Data Processing Agreement

1. Introduction and Scope

1.1 Parties

This Data Processing Agreement ("DPA") forms part of the agreement between Artificial Societies Ltd, a company incorporated in England and Wales (company number 15963818), with its registered address at 5 New Street Square, London, EC4A 3TW ("Processor", "we", "us"), and the customer entity that has executed a Statement of Work or accepted our Terms of Service ("Controller", "you", "Customer").

1.2 Purpose

This DPA sets out the terms under which we will process Personal Data on your behalf when providing our Platform and services. It supplements our Terms of Service (available at https://societies.io/terms-of-service) and our Privacy Policy (available at https://societies.io/privacy-policy).

1.3 Applicable Law

This DPA is designed to meet the requirements of:

• The UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018;
• The EU General Data Protection Regulation (GDPR) 2016/679;
• Other applicable data protection laws as specified in a Statement of Work.

2. Definitions

In this DPA, the following terms have the meanings set out below:

3. Roles and Responsibilities

3.1 Controller Responsibilities

As the Controller, you shall:

• Ensure that you have a lawful basis for Processing Personal Data and for instructing us to Process such data;
• Provide all required notices to Data Subjects and obtain any necessary consents;
• Ensure that Customer Data provided to us is accurate and up-to-date;
• Comply with all applicable Data Protection Laws in your use of the Platform;
• Respond to Data Subject requests and regulatory inquiries relating to Customer Data.

3.2 Processor Responsibilities

As the Processor, we shall:

• Process Personal Data only on your documented instructions, unless required by law;
• Ensure that persons authorised to Process Personal Data are bound by confidentiality obligations;
• Implement appropriate technical and organisational security measures;
• Assist you in responding to Data Subject requests and regulatory inquiries;
• Notify you promptly of any Personal Data Breach;
• Delete or return Personal Data at the end of the agreement, unless required by law to retain it;
• Make available information necessary to demonstrate compliance with this DPA.

4. Processing Details

4.1 Subject Matter and Duration

We will Process Personal Data for the duration of our agreement with you, for the purpose of providing the Platform and associated services as described in the Terms of Service and any applicable Statement of Work.

4.2 Nature and Purpose of Processing

The nature and purpose of Processing includes:

• Operating and maintaining the Platform;
• Running Simulations using synthetic audiences based on Customer inputs;
• Generating and storing Simulation results;
• Providing customer support and troubleshooting;
• Maintaining logs for service delivery and security purposes.

4.3 Types of Personal Data

The types of Personal Data Processed may include:

• Contact information (names, email addresses, job titles);
• Account credentials and authentication data;
• Data included in Simulation prompts and configurations;
• Usage data and Platform interaction logs;
• Any other Personal Data provided by the Customer through the Platform.

4.4 Categories of Data Subjects

The categories of Data Subjects may include:

• Customer employees and authorised users of the Platform;
• Individuals whose data is included in Customer inputs or Simulation configurations;
• Individuals referenced in research or survey data provided by the Customer.

4.5 Special Categories of Data

The Platform is not designed to Process special categories of Personal Data (such as health data, biometric data, or data revealing racial or ethnic origin). If you require Processing of such data, please contact us to discuss appropriate safeguards and ensure you have obtained explicit consent or another lawful basis for such Processing.

5. Security Measures

5.1 Technical Measures

We implement appropriate technical measures to protect Personal Data, including:

• Encryption of data in transit using TLS 1.2 or higher;
• Encryption of data at rest using industry-standard encryption;
• Secure authentication mechanisms including multi-factor authentication options;
• Regular security testing and vulnerability assessments;
• Network security including firewalls, intrusion detection, and DDoS protection via Cloudflare;
• Secure backup and disaster recovery procedures.

5.2 Organisational Measures

We implement appropriate organisational measures, including:

• Role-based access controls limiting access to Personal Data;
• Confidentiality agreements for all personnel;
• Regular data protection training for employees;
• Documented security policies and procedures;
• Incident response procedures for security events.

6. Subprocessors

6.1 Authorised Subprocessors

You authorise us to engage the Subprocessors listed at https://societies.io/subprocessors. We ensure that each Subprocessor is bound by data protection obligations no less protective than those set out in this DPA.

6.2 Changes to Subprocessors

We will provide you with notice of any intended changes to Subprocessors by updating our Subprocessors list. You may object to a new Subprocessor by notifying us in writing within 14 days of receiving notice. If you have a reasonable objection and we cannot address your concerns, you may terminate the affected services without penalty.

6.3 Subprocessor Liability

We remain fully liable to you for the performance of our Subprocessors' obligations under this DPA.

7. International Data Transfers

7.1 Transfer Mechanisms

When we transfer Personal Data outside the UK or EEA, we ensure appropriate safeguards are in place, including:

• Transfers to countries with an adequacy decision from the UK government or European Commission;
• Standard Contractual Clauses approved by the UK Information Commissioner and/or European Commission;
• Other appropriate safeguards as permitted by Data Protection Laws.

7.2 Standard Contractual Clauses

Where required, the parties agree that the Standard Contractual Clauses shall apply to transfers of Personal Data to third countries. The applicable SCCs are incorporated by reference into this DPA, with:

• Module Two (Controller to Processor) applying to transfers of Customer Data;
• The Customer acting as data exporter and Artificial Societies Ltd as data importer;
• The UK Addendum applying for transfers from the UK.

7.3 Transfer Impact Assessments

We conduct transfer impact assessments for international transfers and implement supplementary measures where necessary to ensure an essentially equivalent level of protection for Personal Data.

8. Data Subject Rights

8.1 Assistance with Requests

We will assist you in responding to requests from Data Subjects exercising their rights under Data Protection Laws, including rights of access, rectification, erasure, restriction, portability, and objection.

8.2 Notification

If we receive a request directly from a Data Subject relating to Customer Data, we will promptly notify you and will not respond to the request without your instructions, unless required by law.

8.3 Platform Features

The Platform provides features to help you respond to Data Subject requests, including data export and deletion capabilities.

9. Personal Data Breach

9.1 Notification

We will notify you without undue delay (and in any event within 48 hours) after becoming aware of a Personal Data Breach affecting Customer Data. The notification will include:

• A description of the nature of the breach;
• The categories and approximate number of Data Subjects affected;
• The categories and approximate number of records affected;
• The likely consequences of the breach;
• Measures taken or proposed to address the breach.

9.2 Cooperation

We will cooperate with you and provide reasonable assistance to help you comply with your breach notification obligations under Data Protection Laws.

10. Audit Rights

10.1 Information and Audit

We will make available to you all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint.

10.2 Audit Conditions

Audits shall be subject to the following conditions:

• You shall provide at least 30 days' written notice of any proposed audit;
• Audits shall be conducted during normal business hours and shall not unreasonably disrupt our operations;
• Any third-party auditor must be bound by confidentiality obligations;
• You shall bear the costs of any audit, unless the audit reveals a material breach by us.

10.3 Third-Party Certifications

We may provide third-party certifications, attestations, or audit reports to satisfy your audit requirements, where available.

11. Data Retention and Deletion

11.1 During the Agreement

We will retain Customer Data for the duration of our agreement, in accordance with our retention policies and your instructions.

11.2 Upon Termination

Upon termination or expiry of our agreement, we will:

• Return Customer Data to you in a commonly used format upon request, made within 30 days of termination;
• Delete all Customer Data within 90 days of termination, unless you request data return or we are required by law to retain it;
• Provide written confirmation of deletion upon request.

11.3 Deletion of End Customer Data

Where the Controller provides Platform access to its own customers or end users ("End Customers"), the Controller may request deletion of a specific End Customer's data by written notice to the Processor identifying the relevant account. The Processor shall delete all Personal Data associated with that End Customer account within ninety (90) days of receiving the request, unless retention is required by applicable law, and shall confirm deletion in writing upon completion.

11.4 Exceptions

We may retain anonymised or aggregated data that does not constitute Personal Data. We may also retain Personal Data where required by applicable law, subject to appropriate safeguards.

12. AI and Model Training

12.1 No Training on Customer Data

We do not use Customer Data - including simulation prompts, input parameters, and bespoke audience configurations - to train or improve foundational AI models, unless explicitly agreed in writing with you.

12.2 Third-Party AI Providers

Where we use third-party AI providers (such as OpenAI and Google AI) as Subprocessors, we ensure contractual commitments that Customer Data is not used for model training by these providers.

13. Liability

13.1 Liability Cap

Each party's liability under this DPA shall be subject to the limitations of liability set out in the Terms of Service or applicable Statement of Work.

13.2 Indemnification

Each party shall indemnify the other for any losses, damages, or expenses arising from its breach of this DPA or applicable Data Protection Laws.

14. General Provisions

14.1 Precedence

In the event of any conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to the Processing of Personal Data.

14.2 Amendments

We may update this DPA from time to time. Material changes will be notified to you, and continued use of the Platform after such notification constitutes acceptance of the updated DPA.

14.3 Governing Law

This DPA shall be governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

15. Contact Us

If you have any questions about this Data Processing Agreement or our data processing practices, please contact us: