Platform Data Processing Agreement

PARTIES AND EXECUTION

Entity details:

Semaloop Ltd

Company number: 16675807

Registered office address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

(referred to as “Semaloop” in the Main Agreement and “Semaloop” or “Processor” in this DPA).

Entity details:

The “Customer” as set out in the Main Agreement.

(referred to as “Customer” in the Main Agreement and “Customer” or “Controller” in this DPA).

Signature:

Signed in accordance with the Main Agreement.

Signature:

Signed in accordance with the Main Agreement.

Name:

Name:

Title:

Title:

Date:

Date:

VARIABLES

Parties’ relationship

Controller to Processor

Parties’ roles

Customer will act as the Controller (as defined in Section 1 of the Terms)

Semaloop will act as the Processor (as defined in Section 1 of the Terms)

Contacts

Controller

Processor

Name:

Email:

As set out in the Notices clause (Clause 12.12(a)(ii)) of the Main Agreement.

Name:

Email:

As set out in the Notices clause (Clause 12.2(a)(i)) of the Main Agreement.

Main Agreement

The Agreement entered into between Semaloop and the Customer in relation to the provision of the Platform under and in accordance with the “Semaloop Platform Terms of Service” at semaloop.com/terms

Term

This DPA will commence on the Effective Date as set out in the Main Agreement and will continue for the Term as set out in the Main Agreement.

Breach Notification Period

Without undue delay after becoming aware of a personal data breach

Sub-processor Notification Period

A reasonable timeframe before the new sub-processor is granted access to Personal Data

Liability Cap

Each party’s aggregate liability under this DPA will not exceed the liability caps as per the Main Agreement

Governing Law and Jurisdiction

As per the Main Agreement

Data Protection Laws

All laws, regulations and court orders which apply to the processing of Personal Data in the United Kingdom (UK). This includes the UK GDPR and the Data Protection Act 2018, each as amended from time to time.

Services related to processing

As described in the Main Agreement (the “Platform”)

Duration of processing

For the Term of this DPA

Nature and purpose of processing

Known Personal Data. The purpose of the Personal Data processing for the identifiable in-scope personal data is to enable the Customer’s personnel to access and use the Dashboard and for Semaloop to provide the Platform. This includes the collection, storage, updating and deletion of such Personal Data.

Unknown Personal Data. Any unknown Personal Data is such data that the Processor is not able to easily identify as subject to processing (as of the Effective Date) but may be processed in order to provide the Platform. To the extent that such unknown Personal Data is processed by Semaloop, the purpose is purely to enable Semaloop to deliver the Platform and, if the parties have agreed that Semaloop may use Customer Data to do so in the Main Agreement, to improve its product and train its AI models (here, acting as a controller in its own right).

Personal Data

Known Personal Data

The types of personal data processed are:

Customer’s personnel

• Identity Data: first name, last name, profile picture
• Contact Data: email address (work)

Unknown Personal Data

Customer’s customers or Customer’s customer’s customers

Semaloop may also process the Customer’s customer’s personal data that is not identifiable as of the Effective Date, in order to provide the Platform. Specifically, this may include any Customer’s customer’s personal data that is presented in the Customer’s mobile app for a Test. For example, names and pictures of other app users or comments and posts made by such users. This may include special categories of personal data.

Data subjects

The individuals whose Personal Data will be processed are:

• Customer’s personnel

And may include:

• Customer’s customers (consumers or business users)
• Customer’s customer’s customers (consumers or business users)

and any other data subjects whose Personal Data may be processed by the Processor in order to provide the Platform.

Special provisions

None

Transfer Mechanism

N/A

ANNEX 1

Security measures. Technical and organisational measures to ensure the security of Personal Data

Technical measures

• Encryption of customer data in transit (TLS) and at rest (AES-256 or equivalent).
  
• Role-based access control and least privilege to restrict system and data access.
  
• Multi-factor authentication for administrative and production system access.
  
• Logging and monitoring of infrastructure and application activity, including authentication events and administrative actions.
  
• Network security protections, including firewalls, restricted inbound access, and secure cloud configuration.
  
• Secure software development practices, including code review, version control, and security testing before deployment.
  
• Vulnerability management, including periodic vulnerability scanning and remediation based on severity.
  
• Segregation of development and production environments to prevent unauthorised access to production data.
  
• Regular backups and recovery procedures designed to support system restoration and availability.

Organisational measures

• Documented information security policies and procedures governing the protection of customer data.
  
• Defined security roles and responsibilities with oversight of security and compliance programs.
  
• Employee security awareness training at onboarding and periodically thereafter.
  
• Confidentiality obligations for employees and contractors with access to company systems or customer data.
  
• Access management procedures, including approval, periodic access reviews, and timely revocation upon role change or termination.
  
• Incident response processes for detecting, responding to, and resolving security incidents.
  
• Business continuity and disaster recovery planning, including periodic testing of recovery capabilities.
  
• Vendor and sub-processor risk management, including security due diligence and contractual security requirements.
  
• Independent security audits and monitoring, including SOC 2 Type 2 assessments.

ANNEX 2

Sub-processors. Current sub-processors