Data Processing Addendum

Version 1.0 · 21 October 2026

Parties and application

This addendum forms part of the Terms of Service between the customer identified in the accepted service agreement and ACTERA LIMITED, company number 17528640, registered in England and Wales, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Actera’s privacy contact is hello@actera.dev.

It applies to personal data that Actera processes on the customer’s behalf through the service (Customer Personal Data). Applicable Data Protection Law means the UK GDPR and Data Protection Act 2018, as amended, and the EU GDPR or other data-protection laws to the extent applicable to that processing. Terms including controller, processor, personal data, personal data breach and processing have their applicable statutory meanings.

The customer is a controller or an authorised processor for its controller; Actera is respectively its processor or subprocessor. The customer must have authority for its instructions, provide required notices and establish a lawful basis. Actera remains responsible for its own statutory obligations. Actera’s separate controller processing of account and business-administration data is described in the Privacy Policy.

Processing instructions

Actera may process Customer Personal Data only to provide and secure the agreed alpha, as configured by the customer and described in this addendum, or on further lawful instructions recorded in writing. That includes access-controlled storage, evaluation, presentation, approved transmission, export and deletion. The agreement and the customer’s authorised use of supported functions constitute documented instructions within this scope.

Actera will inform the customer promptly if it considers an instruction to infringe Applicable Data Protection Law and may suspend that instruction while the parties resolve it. If law requires different processing, Actera will inform the customer of the requirement before processing unless prohibited by law. Actera will not sell Customer Personal Data, use it for advertising, train general-purpose models on it or combine it with another customer’s content for an unrelated purpose.

Confidentiality and safeguards

Actera will limit access to authorised people with a necessary role and a binding confidentiality duty. It will implement and maintain the technical and organisational measures in the Data Retention and Security Schedule, taking account of processing risks, and will not materially reduce their overall protection during the agreement.

Subprocessors

The customer grants general authorisation for the providers identified in the Subprocessor and Service Provider Register to process Customer Personal Data for the relevant functions where Actera engages them as subprocessors. This does not authorise unrelated processing or displace the transfer requirements below.

Before adding or replacing a subprocessor or materially changing its processing, Actera will notify the customer’s account contact sufficiently in advance to provide a reasonable opportunity to object on data-protection grounds before the change. The parties will seek an alternative, mitigation or cessation of the affected function. If no reasonable solution is available, the customer may terminate the affected service before the change, with return/deletion under this addendum. The new subprocessor will not process the objecting customer’s data while the objection remains unresolved. Urgent security circumstances may require suspension rather than an unapproved transfer.

Actera will bind each subprocessor to relevant data-protection obligations offering equivalent protection for its processing and remains responsible for the subprocessor’s performance of those obligations. Customer-directed services contracted independently by the customer are identified separately; their classification depends on the actual relationship, not their label.

Assistance and incidents

Actera will assist the customer with lawful requests for access, correction, deletion, restriction, objection and portability, taking account of the nature of the service. It will promptly refer a request concerning Customer Personal Data to the customer and will not independently decide it except on instructions or as required by law.

Actera will notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Available information will include the nature and scope, likely consequences, affected data/people where known, containment and remediation, and a contact for follow-up. Actera may provide information in stages and will preserve relevant evidence and cooperate with the customer’s response. A lack of complete information will not delay the initial notice.

Taking account of the processing and information available, Actera will assist the customer with security obligations, impact assessments, regulator consultation and required breach notifications. The customer ordinarily decides its regulator and individual notices; neither party’s own legal duties are displaced. Operational support targets do not extend statutory deadlines.

International transfers

Actera will make a restricted transfer only on documented instructions and with a valid mechanism under Applicable Data Protection Law. Actera will make information about relevant destinations and safeguards available to the customer, including the applicable adequacy basis or contractual safeguards and any necessary supplementary measures.

This addendum does not itself complete or sign EU Standard Contractual Clauses, a UK Addendum or a UK International Data Transfer Agreement. Where such terms are required, the parties must complete the applicable modules/tables and annexes and put them into effect before the transfer. Required transfer terms prevail over conflicting commercial terms, including any incompatible limitation of liability or jurisdiction clause.

Return and deletion

At the customer’s choice, Actera will return Customer Personal Data in an available commonly used electronic format or delete it when the service ends, and delete remaining copies under the retention schedule unless applicable law requires storage. A customer may request return followed by deletion. Any legal retention must be limited to the required records and duration, protected from unrelated use and explained where lawful.

Backup copies will be kept out of ordinary use, expire through the recovery rotation described in the retention schedule and be subject to reapplication of deletions before restored systems resume ordinary processing. Actera will confirm completion on request, distinguishing active-system deletion from remaining backup expiry. Return, deletion and related assistance may be handled manually without changing these obligations.

Demonstrating compliance

Actera will provide information reasonably necessary to demonstrate compliance with this addendum and allow and contribute to proportionate audits and inspections by the customer or its mandated independent auditor. The parties will arrange timing, confidentiality and access to protect other customers and service security. Such arrangements must not prevent a necessary audit, regulator access or urgent verification after an incident. Any agreement on extraordinary audit costs must not defeat mandatory rights or Actera’s obligation to remedy its own breach.

Processing details

Actera-hosted AI policy assistance and managed workflows are outside this alpha’s processing instructions. Enabling them requires a revised scope and provider review before customer data enters those features.