Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Customer", "controller") and BolderBrain ("BolderBrain", "processor") for the BolderBrain service.

Customer is the controller of personal data processed under the agreement. BolderBrain is the processor. If Customer is itself a processor, Customer warrants that it has authority from the relevant controller to appoint BolderBrain as a sub-processor on these terms.

This template must be completed and signed by both parties before it takes effect. Contact [email protected] to start that process.

• "Applicable Data Protection Law" means the GDPR, the UK GDPR, India's Digital Personal Data Protection Act 2023, and any other law that applies to the processing.
• "Personal Data", "Processing", "Data Subject", "Controller", "Processor", "Supervisory Authority" and "Personal Data Breach" have the meanings given in Applicable Data Protection Law.
• "Services" means the BolderBrain platform and related services provided under the agreement.
• "Sub-processor" means a third party engaged by BolderBrain to process Personal Data on behalf of Customer.
• "Security Incident" means a Personal Data Breach affecting Personal Data processed under this DPA.

BolderBrain will process Personal Data only to provide the Services, as described in Annex 1 and on Customer's documented instructions.

The duration of processing is the term of the agreement, unless otherwise agreed in writing. The nature and purpose of processing, categories of Data Subjects and categories of Personal Data are set out in Annex 1.

Customer is responsible for the accuracy, quality and legality of Personal Data and for the means by which it acquired the data.

Customer instructs BolderBrain to process Personal Data to provide the Services, including hosting, storing, analysing, generating reports and sending service notifications.

BolderBrain will promptly inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law. BolderBrain may process Personal Data outside Customer's instructions where required by law. In that case, BolderBrain will inform Customer unless the law prohibits it.

BolderBrain will not sell Personal Data or use it for its own marketing.

BolderBrain will ensure that personnel authorised to process Personal Data are bound by appropriate confidentiality obligations. Access is limited to personnel who need it to provide the Services.

BolderBrain will implement appropriate technical and organisational measures to protect Personal Data, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to Data Subjects.

Current measures include:

• TLS encryption for data in transit;
• role-based access controls and tenant isolation;
• password hashing and optional multi-factor authentication;
• audit logging of key actions;
• backups with automated restore checks;
• monitoring and error reporting.

Additional measures may be agreed in Annex 2. BolderBrain will regularly review and update these measures.

Customer authorises BolderBrain to engage Sub-processors to provide the Services. A current list of Sub-processors is set out in Annex 3. The AI model provider is engaged for AI narrative generation only where the Customer enables AI features in its workspace.

BolderBrain will impose data protection obligations on each Sub-processor that are no less protective than this DPA. BolderBrain will give Customer reasonable notice of new Sub-processors and an opportunity to object. If Customer objects on reasonable data protection grounds, the parties will discuss alternatives. If no alternative is agreed, Customer may terminate the affected Services.

BolderBrain remains liable to Customer for the performance of its Sub-processors.

Taking into account the nature of the processing, BolderBrain will assist Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from Data Subjects to exercise their rights.

BolderBrain will promptly notify Customer if it receives a request from a Data Subject relating to Personal Data processed for Customer. BolderBrain will not respond to the request itself unless authorised by Customer or required by law.

BolderBrain will provide tools and information to help Customer respond to access, correction, deletion, restriction, portability and objection requests.

BolderBrain will notify Customer without undue delay after becoming aware of a Security Incident and, where required by law, within 72 hours.

The notification will include, to the extent known, the nature of the incident, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed.

BolderBrain will investigate, mitigate and cooperate with Customer and any Supervisory Authority. BolderBrain will not notify Data Subjects or a Supervisory Authority on Customer's behalf unless instructed or required by law.

BolderBrain will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities, taking into account the nature of the processing and the information available.

BolderBrain may process Personal Data in countries other than the country where Customer is established. Where Personal Data is transferred outside the EEA, the UK or another jurisdiction with transfer restrictions, the parties will rely on an appropriate transfer mechanism, such as the Standard Contractual Clauses, and will complete any required annexes.

Details of transfers are set out in Annex 4.

On termination or expiry of the agreement, BolderBrain will, at Customer's choice, return or delete Personal Data, unless Applicable Data Protection Law requires retention.

BolderBrain will delete Personal Data from its live systems within 30 days of the later of termination or Customer's written request, and from backups within the backup retention period. BolderBrain will certify deletion in writing on request.

BolderBrain may retain Personal Data where required by law, provided it protects the data and limits processing to the required purpose.

BolderBrain will make available information necessary to demonstrate compliance with this DPA and will allow for audits, including inspections, by Customer or an auditor mandated by Customer.

Audits will be conducted with reasonable prior notice, during normal business hours, no more than once a year unless required by a Supervisory Authority or following a Security Incident. The auditor must be bound by confidentiality. Customer will bear the cost of the audit unless the audit reveals a material breach.

BolderBrain may satisfy audit requests with current third-party certifications or audit reports where appropriate.

The liability of each party under this DPA is subject to the limitations and exclusions in the agreement.

Nothing in this DPA limits liability that cannot be limited by law.

This DPA takes effect when signed by both parties and continues until the later of the end of the agreement or the end of processing.

Termination of this DPA does not affect obligations that by their nature survive, including confidentiality, deletion and liability.

This DPA is governed by the law stated in the agreement. If the agreement does not state a governing law, the laws of India apply. Disputes will be resolved in the courts or forum stated in the agreement.

• Data subjects: Customer's employees, contractors, candidates, managers, administrators and other individuals whose data Customer enters into the Services.
• Categories of personal data: identification and contact details, employment and organisation details, assessment responses, scores and reports, training and development records, performance review data, manager notes, talent grid placements, WhatsApp number and opt-in status, and technical logs.
• Sensitive data: the Services are not intended for special category data or sensitive personal data. Customer must not enter such data unless it has a lawful basis and has agreed additional safeguards with BolderBrain.
• Frequency: continuous for the term of the agreement.
• Purpose: provision of the Services, including assessment delivery, scoring, reporting, development planning, training impact analysis and support.
• Retention: as set out in the agreement and the Privacy Policy, unless otherwise agreed in writing.

• Access control: role-based access, least privilege, tenant isolation and unique user accounts.
• Authentication: password hashing, optional multi-factor authentication and session expiry.
• Encryption: TLS for data in transit.
• Logging and monitoring: audit logs for key actions, error monitoring and request logging.
• Backups: regular database backups with automated restore checks.
• Incident response: a documented process for investigating and responding to security incidents.
• Personnel: confidentiality obligations and security awareness.
• Physical security: controlled by our hosting provider.
• Vendor management: due diligence and contractual protections for Sub-processors.

A current list with provider names and locations is available from [email protected].

• BolderBrain and its Sub-processors may process Personal Data in India, the EEA, the UK, the United States and other countries where they operate.
• Where required, the parties will execute the Standard Contractual Clauses or rely on another lawful transfer mechanism.
• Customer authorises transfers on these terms.
• Transfer impact assessments and supplementary measures will be documented where required.