8.1. If we become aware of a personal data breach affecting your leads' data, we will notify you without undue delay, and in any event within 72 hours of becoming aware of it.

8.2. The notice will describe, as far as we know at the time: the nature of the breach; the categories and approximate number of leads and records affected; the likely consequences; and the measures we have taken or propose to take. Where not all of this is available at once, we will send what we know within that time and the rest as soon as it is known.

8.3. We will send the notice to the email address on your account, and cooperate with you and provide the information you reasonably need to meet your own obligations, including any report to the Information Commissioner's Office and any communication to your leads. We will not contact your leads about a breach ourselves unless you ask us to.

8.4. We will record every personal data breach affecting your leads' data, including its effects and the action taken, whether or not it had to be reported.

8.5. Notifying you of a breach is not an admission of fault or liability.

9. Your instructions

9.1. We process your leads' data only as necessary to provide the Service, as described in this DPA and the Terms and Conditions, unless the law requires otherwise, in which case we will tell you first unless the law prevents it. We do not use it for any other purpose, including our own marketing, analytics unrelated to the Service, or any purpose benefiting a party other than you.

9.2. If we believe an instruction from you would breach data protection law, we will tell you.

9.3. If you believe we are processing your leads' data outside these instructions, please contact us at support@bowervault.co.uk.

10. Assisting with your own obligations

10.1. Since your leads are UK data subjects, you may receive requests from them to access, correct, or delete their data. Most of these you can action yourself, without contacting us:

• Access and portability: open the lead in your dashboard, or export your leads to a CSV file, which carries their answers, their report, and their consent record.
• Erasure: open the lead and use "Delete lead." This removes their name, email address, answers, consent record, and report immediately and permanently from our live systems, and from our backups within 30 days (section 6.7). If that lead has already been passed to your own Brevo account, you will need to delete them there as well, since that account is yours and we cannot reach it.

10.2. Correction of a lead's details, and anything else you cannot action from your dashboard, is handled by contacting us at support@bowervault.co.uk.

10.3. We will provide reasonable assistance to help you respond to a data subject request, a regulator's enquiry, a data protection impact assessment, or a prior consultation with the Information Commissioner's Office, where it relates to data we process on your behalf.

11. Information and audits

11.1. We will make available to you the information reasonably necessary to demonstrate that we meet our obligations under this DPA, including answers to reasonable written questions about our security and data handling.

11.2. Where that information is not enough to satisfy you, or a regulator requires it, we will allow and contribute to an audit by you or an auditor you appoint who is bound by confidentiality, on at least 30 days' written notice, no more than once in any 12 months unless following a personal data breach, and at your cost.

12. On termination

12.1. Following cancellation or deletion of your account, your leads' data is deleted as set out in section 6.

12.2. You may export your leads' data as a CSV file (Terms and Conditions, clause 14.4) at any time before it is deleted. This is how the data is returned to you: we do not otherwise send it.

12.3. We do not keep copies of your leads' data after deletion, other than in backups until they expire as described in section 6.7, or where the law requires us to keep it.

13. Liability and relationship to the Terms

This DPA forms part of, and is subject to, the BowerVault Terms and Conditions, including their limitation of liability (Terms and Conditions, clause 27), which applies to liability under this DPA. Nothing in this DPA expands our liability beyond what is set out there.

14. Changes to this DPA

14.1. We may update this DPA to reflect changes in the Service or in the law. Where a change is material, we will give you reasonable notice before it takes effect.

14.2. The date you accept this DPA, and the version you accepted, are recorded against your account.

Questions

If you have questions about this DPA or how we handle data, email support@bowervault.co.uk.