Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Customer Agreement between Branded Mark Limited, a company registered in England and Wales (company number 14452041), whose registered office is at Broomfield House, Blakedown, Kidderminster, DY10 3LA, United Kingdom ("BrandedMark", "we", "us"), and the customer named in the Order Form ("Customer", "you").

It applies whenever BrandedMark processes Customer Personal Data on your behalf in providing the Service. You accept it by signing an Order Form or by accepting the Customer Terms. You don't need to sign it separately. If you'd like a countersigned copy, email [email protected].

In short: when your consumers and staff use BrandedMark, you decide what happens to their personal data and we act only on your instructions. This document sets out the legal promises we make to you as your processor under UK and EU data protection law.

#1. Definitions and interpretation

1.1 Terms defined in the Customer Terms have the same meaning here. In addition:

1.2 The italic "In short" summaries are for convenience only and do not affect interpretation.

1.3 If this DPA conflicts with the Customer Terms, this DPA prevails in relation to the processing of Customer Personal Data. If this DPA conflicts with the EU SCCs, the UK Addendum or the IDTA (where they apply), those clauses prevail.

#2. Roles and scope

2.1 Customer as controller. For Customer Personal Data, the Customer is the controller (or a processor acting for a third-party controller, such as an affiliate or a brand it serves), and BrandedMark is the processor (or sub-processor). This covers all end-consumer data processed through the Customer's product experiences, including registrations, warranty claims, cases, returns, orders, conversations, reviews, marketing preferences and scan events. The Customer's own consumer privacy notice governs these data subjects. BrandedMark provides a default template the Customer may adopt and edit. Fraud signals, AI quality scores and answer-memory summaries are computed only from, stored only in, and used only for the Customer's own tenant.

2.2 BrandedMark as independent controller. BrandedMark is an independent controller, and not the Customer's processor, for the following limited purposes only. It handles that data in line with its Privacy Policy (https://www.brandedmark.com/legal/privacy):

(a) account administration, billing and contract management for the Customer and its Authorised Users (names, business contact details, billing records);

(b) authentication, account security and fraud prevention for Authorised Users (login audit records, known devices, sign-in alerts);

(c) securing the platform, limited to security and access logs and rate-limiting counters, and not the content of Customer Personal Data. Malware scanning of uploaded files is a Security Measure that BrandedMark carries out for the Customer (Annex II); and

(d) complying with legal obligations that apply to BrandedMark.

BrandedMark will not use Customer Personal Data for any other purpose of its own. It will not sell it, use it for advertising, use it to train or fine-tune any AI model shared between customers, or allow any AI provider to train its models on it. BrandedMark's AI provider may keep prompts and responses for a limited period to detect and prevent misuse of its service, as Annex II (section 11) describes. Creating Service Improvement Data under clause 3.2(d), usage metrics under clause 3.2(f) and answer memory under clause 3.2(g) is processing on the Customer's instructions, not a purpose of BrandedMark's own.

2.3 Customer-Directed Integrations. If the Customer connects or instructs a Customer-Directed Integration, the provider of that integration is not a Sub-processor of BrandedMark. Transfers to it are made on the Customer's instructions and are governed by the Customer's own agreement with that provider. BrandedMark sends data to a Customer-Directed Integration only after the Customer has configured it, and is not responsible for the provider's processing once the data leaves the Service.

2.4 Customer responsibilities. The Customer:

(a) is responsible for having a lawful basis and giving transparency information (including a privacy notice and, where required, cookie information) to data subjects whose data it collects through the Service;

(b) is responsible for obtaining any consent required, including marketing consent and consent for optional features such as precise location;

(c) will not instruct BrandedMark to process special category data or criminal offence data through the Service unless the parties agree this in writing;

(d) is responsible for the lawfulness of its instructions and of the Customer Personal Data it provides; and

(e) will not switch on AI Features on a portal, or for products, aimed at or likely to be used by people under 18 (Acceptable Use Policy, clause 4.10).

In short: you're the controller for everything about your customers and staff. We're only a controller for our own business admin, account security, platform security and legal duties. Usage statistics we make from your tenant are made on your instructions. Services you connect yourself aren't our sub-processors.

#3. Processing on documented instructions

3.1 BrandedMark will process Customer Personal Data only on the Customer's documented instructions, including with regard to Restricted Transfers, unless UK law or, for data subject to the EU GDPR, Union or Member State law to which BrandedMark is subject requires otherwise. In that case BrandedMark will tell the Customer of the legal requirement before processing, unless the law prohibits this on important grounds of public interest.

3.2 The Customer's complete instructions at the date of this DPA are:

(a) the Customer Agreement (including this DPA);

(b) the Customer's configuration and use of the Service, including settings, workflows, integrations, AI features and privacy settings (such as the consumer erasure delay);

(c) any further reasonable written instructions consistent with the Customer Agreement;

(d) unless Service Improvement is switched off for the Customer's tenant under clause 6.4 of the Customer Terms, preparing Service Improvement Data from Customer Data as that clause describes: removing or replacing Personal Data, and replacing the Customer's names and marks, before any use; using it, including product-specific content, to evaluate and improve the AI features for the Customer; and using what it shows to improve instructions, guardrails and checks shared by all customers, which never contain the Customer's content. No AI model shared between customers is trained or fine-tuned on Customer Data, and Personal Data is never included in Service Improvement Data or in any training, fine-tuning or evaluation set made from it. The switch-off and deletion terms in clauses 6.4(f) and 6.4(g) of the Customer Terms apply;

(e) support access under clause 18.5 of the Customer Terms: read-only access by named BrandedMark staff, including viewing the tenant as a named user, to provide support, investigate incidents and keep the Service secure; and changes as a user only at the Customer's written request or with a tenant administrator's approval. BrandedMark may also use automated tools to operate and support the Service. They act under the same confidentiality and security controls as BrandedMark's staff, are used only to operate, support and secure the Service, and never view the tenant as a user; viewing as a user is for named staff only. Each support access by BrandedMark staff is recorded as clause 18.5(c) of the Customer Terms describes. A tenant administrator can ask BrandedMark to stop support access, subject to the security and legal exceptions in clause 18.5(d) of the Customer Terms;

(f) creating de-identified, aggregated usage metrics that contain no Customer Content and from which no individual or Customer can be identified, and using them to operate, secure, bill and improve the Service; and

(g) where the Customer uses the AI support assistant, keeping a short summary of the issue and the fix from AI-answered conversations that the consumer rates highly ("answer memory"), and using it to answer similar questions about the same product, in the Customer's tenant only. This is part of delivering the AI Features, not Service Improvement. Summaries may contain Personal Data from the source conversation. They are kept until the Customer's tenant is deleted, or until the Customer asks BrandedMark to delete them.

Any instruction outside the scope of the Customer Agreement may be subject to agreement on additional fees.

3.3 BrandedMark will tell the Customer immediately if, in its opinion, an instruction infringes Data Protection Laws. It may suspend performance of that instruction until the Customer confirms or changes it in writing.

#4. Confidentiality of personnel

4.1 BrandedMark will ensure that every person it authorises to process Customer Personal Data (employees, directors and contractors) is subject to a contractual or statutory duty of confidentiality. Access is limited to those who need it to provide, support and secure the Service.

#5. Security

5.1 BrandedMark will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 UK GDPR / EU GDPR. These include the Security Measures in Annex II.

5.2 BrandedMark may update the Security Measures from time to time, provided the updates do not materially reduce the overall level of protection.

5.3 The Customer is responsible for its own secure use of the Service. This includes:

• managing Authorised Users and their access scopes;
• enabling the multi-factor authentication or passkey policy available to its tenant;
• keeping API keys and credentials confidential; and
• securing Customer-Directed Integrations.

#6. Sub-processors

6.1 General authorisation. The Customer gives BrandedMark general written authorisation to engage Sub-processors. The Sub-processors in place at the date of this DPA are listed at https://www.brandedmark.com/legal/subprocessors (the "Sub-processor List"), which forms Annex III. Where a provider on that list acts under its own terms as an independent controller rather than as BrandedMark's processor (Google Maps Platform, for address lookup and maps), it is not a Sub-processor: BrandedMark uses it only where the Customer uses that feature, on the Customer's instructions under clause 3.2(b).

6.2 Flow-down. BrandedMark will enter into a written contract with each Sub-processor. That contract will impose data protection obligations that are, in substance, no less protective than those in this DPA, as Article 28(4) UK GDPR / EU GDPR requires. On request, BrandedMark will give the Customer a copy of, or a link to, each Sub-processor's data protection terms. BrandedMark remains fully liable to the Customer for the performance of each Sub-processor's obligations.

6.3 Notice of changes. BrandedMark will give at least 30 days' notice before it engages a new Sub-processor or materially changes the processing location of an existing one. It will do this by emailing the Customer's account owner and notices contact, and by recording the change in the change log on the Sub-processor List.

6.4 Objection. The Customer may object to a new Sub-processor on reasonable data protection grounds by writing to [email protected] within the notice period. The parties will discuss the objection in good faith. BrandedMark may offer a reasonable alternative, for example a configuration that avoids the Sub-processor, or disabling the feature that relies on it. If the parties cannot resolve the objection within 30 days of it being made, the Customer may terminate the affected part of the Service by written notice. For a Sub-processor used for every customer, the affected part may be the whole Service. BrandedMark will then refund any prepaid fees for the terminated part covering the period after termination. This is the Customer's sole remedy for an unresolved objection.

6.5 Emergency replacement. If BrandedMark needs to replace a Sub-processor urgently for reasons outside its reasonable control (for example a security risk, or the Sub-processor ceasing service), it may do so immediately. It will give notice as soon as practicable, and the objection right in clause 6.4 then applies. This is subject to Clause 9 of the EU SCCs where they apply.

In short: our current suppliers are on a public list. We'll give you 30 days' warning of any new one. If you have a genuine data protection concern we can't fix, you can leave that part of the service and get a refund.

#7. Data subject rights

7.1 Taking into account the nature of the processing, BrandedMark will help the Customer, by appropriate technical and organisational measures, to respond to requests from data subjects to exercise their rights under Data Protection Laws. The main way it does this is through self-service tools in the Service, including:

(a) consumer personal-data export (access and portability) and erasure. Erasure deletes the consumer's profile and their own messages and attachments, replaces their identity in records the Customer needs to keep (such as registrations, tags, orders, reviews, audit logs and widget storage), and deletes the consumer's Stripe customer record on the Customer's connected Stripe account where one exists. Erasure does not currently remove staff and assistant replies in a conversation, AI processing records (conversation traces) or answer-memory summaries; these follow the retention in Annex I. On the Customer's written request, BrandedMark will delete those records, or remove a named consumer's Personal Data from them, within 5 business days;

(b) a configurable erasure delay, set by the Customer (default 10 days, maximum 30 days), together with staff "holds", so that the Customer can check a request before it is carried out. Holds do not extend the Customer's legal deadline for responding to the request; and

(c) consumer marketing-preference management and one-click unsubscribe.

7.2 If BrandedMark receives a request directly from a data subject that relates to Customer Personal Data, it will not respond to the request itself, other than to direct the data subject to the Customer. It will forward the request to the Customer without undue delay, unless law requires otherwise.

7.3 Where the self-service tools are not enough, BrandedMark will provide reasonable additional help within 5 business days of the Customer's written request. If the help requested goes beyond what is reasonable, BrandedMark may charge for it at its then-current professional services rates, after agreeing this with the Customer in advance.

#8. Personal data breaches

8.1 BrandedMark will notify the Customer without undue delay, with a target of 48 hours and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. BrandedMark becomes aware of a personal data breach when it has a reasonable degree of certainty that a security incident has compromised Customer Personal Data. It will investigate suspected incidents without undue delay.

8.2 The notification will include, as far as the information is then available:

(a) the nature of the breach, including the categories and approximate number of data subjects and records concerned;

(b) the name and contact details of BrandedMark's contact point ([email protected]);

(c) the likely consequences of the breach; and

(d) the measures taken or proposed to address the breach and reduce its possible adverse effects.

Where BrandedMark cannot provide all the information at once, it may provide it in phases without further undue delay.

8.3 BrandedMark will take reasonable steps to contain, investigate and remedy the breach. It will cooperate with the Customer and give reasonable help so the Customer can meet its own obligations to notify supervisory authorities (within 72 hours where required) and data subjects.

8.4 BrandedMark's notification of, or response to, a personal data breach is not an acknowledgement of fault or liability.

8.5 BrandedMark will not tell third parties (including data subjects or supervisory authorities) about a breach affecting Customer Personal Data without first consulting the Customer, unless law requires it. This does not limit BrandedMark's own obligations as a controller for the data described in clause 2.2.

#9. DPIAs and prior consultation

9.1 Taking into account the nature of the processing and the information available to it, BrandedMark will give the Customer reasonable help with any data protection impact assessment, and any prior consultation with a supervisory authority, that the Customer is required to carry out in relation to the Service. BrandedMark will first provide its documentation (this DPA, Annex II, the Trust Centre, the AI Statement and the Sub-processor List). Further help may be chargeable under clause 7.3.

#10. Audits and information

10.1 BrandedMark will make available all information reasonably necessary to demonstrate its compliance with Article 28 UK GDPR / EU GDPR, and will allow for and contribute to audits, as set out in this clause.

10.2 Documentation first. On request (no more than once a year, unless clause 10.4 applies), BrandedMark will provide:

(a) answers to a reasonable security and privacy questionnaire;

(b) a summary of any independent penetration test carried out in the previous 12 months, under a non-disclosure agreement; and

(c) copies of any certifications it holds at the time.

10.3 Audits. If the documentation in clause 10.2 is not reasonably enough to show compliance, the Customer (or an independent auditor bound by confidentiality who is not a competitor of BrandedMark) may carry out an audit:

• no more than once in any 12-month period;
• on at least 30 days' written notice;
• during business hours;
• in a way that minimises disruption;
• remotely, unless an on-site visit is reasonably needed because the matter cannot be checked remotely; and
• for no more than 2 days in total.

The first remote audit day in each 12-month period is free of charge. BrandedMark charges for further audit days at £1,000 per person-day, or the audit day rate in the Order Form if it states one, and will tell the Customer of the expected charge in advance. The Customer bears its own costs.

10.4 Exceptions. The once-a-year limit in clause 10.3 does not apply, and each party bears its own costs, where an audit is:

(a) required by a supervisory authority; or

(b) reasonably needed following a personal data breach affecting Customer Personal Data.

No audit day charge applies to such an audit. Such an audit is limited to the matters connected with the breach or the authority's requirement.

10.5 Audits do not extend to:

• other customers' data;
• BrandedMark's systems or premises where no Customer Personal Data is processed; or
• Sub-processors' facilities. For Sub-processors, BrandedMark will instead provide, or direct the Customer to, the Sub-processor's available audit reports or certifications, such as Microsoft's ISO 27001 and SOC 2 reports.

#11. Deletion and return at the end of the Service

11.1 Retrieval period. For at least 30 days after the Customer Agreement (or the relevant subscription) ends, the Customer may retrieve Customer Data, including Customer Personal Data, through the in-product exports, the API and a complete export on request, as Schedule A (A3 and A4) of the Customer Terms describes. When the Customer closes its tenant, the tenant can be reopened for 30 days, and the account owner is emailed an export file. The export includes conversations, but not BrandedMark's AI processing records (conversation traces), which are deleted under clause 11.2. The Customer may instead instruct deletion before the retrieval period ends.

11.2 Deletion. After the retrieval period ends, BrandedMark will delete Customer Personal Data from the live Service within a further 30 days. Deletion covers the database, file storage, stored integration credentials and the document-search stores held with the AI provider for the Customer. Material tuned on the Customer's product-specific content under clause 6.4(g) of the Customer Terms is deleted within 90 days after the Customer Agreement ends. Sub-processors that keep limited records under their own legal or abuse-monitoring duties delete them under their own terms. Deletion does not apply where Data Protection Laws or other applicable law require BrandedMark to keep the data. In that case BrandedMark will keep it confidential and process it only for the purpose of that legal requirement.

11.3 Backups. Deleted data may remain in backups until those backups expire in their normal cycle:

• database backups: up to 7 days;
• file storage (deleted files, earlier versions and soft-deleted copies): up to 65 days;
• stored credentials: up to 90 days;
• operational logs: up to 30 days.

BrandedMark commits that backups roll off within 65 days of deletion, except for credential secrets (up to 90 days). Until they roll off, backups are protected by the Security Measures and are not used to restore the Customer's data unless the Customer asks.

11.4 Digital Product Passports. If the Customer has Link Continuity under Schedule B (B2A) of the Customer Terms, BrandedMark keeps the passport data and resolver mappings needed for it while it continues. If the Customer asks for a redirect under B2(b), BrandedMark keeps only the resolver mappings and redirect targets, for the 12-month redirect period. Any personal data within them is still covered by this DPA.

11.5 On request, BrandedMark will confirm deletion in writing.

11.6 Insolvency. If BrandedMark is going to stop providing the Service because of its insolvency or winding up, then, as far as it lawfully can, BrandedMark will keep export of Customer Data available to the Customer and will delete Customer Personal Data on the Customer's instruction, or, if the Service ends without an instruction from the Customer, within 90 days after it ends. Schedule B (B5) of the Customer Terms deals with Digital Product Passports and resolver mappings in that case.

#12. International transfers

12.1 Primary location. BrandedMark hosts Customer Personal Data in Microsoft Azure data centres in the European Union:

• the primary location is the Netherlands;
• geo-redundant copies are kept in Ireland.

BrandedMark will not change the primary hosting region outside the EU or UK without notice under clause 6.3. Some Sub-processors process data outside the EU, for example the AI provider and the global network that carries traffic to the Service, as shown on the Sub-processor List.

12.2 BrandedMark's location. BrandedMark is established in the United Kingdom. Its personnel may access Customer Personal Data from the UK to provide, support and secure the Service.

(a) EU data. Transfers of Customer Personal Data that is subject to the EU GDPR to BrandedMark in the UK rely on the European Commission's adequacy decision for the UK, as renewed until 27 December 2031. If that decision is suspended, revoked, expires or is found invalid, the EU SCCs (Module 2 controller-to-processor, or Module 3 processor-to-processor where the Customer is itself a processor) will automatically apply between the Customer as data exporter and BrandedMark as data importer, as completed in Annex IV, to the extent they may lawfully be used. Otherwise the parties will promptly put in place another lawful transfer mechanism.

(b) UK data. Transfers of UK personal data to the EU/EEA are permitted under UK adequacy regulations, so no additional safeguards are needed.

12.3 Onward transfers to Sub-processors. Where a Sub-processor processes Customer Personal Data outside the UK and the EU/EEA (for example, a global edge network or a provider's support personnel), BrandedMark will ensure the transfer is covered by one of the following:

(a) an adequacy decision or adequacy regulations (including, for US recipients, the EU-US Data Privacy Framework and the UK Extension to it, where the recipient is certified); or

(b) the EU SCCs, Module 3 (processor-to-processor), together with the UK Addendum for UK personal data, or, as an alternative for UK data, the IDTA.

Where BrandedMark is the exporter, it relies on the transfer clauses in each Sub-processor's data protection terms. The Sub-processor List describes the transfer safeguards used.

12.4 Customer-Directed Integrations. Transfers to Customer-Directed Integrations are made on the Customer's instruction. The Customer is responsible for any transfer mechanism they require.

12.5 If the transfer clauses can't be used. If the clauses in 12.2(a) can't lawfully be used for a transfer to BrandedMark, for example because its processing is directly subject to the EU GDPR, the parties will promptly adopt the lawful mechanism then available, including any standard clauses the European Commission issues for that case. BrandedMark's EU representative is named in its Privacy Policy.

#13. Government and law enforcement requests

13.1 If BrandedMark receives a legally binding request from a public authority for access to Customer Personal Data, it will:

(a) where legally permitted, promptly notify the Customer and give a copy of the request, so the Customer can seek a protective order or other remedy;

(b) challenge the request if, after careful assessment, it concludes there are reasonable grounds to consider it unlawful;

(c) disclose only the minimum data necessary to comply; and

(d) where notice to the Customer is prohibited, use reasonable efforts to obtain a waiver of the prohibition.

13.2 BrandedMark has not received any such request as of the date of this DPA. It will report the number of requests received in its Trust Centre at least once a year.

#14. Liability

14.1 Each party's liability arising out of or relating to this DPA (including under the EU SCCs, the UK Addendum or the IDTA, to the extent permitted by them) is subject to the limitations and exclusions of liability in clause 16 of the Customer Terms, as varied by any Order Form. In particular, liability for breach of this DPA is limited to the Data Cap in clause 16.4 of the Customer Terms: two times the General Cap, which by default is the greater of the Fees paid and payable in the 12 months before the claim and £15,000.

14.2 Nothing in this DPA limits either party's liability to data subjects, or its regulatory responsibility, under Data Protection Laws where the law does not permit limitation.

#15. Term, changes and governing law

15.1 This DPA stays in force for as long as BrandedMark processes Customer Personal Data. Clauses 11, 13 and 14 survive termination.

15.2 BrandedMark may update this DPA:

(a) to reflect changes in Data Protection Laws, or a court or regulator's guidance, including replacement transfer clauses; or

(b) in any other way that does not materially reduce the protection given to Customer Personal Data.

Material changes will be notified at least 30 days in advance under the change process in clause 22 of the Customer Terms. Previous versions are archived at https://www.brandedmark.com/legal/dpa/archive.

15.3 This DPA is governed by the law of England and Wales, as is the Customer Agreement. Disputes are subject to the courts chosen in the Customer Agreement. This is without prejudice to clauses 17 and 18 of the EU SCCs where they apply.

#Annex I: Description of the processing

Parties

• Data exporter / controller: the Customer named in the Order Form. Contact: the Customer's account owner and notices contact.
• Data importer / processor: Branded Mark Limited, Broomfield House, Blakedown, Kidderminster, DY10 3LA, UK. Contact: [email protected].

Subject matter and duration. Providing the BrandedMark post-purchase platform (product identity, QR/GS1 Digital Link resolution, digital product passports, product registration and warranty, support cases, returns and RMAs, commerce and spares, AI-assisted support, notifications and integrations), for the term of the Customer Agreement plus the retrieval and deletion periods in clause 11.

Nature of processing. Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission (including to Customer-Directed Integrations on instruction), alignment, restriction, erasure and destruction. This includes automated processing by AI features to draft replies, classify and summarise conversations, and read serial-number labels. These outputs support the Customer's staff and consumers. BrandedMark's built-in AI tools can look up information, open cases and send messages. They cannot approve or refuse warranty claims, returns or refunds. The Customer decides whether any tool it connects to the assistant may act without human review.

It also includes:

• support access by named BrandedMark staff, read-only by default and recorded, and use of BrandedMark's automated tools to operate, support and secure the Service, which never view the tenant as a user (clause 3.2(e));
• usage metrics: de-identified, aggregated metrics used to operate, secure, bill and improve the Service (clause 3.2(f));
• de-identification of Customer Data to prepare Service Improvement Data, where Service Improvement is on for the tenant (clause 3.2(d));
• answer memory: summaries of highly rated AI-answered conversations, reused only within the Customer's tenant (clause 3.2(g));
• disclosure to Trade Partners the Customer adds to its tenant, as the Customer configures (Stream B and Stream E); and
• sealing of Signed Forms (electronic signature evidence).

Frequency. Continuous.

Special category data. None intended. The Customer must not configure the Service to collect special category data (see clause 2.4(c)). Free-text messages and uploads may incidentally contain it if a data subject chooses to include it.

#Stream A: Customer staff users (Authorised Users)

#Stream B: End consumers (the Customer's product owners, buyers and enquirers)

#Stream C: The Customer's business customers and contacts

#Stream D: Digital Product Passport and product data

#Stream E: Trade Partner Users and Field Users

#Annex II: Technical and organisational measures

These measures describe the Service as it runs at the date of this DPA.

1. Hosting and physical security

• Microsoft Azure data centres in the EU (Netherlands), with geo-redundant copies in Ireland. Physical security, environmental controls and hardware lifecycle are provided by Microsoft under its ISO 27001 / SOC 2 certified controls.
• The production environment is separate from development and test, is protected against accidental deletion, and is restricted to approved EU locations.

2. Encryption

• In transit: TLS 1.2 or higher on all public connections, with HSTS enforced.
• At rest: AES-256 encryption for the database, file storage, disks and backups, with Microsoft-managed keys. Application encryption keys are protected in a managed key vault.

3. Network and perimeter

• No application server is directly exposed to the internet. All traffic passes through a network security provider with DDoS protection and a web application firewall.
• Network segmentation between internal services. Rate limiting on public endpoints.

4. Identity and access management

• Services authenticate to each other and to data stores with managed identities rather than shared passwords or keys. Database key access is disabled. Deployments use short-lived credentials, with no stored deployment secrets.
• Application secrets and tenant integration credentials are held in a managed, access-controlled secrets vault, stored separately for each tenant.
• Access to the production cloud platform and databases, other than by the Service's own components, is limited to BrandedMark's directors, an emergency account and BrandedMark's own automated tools, through a central identity provider, with no local accounts. The automated tools act under the same confidentiality and security controls as BrandedMark's staff and are used only to operate, support and secure the Service.
• Support access (clause 3.2(e) and Customer Terms clause 18.5):
  • by named BrandedMark staff; BrandedMark's automated tools never view a tenant as a user, and viewing as a user ("view as") is for named staff only;
  • read-only by default;
  • acting as a user or making changes only at the Customer's written request or with a tenant administrator's approval;
  • each support access by BrandedMark staff recorded (who, when and why, with the ticket or incident reference), kept for at least one year, with a copy available to a tenant administrator on request;
  • stopped if a tenant administrator asks, subject to the security and legal exceptions in Customer Terms clause 18.5(d).
• Customer staff: password policy (minimum length, lockout after repeated failures), optional TOTP and passkeys, and a tenant-level policy to require MFA or passkeys. Role-based access scopes per tenant and brand.
• Consumers: passwordless sign-in by one-time code or passkey.
• API keys are stored only in hashed form and are scoped to the permissions granted.

5. Tenant isolation

• Logical multi-tenancy: every record belongs to a single tenant, and access is enforced by tenant-scoped authorisation checks in the application, which are reviewed in our security reviews.
• Files are segregated by tenant. Private files are served only through short-lived signed links.
• Media-library files (images, videos, branding) and generated QR-code images are publicly readable by anyone holding their URL, which contains a non-guessable random identifier. Stored files cannot be listed or browsed. All other Customer Data, including product and passport documents of every visibility, End User uploads, support attachments, exports and print files, is held in private storage and served only through the Service or short-lived signed links. The Customer should not place confidential material in the media library.

6. Application security

• Changes are made through pull requests with automated tests, and deployed through a controlled pipeline using container images pinned by digest. Every build checks dependencies for known vulnerabilities.
• Browser protections: a strict Content Security Policy, secure cookies and anti-forgery protection.
• Uploaded files are scanned for malware.
• Outbound webhooks are signed so recipients can verify them, and are protected against server-side request forgery. Inbound webhooks from payment, email and shipping providers are signature-verified.
• Internal security reviews of the application and infrastructure.

7. Logging and monitoring

• Application and platform monitoring, with alerts on service health. Operational logs are kept for 30 days.
• Tenant-visible audit log of significant actions (60 days).

8. Availability, backup and recovery

• Database and storage replicated across separate data-centre zones. Continuous database backup with point-in-time restore (7 days). Recovery of deleted files (30 days). Geo-redundant copy in a second EU location.
• Documented disaster-recovery plan (target: 4-hour recovery time and a recovery point of 2 minutes or less for an in-region restore).

9. Data minimisation and retention

• Automated deletion of short-lived data (such as sign-in codes, invitations and serial-photo reads) within 7 days, of scan/experience events after 90 days, and of conversations after 2 years.
• Consumer export and erasure tooling, with a configurable delay.
• Tenant closure and purge process.

10. Personnel and organisational

• Everyone BrandedMark authorises to access Customer Personal Data is under a duty of confidentiality (clause 4). Access is granted on a need-to-know basis and removed promptly on leaving.
• Security and data protection responsibilities are assigned at board level. Security incidents are reported to [email protected].
• Written incident response process, including breach assessment and notification within the timescales in clause 8.
• Annual review of this DPA, the Sub-processor List and these measures.

11. AI processing

• AI features use Google Gemini models through the Gemini API (Google LLC). Google does not commit to a processing location for this API, so AI inputs may be processed outside the UK and EU; the transfer is protected by the standard contractual clauses in Google's data processing terms. Under those terms Google does not use prompts or responses to train its models or improve its products. It keeps them for a limited period (currently up to 55 days) to detect and prevent misuse of its service, and items its systems flag may be reviewed by people. Product documents the Customer marks Public and Include in AI are indexed with Google for AI search and deleted when the Customer removes them or the product.
• Some AI features can be switched off in the tenant's settings, and BrandedMark will switch AI features off for the whole tenant on request.

12. Sub-processor management

• Each provider on the Sub-processor List has been reviewed for security and data protection and is bound by written data protection terms appropriate to its role, a copy of which BrandedMark keeps on file. New Sub-processors are reviewed before they are used.

#Annex III: Sub-processors

The Sub-processors authorised under clause 6 are those listed at https://www.brandedmark.com/legal/subprocessors, as updated in line with clause 6.3. The version that applies at the date of this DPA is the one published on that page on that date.

#Annex IV: Transfer clauses (completion)

A. EU SCCs (where the clause 12.2(a) fallback applies)

B. UK Addendum (for UK personal data in a Restricted Transfer)

C. IDTA. As an alternative to Part B for UK personal data, the parties may agree to use the IDTA, completed consistently with this DPA.

#Version history