Data Processing Agreement

This Data Processing Agreement (this “DPA”) is entered into between Vygard Ltd, a company registered in England and Wales (“Processor”, “we”, “us”) and the entity executing the underlying Service Agreement for the Vygard service (the “Controller”, “you”). Each a “Party”, together the “Parties”.

We provide the Vygard safety-monitoring service (the “Service”) to you under the terms of a Service Agreement (the “Agreement”). The Service necessarily involves the Processing of Personal Data relating to your workers and administrators. This DPA forms part of the Agreement and governs that Processing under UK GDPR Article 28 and, where applicable, EU GDPR Article 28.

Capitalised terms not defined here have the meaning given in UK GDPR. Specifically:

• Controller, Processor, Sub-processor, Personal Data, Processing, Data Subject, Personal Data Breach: as defined in Article 4 UK GDPR.
• UK GDPR: the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 amending the General Data Protection Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland.
• EU GDPR: Regulation (EU) 2016/679 (the General Data Protection Regulation).
• UK IDTA: the United Kingdom International Data Transfer Agreement issued by the Information Commissioner.
• EU SCCs: the Standard Contractual Clauses approved by the European Commission in Decision (EU) 2021/914.
• Schedule: a schedule to this DPA, identified by letter.

The subject matter of the Processing is the operation of the Service for the Controller. The nature, purpose, types of Personal Data and categories of Data Subjects are set out in Schedule A. This DPA is co-terminus with the Agreement and continues for the term of the Agreement plus any wind-down period specified in clause 11.

The Processor will:

1. Process only on documented instructions. The Agreement, the Service's configurable settings, and any written instructions you give us via the in-product control panel constitute your documented instructions. We will notify you if we believe an instruction infringes data-protection law.
2. Ensure confidentiality. Every person we authorise to access Personal Data is bound by written confidentiality obligations or a statutory duty of confidence.
3. Implement appropriate security. We implement and maintain the technical and organisational measures set out in Schedule C to ensure a level of security appropriate to the risk, in accordance with Article 32 UK GDPR.
4. Engage Sub-processors only under written contracts imposing data-protection terms equivalent to this DPA. Our current Sub-processors are listed in Schedule B. You authorise us to engage them. Process for changes is in clause 6.
5. Assist with Data Subject rights. Taking into account the nature of the Processing, we will assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to Data Subject requests under UK GDPR Chapter III.
6. Assist with security, breach and DPIA obligations. We will help you comply with Articles 32 to 36 UK GDPR, taking into account the nature of the Processing and the information available to us.
7. Notify you of Personal Data Breaches within 24 hours of becoming aware of them, providing all information then known. Further detail is supplied as it emerges.
8. Return or delete Personal Data at the end of the Agreement in accordance with clause 11.
9. Make available all information necessary to demonstrate compliance with Article 28 UK GDPR, and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, subject to clause 8.

We will give you at least 30 days' advance notice of any intended addition or replacement of a Sub-processor by publishing the change to this page (Schedule B below) and emailing the notification contact you provide. If you reasonably object on data-protection grounds, you may terminate the affected portion of the Service without penalty within the 30-day notice window.

To subscribe to Sub-processor change notifications, email legal@vygard.com.

Personal Data is hosted in the United Kingdom by default. Where a Sub-processor is located outside the United Kingdom (or, for EU customers, the European Economic Area), transfers are made under the appropriate transfer mechanism listed in Schedule B (UK International Data Transfer Agreement and / or EU Standard Contractual Clauses). Onward transfers by Sub-processors are governed by their own contractual arrangements that mirror this DPA.

You may audit our compliance with this DPA once per year with at least 30 days' written notice, by reviewing our up-to-date third-party security audits (ISO 27001 / SOC 2 when available), penetration test executive summaries, and responses to your supplied security questionnaire (SIG Lite, SIG Core or CAIQ). On-site audits may be substituted where these documents do not adequately answer a specific risk, at your cost and during business hours, subject to reasonable confidentiality terms. We will respond to audit requests within 5 working days.

You are responsible for responding to requests from Data Subjects exercising their rights under UK GDPR Chapter III. We provide tooling within the Service to fulfil access, rectification, restriction, erasure, portability and objection requests for Personal Data we hold on your behalf. If a Data Subject contacts us directly, we will redirect them to you within 2 working days unless prohibited by law.

We will notify your nominated security contact within 24 hours of becoming aware of a Personal Data Breach affecting your Personal Data, providing at minimum: the nature of the breach, categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available and cooperate with you on regulator and Data Subject notifications.

On termination or expiry of the Agreement, at your written instruction within 30 days, we will either:

• Return all Personal Data to you in a portable format (JSON or CSV per category, ZIP archive), then delete; or
• Delete all Personal Data, except where retention is required by Union or Member State law.

Backups containing Personal Data are overwritten on their normal rotation cycle and fully purged within 35 days of termination. Audit logs retained under regulatory obligation (typically 7 years for safety incidents) are minimised to remove direct identifiers where possible.

The Parties' respective liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement. Where the Agreement does not contain such terms (e.g. click-through subscriptions), each Party's aggregate liability under this DPA is capped at 12 months' subscription fees paid under the Agreement.

In case of conflict between this DPA and the Agreement, this DPA prevails for matters relating to the Processing of Personal Data.

This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising from or in connection with this DPA.

You accept this DPA either by signing a countersigned PDF (available on request) or by clicking “I agree to the DPA” when prompted during onboarding. Either method binds your organisation.

Signed on behalf of the Processor:
Vygard Ltd · Director · 28 May 2026