Data Processing Agreement

1Parties

This Data Processing Agreement (“DPA”) is entered into between:

Patario Limited (Company No. 17023042), registered at South Wonston Farm House, South Wonston, Winchester, England, SO21 3HL (“Patario”, “Processor”); and
The Client organisation that has accepted the Patario Terms of Service (“Client”, “Controller”).

This DPA is incorporated by reference into the Terms of Service clause 14 and forms part of the contract between the parties. Acceptance of the Terms of Service constitutes acceptance of this DPA on behalf of the Client organisation. In the event of conflict between this DPA and the Terms of Service on privacy matters, this DPA takes precedence.

2Definitions

In this DPA, unless the context requires otherwise:

“Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, and “Processing” have the meanings given in UK GDPR.
“UK GDPR” means the UK General Data Protection Regulation as defined in the Data Protection Act 2018.
“Services” has the meaning given in the Terms of Service.
“Subprocessor” means any third party engaged by Patario to process Personal Data in connection with the Services.
“TOMs” means the technical and organisational measures described in clause 7 of this DPA.

3Subject matter, nature, and purpose of processing

The details of the processing carried out by Patario as processor on the Client’s behalf are as follows:

Particulars of processing (Art. 28(3))
Item	Detail
Subject matter	Processing of personal data of Client’s learners and administrators on the Patario compliance training platform.
Duration	For the term of the agreement between the parties under the Terms of Service, plus the 30-day post-termination data retention window.
Nature of processing	Storage, retrieval, transmission, organisation, and deletion of learner personal data in the course of delivering compliance training services.
Purpose	Delivery of online compliance training, learner record management, assessment scoring, certificate generation, and platform administration on the Client’s behalf.
Type of personal data	Name, email address, workspace role, course progress, module completion records, assessment results, Socratic tutor conversation records, authentication events. Incidentally: special category data that learners may input during tutor sessions (processed under Art. 9(2)(b)).
Categories of data subjects	Client’s employees and contractors enrolled as learners on the platform; Client’s administrators with workspace access.

4Patario’s obligations as processor

Patario shall, in its capacity as processor:

4.1Instructions

Process Personal Data only on the documented instructions of the Client, as set out in this DPA and the Terms of Service, unless required to do so by applicable law. Where Patario is required by law to process Personal Data other than in accordance with the Client’s instructions, Patario will notify the Client before such processing unless prohibited by law.
Notify the Client promptly if, in Patario’s opinion, an instruction infringes UK GDPR or any other applicable data protection law.

4.2Confidentiality

Ensure that all persons authorised to process the Personal Data are subject to appropriate confidentiality obligations.
Limit access to Personal Data to those personnel who require access to perform the Services.

4.3Security

Implement and maintain the technical and organisational measures described in clause 7 of this DPA, having regard to the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons.

4.4Subprocessing

Not engage any Subprocessor without the Client’s prior general written authorisation. The Client grants general authorisation for the Subprocessors listed in Schedule 1 of this DPA.
Give the Client at least 30 days’ written notice before adding or replacing any Subprocessor, giving the Client the opportunity to object on reasonable grounds relating to data protection.
Impose on each Subprocessor data protection obligations equivalent to those set out in this DPA by way of a binding written contract.
Remain fully liable to the Client for the performance of each Subprocessor’s obligations to the extent that the Subprocessor fails to fulfil its obligations.

4.5Data subject rights

Assist the Client, by appropriate technical and organisational measures and insofar as reasonably possible, to fulfil the Client’s obligations to respond to requests from data subjects exercising their rights under UK GDPR (including rights of access, rectification, erasure, restriction, portability, and objection).
Notify the Client without undue delay if Patario receives a data subject rights request directly relating to Personal Data processed on the Client’s behalf. Patario will not respond to such requests directly without the Client’s prior written authorisation, except to inform the data subject that their request has been forwarded to the Client.

4.6Personal data breaches

Notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Personal Data processed on the Client’s behalf.
Provide the Client with sufficient information to allow the Client to meet any obligations to report the breach to the ICO or notify affected data subjects, including: the nature of the breach; the categories and approximate number of data subjects and records affected; the likely consequences; and the measures taken or proposed to address the breach.
Co-operate with the Client and take such steps as are reasonably required to assist the Client in investigating, mitigating, and remedying any such Personal Data Breach.

4.7Data protection impact assessments

Provide reasonable assistance to the Client in carrying out data protection impact assessments and prior consultations with the ICO where required by Art. 35 and 36 UK GDPR, taking into account the nature of the processing and the information available to Patario.

4.8Deletion and return of data

On termination or expiry of the Terms of Service, make Personal Data available to the Client for export for a period of 30 days via the platform export function. After that 30-day window, Patario will securely delete all Personal Data processed on the Client’s behalf, except to the extent that applicable law requires continued retention.
On written request from the Client during the term, confirm in writing that deletion has been completed.

4.9Audit rights

Make available to the Client all information reasonably necessary to demonstrate compliance with the obligations in this DPA, upon written request with reasonable notice.
At MVP, audit rights are limited to documentation review. Patario will provide relevant policy documents, this DPA, and written responses to reasonable data protection questionnaires within 30 days of a written request. On-site audits are not available at this stage.
Patario may charge reasonable costs for responding to audit requests that are excessive or repetitive.

5Client’s obligations as controller

The Client confirms and warrants that:

It is the data controller of the Personal Data it provides to Patario and has the authority to instruct Patario to process it as set out in this DPA.
It has a lawful basis under UK GDPR Art. 6 (and where applicable Art. 9) for the processing of Personal Data it instructs Patario to carry out.
It has provided all necessary privacy information to data subjects (including learners) in accordance with Art. 13 and 14 UK GDPR, including information about Patario’s role as processor.
It will ensure that all data subjects whose Personal Data is processed under this DPA are aged 18 or over, consistent with the platform-wide age restriction in the Terms of Service.
Its instructions to Patario will at all times comply with applicable data protection law.
It will notify Patario promptly of any changes to its instructions that may affect Patario’s processing obligations.

6International transfers

Patario will not transfer Personal Data outside the UK or EU except as set out in Schedule 1 (Subprocessors). Where transfers to third countries occur, Patario will ensure an appropriate transfer mechanism is in place as required by UK GDPR Chapter V, as listed in Schedule 1.

7Technical and organisational measures

Patario implements and maintains the following categories of technical and organisational measures to protect Personal Data against unauthorised access, loss, destruction, or disclosure:

Access controls: Role-based access control (RBAC) with least-privilege principles. Super-admin access restricted to named personnel. Multi-factor authentication required for administrative access.
Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256) across all storage and compute infrastructure.
Network security: Infrastructure hosted on hardened cloud environments (Supabase / GCP). Network-level access controls and firewall rules in place.
Pseudonymisation: Learner activity records pseudonymised for analytics purposes. IP addresses hashed before storage.
Logging and monitoring: Authentication events, access logs, and admin actions logged with defined retention periods. Anomalous access patterns monitored.
Incident response: Personal Data Breach detection, assessment, and notification procedures in place. Client notification within 48 hours of confirmed breach.
Backup and recovery: Automated database backups with defined recovery point and recovery time objectives. Backup retention 7–35 days.
Supplier management: Subprocessors subject to data processing agreements with equivalent obligations. Subprocessor list maintained and subject to 30-day change notification.
Staff: All personnel with access to Personal Data subject to confidentiality obligations.

8Liability

Each party’s liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service clause 11, except that nothing in this DPA or the Terms of Service limits either party’s liability for:

Death or personal injury caused by negligence;
Fraud or fraudulent misrepresentation;
Any liability that cannot be limited or excluded under applicable law, including the Data Protection Act 2018.

9Term and termination

This DPA comes into force on the date the Client accepts the Terms of Service and remains in force for the duration of those Terms of Service. Termination of the Terms of Service automatically terminates this DPA, subject to the post-termination obligations in clause 4.8 (deletion and return of data).

10Governing law

This DPA is governed by the laws of England and Wales. Any disputes arising under this DPA are subject to the exclusive jurisdiction of the English courts.

11General

Order of precedence: In the event of conflict between this DPA and the Terms of Service on privacy matters, this DPA takes precedence.
Entire agreement on privacy: This DPA sets out the entire agreement between the parties with respect to the subject matter of data processing and supersedes all prior agreements on that subject.
Severability: If any provision of this DPA is found to be unenforceable, the remaining provisions continue in full force.
Updates: Patario may update this DPA from time to time to reflect changes in applicable law or processing activities. Patario will give the Client 30 days’ written notice of any material changes.

Schedule 1 Subprocessors

The following Subprocessors are authorised under clause 4.4 of this DPA as at the date of publication. The Client grants general authorisation for these Subprocessors by accepting the Terms of Service.

Authorised subprocessors
Subprocessor	Location	Purpose	Transfer mechanism
Supabase	EU (eu-west-1)	Database hosting and authentication	EU hosting — no transfer
Google Cloud Platform / Vertex AI	EU (europe-west4)	AI infrastructure and compute	EU hosting — no transfer
Stripe	United States	Payment processing	UK-US Data Bridge; IDTA
Brevo	EU	Email delivery	EU hosting — no transfer
Google Analytics 4	United States	Aggregate web analytics (consent-gated)	UK-US Data Bridge; SCCs with UK Addendum
Cookiebot	EU	Cookie consent management	EU hosting — no transfer

Patario will give the Client at least 30 days’ written notice of any addition to or replacement of the above Subprocessors. Notice will be given by email to the Client’s account email address on record.

Patario Limited
Registered in England and Wales, company number 17023042
South Wonston Farm House, South Wonston, Winchester, England, SO21 3HL
[email protected]