# Data Processing Agreement (DPA) — Prospero Tools **Template version:** 1.0 · Draft, governing law: Jersey **Last updated:** _to be set on first execution_ This Data Processing Agreement ("**DPA**") forms part of the Order Form, Master Services Agreement or other written or electronic agreement (the "**Agreement**") between: - **Prospero Advisory Limited**, a company registered in Jersey, Channel Islands (company number 166208), trading as **Prospero Tools** ("**Processor**"); and - the customer identified in the Agreement ("**Controller**"). It governs the Processing of Personal Data by Processor on behalf of Controller in connection with the Services (Brief and Minutes, collectively the "**Services**"). --- ## 1. Definitions Terms not defined here have the meaning given in the Data Protection (Jersey) Law 2018 ("**DPJL**") and, where applicable, Regulation (EU) 2016/679 ("**UK/EU GDPR**"). - **Personal Data** — data relating to an identified or identifiable natural person that Controller (or its authorised users) submits to or generates through the Services. - **Processing** — has the meaning given in Article 1(1) of the DPJL. - **Sub-processor** — any third party engaged by Processor to Process Personal Data on behalf of Controller. - **Restricted Transfer** — a transfer of Personal Data to a country outside Jersey, the United Kingdom and the European Economic Area that does not benefit from an adequacy decision applicable to the transfer. --- ## 2. Scope and roles 1. Controller is the **controller** of the Personal Data. Processor acts as **processor** when Processing Personal Data on Controller's behalf. 2. Processor will Process Personal Data only on documented instructions from Controller, which instructions are set out in the Agreement, this DPA, and Controller's use of the Services. 3. The subject-matter, duration, nature and purpose of the Processing, the categories of data subjects, and the types of Personal Data are described in **Annex 1**. --- ## 3. Processor obligations Processor will: 1. Process Personal Data only for the purposes set out in Annex 1 and in accordance with Controller's instructions. 2. Ensure that personnel authorised to Process Personal Data are bound by confidentiality undertakings of no less protection than those in this DPA. 3. Implement and maintain the technical and organisational measures described in **Annex 2** to protect Personal Data against unauthorised or unlawful Processing and against accidental loss, destruction, damage, alteration or disclosure. 4. Notify Controller without undue delay, and in any event within **72 hours**, of becoming aware of a Personal Data Breach affecting Controller's Personal Data, providing the information reasonably required for Controller to comply with its own notification obligations. 5. Assist Controller, taking into account the nature of the Processing and the information available to Processor, in fulfilling its obligations to respond to data subject requests, to carry out data protection impact assessments and to consult with supervisory authorities. --- ## 4. Sub-processors 1. Controller grants Processor a **general authorisation** to engage Sub-processors. The Sub-processors in use as at the effective date of this DPA are listed at and reproduced in **Annex 3**. 2. Processor will provide at least **30 days' notice** of any intended change to the list of Sub-processors. Controller may object to a change on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, Controller may terminate the affected Services without penalty. 3. Processor will impose on each Sub-processor data-protection obligations no less protective than those in this DPA and remains liable for any failure by a Sub-processor to meet those obligations. --- ## 5. International transfers 1. Processor will not make a Restricted Transfer of Personal Data without first putting in place an appropriate transfer mechanism (such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision). 2. Production Processing of Personal Data takes place in the **European Union (Frankfurt, `eu-central-1`)**. LLM inference is performed in the **European Union** via Google Vertex AI. Voice transcription (Minutes only) is performed by Speechmatics, a UK-headquartered processor, in its EU region. No Sub-processor listed in Annex 3 involves a Restricted Transfer as at the effective date. --- ## 6. Audit 1. Once per twelve-month period, and on no less than **30 days' written notice**, Controller may request the most recent independent audit reports held by Processor (e.g. SOC 2 Type II, ISO 27001), subject to reasonable confidentiality undertakings. 2. Where independent reports are insufficient to demonstrate compliance with this DPA, the parties will agree the scope, timing and cost of any further audit. Audits will be conducted during normal business hours, in a manner that does not unreasonably interfere with Processor's operations. --- ## 7. Return and deletion 1. Operational data (board packs, briefings, audio recordings, transcripts, minutes drafts, extracted text, and original filenames) is automatically purged within **60 minutes** of generation or upload, in line with the Services' design. Runs that fail are purged within **15 minutes** of the failure. 2. Account metadata (profile, brief and meeting shell records, audit log entries) is retained for the duration of the Agreement. Shell records carry no pack-derived content past the deletion window. 3. Named Processor personnel may access a Controller record during its processing window for the sole purpose of support. Access to shell metadata is audited; revealing pack-derived content additionally requires fresh multi-factor verification and a written reason, both written to the append-only audit log available to the Controller's workspace admin. 4. On termination of the Agreement, Processor will, at Controller's choice, return or delete all remaining Personal Data within **30 days**, except where retention is required by law. --- ## 8. Liability and term 1. The liability provisions of the Agreement apply to this DPA. 2. This DPA takes effect on the date of the Agreement and continues for as long as Processor Processes Personal Data on behalf of Controller. 3. In the event of conflict between this DPA and the Agreement on matters of data protection, this DPA prevails. --- ## 9. Governing law This DPA is governed by the laws of Jersey. The parties submit to the exclusive jurisdiction of the courts of Jersey, save that Controller may bring claims in any other competent jurisdiction where required by mandatory law. --- ## Annex 1 — Processing details | Item | Details | | --- | --- | | **Subject matter** | Provision of the Brief and Minutes services to Controller. | | **Duration** | The term of the Agreement, plus the deletion period in clause 7. | | **Nature and purpose** | Document summarisation, meeting transcription and minute generation for Controller's directors, officers and authorised users. Brief sends redacted text to the LLM; Minutes sends the board-pack PDF to the LLM under the multimodal path so that scanned pages, image-based tables and signed appendices can be read. Both paths run in the EU. | | **Categories of data subjects** | Controller's directors, officers, employees, advisors, meeting attendees and any third parties named in board materials. | | **Categories of Personal Data** | Names, contact details, employment titles, voice recordings, transcript text, contents of board materials uploaded by Controller. | | **Special category data** | Not requested. Controller is responsible for not submitting Article 9 / DPJL Schedule 2 special category data unless lawful and necessary. | --- ## Annex 2 — Technical and organisational measures 1. **Tenancy** — workspace-level isolation enforced by Postgres row-level security; every record carries a `tenant_id` validated on read and write. 2. **Encryption** — TLS 1.2+ in transit; AES-256 at rest for database and object storage. 3. **Authentication** — email/passwordless, Google SSO, and SAML SSO for corporate workspaces. Manual approval gate during beta. 4. **Access control** — least-privilege role model; admin actions recorded in the append-only audit log. 5. **Pseudonymisation (Brief)** — for the Brief service, names, emails, phone numbers, IBANs and National Insurance numbers are tokenised before transmission to the LLM and rehydrated on return ("PII redaction"). For the Minutes service, the board-pack PDF is sent directly to Google Vertex AI in the EU under the multimodal path so that scanned and image-based content can be read; pseudonymisation is not applied on that path. Both paths remain within the EU and use only sub-processors listed in Annex 3. 6. **Data minimisation** — board pack content, briefings, audio recordings and transcripts are deleted within 60 minutes of generation. 7. **Audit log** — append-only, hash-chained per user; retained for 24 months; contains hashes and event metadata only. 8. **Incident response** — 24/7 monitoring; security disclosures via `/.well-known/security.txt`; breach notification within 72 hours. 9. **Vendor management** — sub-processors selected on the basis of security posture, data residency and contractual data-protection commitments. --- ## Annex 3 — Approved Sub-processors (as at effective date) | Sub-processor | Service | Region | | --- | --- | --- | | Supabase (AWS) | Database, auth, storage | EU — Frankfurt | | Google Cloud (Vertex AI) | LLM inference | EU | | Mailgun | Transactional email (inbound and outbound) | EU | | Speechmatics | Voice transcription (Minutes only) | EU (Speechmatics EU region) | The live list is maintained at . --- ## Signatures **For Controller** Name: ________________________ Title: ________________________ Signature: ____________________ Date: ________________________ **For Prospero Advisory Limited (trading as Prospero Tools)** Name: ________________________ Title: ________________________ Signature: ____________________ Date: ________________________