This Data Processing Agreement (“Agreement”) forms part of the Main Agreement between Alethium Limited (“Processor”) and the user (“Controller”). In this Agreement, the terms “Controller,” “Processor,” “Personal Data,” “Processing,” and “Subprocessor” have the meanings given to them in the UK General Data Protection Regulation (“UK GDPR”). This Agreement sets out the Processor’s obligations regarding the Processing of Personal Data on behalf of the Controller.
Definitions
For the purposes of this Agreement:
Scope and Purpose
The Processor shall process Personal Data solely on the documented instructions of the Controller as set forth in this Agreement and the Main Agreement. The categories of Personal Data to be processed include:
- Registration details: such as name, contact information, and related data provided during account registration.
- Transactional details: including order information, payment details, and any other information arising from transactions made via the Platform.
Duration of Processing
The Processor shall Process Personal Data for the duration of the Main Agreement and only for the purposes specified herein.
Data Security
The Processor agrees to implement appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.
Data Subject Rights
The Processor shall assist the Controller in responding to data subject requests to exercise rights under the UK GDPR (including access, rectification, erasure, and data portability), taking into account the nature of the Processing and the information available to the Processor.
Subprocessors
The Processor may engage the following subprocessors to assist with the Processing of Personal Data:
Subprocessor Table
| Subprocessor Name | Service Provided | Location of Processing | Data Categories Processed | Additional Details/Links |
|---|---|---|---|---|
| Google Workspace | Email, document management, collaboration | UK/EU (configured as appropriate) | Registration details, transactional details | Google Workspace Privacy Policy |
| Brevo | Email marketing and communications | UK/EU (configured as appropriate) | Registration details, transactional details | Brevo Privacy Policy |
| Hubspot | CRM and marketing automation | UK/EU (configured as appropriate) | Registration details, transactional details | Hubspot Privacy Policy |
| Attio | CRM and contact management | UK/EU (configured as appropriate) | Registration details, transactional details | Attio Privacy Policy |
Cross-Border Data Transfers
The Processor shall not transfer any Personal Data outside the United Kingdom or the European Union.
Data Retention and Deletion
Upon termination of the Main Agreement, the Processor shall, at the Controller’s instruction, return or delete all Personal Data processed on behalf of the Controller, unless otherwise required by applicable law.
Audit and Inspection
The Processor shall make available to the Controller all information necessary to demonstrate compliance with this Agreement and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, upon reasonable notice.
Liability
The Processor’s liability regarding data Processing is subject to the terms of the Main Agreement and applicable law. Each party remains liable for its own compliance with applicable data protection laws.
Governing Law
This Agreement shall be governed by and construed in accordance with the laws of England and Wales, in accordance with the UK GDPR.