Data Processing Agreement

ClientScan Limited, trading as TakeNote.ai, a company registered in England and Wales, company number 14828718, registered office 7 Bell Yard, London WC2A 2JR (the "Processor");

and [Insert Client Name], a company registered in England and Wales, company number [ ], registered office [ ], FCA Firm Reference Number [ ] (the "Controller").

A. The Controller is an FCA-authorised firm providing financial advisory services and processes personal data in that connection.

B.The Processor provides AI-assisted meeting capture, transcription, summarisation and compliance documentation services (the "Services").

C. In providing the Services the Processor processes personal data on behalf of the Controller.

D.This Agreement is made to satisfy Article 28(3) UK GDPR and supplements the principal service agreement between the Parties (the "Principal Agreement").

Applicable Data Protection Law

The UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any successor or related legislation.

Client Data

All personal data processed by the Processor on behalf of the Controller under the Services, including meeting audio, transcripts, summaries, generated documents, client records and associated metadata.

Data Subject

An identified or identifiable natural person whose personal data is processed under this Agreement, including the Controller's clients, their dependants, the Controller's personnel and other meeting participants.

Personal Data Breach

A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Data.

Special Category Data

Personal data within Article 9(1) UK GDPR.

Sub-processor

Any third party engaged by the Processor to process Client Data.

Terms not defined here carry the meaning given in the UK GDPR.

2.1 In respect of Client Data the Controller is the controller and the Processor is the processor.

2.2 The Processor is an independent controller only in respect of its own account administration, billing and service-security data, which it processes under its own privacy notice.

2.3 Each Party complies with Applicable Data Protection Law in respect of its own activities.

3.1The Processor processes Client Data only on the Controller's documented instructions, as set out in Annex 1, this Agreement and the Principal Agreement.

3.2 The Processor does not process Client Data for any other purpose unless required by law, in which case it informs the Controller before processing unless legally prohibited.

3.3 The Processor informs the Controller without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Law. The Processor may suspend the affected processing until the instruction is confirmed, amended or withdrawn.

3.4The Processor does not use Client Data to train, fine-tune, evaluate or otherwise develop any machine learning or artificial intelligence model, whether its own or a third party's. The Processor contracts with each AI Sub-processor on terms that prohibit such use and require zero retention of Client Data after processing.

4.1 The Parties acknowledge that advisory conversations may disclose Special Category Data, in particular data concerning health relevant to protection, annuity, long-term care or life-expectancy matters, and indicators of vulnerability.

4.2 Such data is not solicited by the Services. It arises incidentally in unstructured speech and cannot be reliably excluded by technical means.

4.3 The Controller is responsible for identifying and documenting its Article 9(2) condition and, where required, its Schedule 1 Data Protection Act 2018 condition, and for maintaining any appropriate policy document required by that Schedule.

4.4 The Processor applies the measures in Annex 2 to all Client Data without distinction as to category.

The Processor shall:

• (a) process Client Data only as set out in clause 3;
• (b) ensure persons authorised to process Client Data are subject to binding confidentiality obligations;
• (c) implement and maintain the measures in Annex 2;
• (d) engage Sub-processors only in accordance with clause 8;
• (e) assist the Controller in responding to Data Subject requests under clause 10;
• (f) assist the Controller in complying with Articles 32 to 36 UK GDPR, including data protection impact assessments and prior consultation;
• (g) notify Personal Data Breaches under clause 11;
• (h) make available information necessary to demonstrate compliance, and submit to audit under clause 13;
• (i) delete or return Client Data under clause 14.

6.1 The Processor ensures that personnel with access to Client Data are subject to background screening appropriate to the role, where lawful and proportionate.

6.2 Personnel receive data protection and information security training on appointment and at least annually.

6.3 Access is granted on a least-privilege basis and revoked promptly on change of role or termination.

7.1 The Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, having regard to the state of the art, cost of implementation, and the nature, scope, context and purposes of processing. Those measures are set out in Annex 2.

7.2 The Processor may update the measures in Annex 2 provided the overall level of security is not materially reduced.

7.3Annex 2 states the Processor's current control position accurately, including controls not yet in place. The Controller acknowledges it has had the opportunity to assess those matters.

8.1 The Controller grants general written authorisation for the engagement of the Sub-processors listed in Annex 3.

8.2The Processor gives the Controller at least 30 days' prior written notice of any intended addition or replacement of a Sub-processor.

8.3 The Controller may object on reasonable data protection grounds within that notice period. If the objection cannot be resolved, the Controller may terminate the affected Services without penalty, with a pro-rata refund of prepaid fees.

8.4The Processor imposes on each Sub-processor data protection obligations no less protective than those in this Agreement, and remains fully liable to the Controller for each Sub-processor's performance.

9.1 The Processor does not transfer Client Data outside the United Kingdom except as recorded in Annex 3.

9.2 Where a transfer occurs, the Processor ensures it is subject to an appropriate Chapter V UK GDPR mechanism — UK adequacy regulations, an International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — supported by a documented Transfer Risk Assessment and any necessary supplementary measures.

9.3 The Processor provides copies of the relevant transfer mechanism and Transfer Risk Assessment to the Controller on request.

10.1 The Processor promptly notifies the Controller of any request received directly from a Data Subject and does not respond substantively unless instructed.

10.2 The Processor provides functionality enabling the Controller to satisfy requests for access, rectification, erasure and portability, including structured export of client records, meetings, transcripts, summaries, documents, forms, notes, tasks and signature history, and deletion of a client record and associated data by a firm administrator.

10.3 The Parties acknowledge that meeting audio and transcripts are a contemporaneous record. Rectification is effected by annotation rather than alteration of the original, so that the integrity of the regulatory record is preserved. Erasure of the underlying record remains available to the Controller.

11.1 The Processor notifies the Controller without undue delay and in any event within 24 hours of becoming aware of a Personal Data Breach affecting Client Data.

11.2The notification includes, to the extent available: the nature of the breach and categories and approximate number of Data Subjects and records concerned; the name and contact details of the Processor's data protection contact; likely consequences; and measures taken or proposed, including mitigation.

11.3 Where information is not available at the time of notification, it is provided in phases without further undue delay.

11.4 The Processor does not notify the ICO or any Data Subject in respect of Client Data unless required by law or instructed by the Controller.

11.5 The Processor maintains a documented incident response procedure.

The Processor provides reasonable assistance with the Controller's data protection impact assessments, including its published DPIA summary and reasonable responses to security questionnaires.

13.1The Controller may verify compliance by requesting evidence of compliance; reviewing security documentation provided under non-disclosure agreement; conducting an on-site audit on at least 30 days' notice, no more than once in any 12-month period unless required by a supervisory authority or following a Personal Data Breach; or appointing an independent auditor at the Controller's expense, subject to reasonable confidentiality terms.

13.2Audits are conducted during business hours with minimal disruption and must not compromise the confidentiality or security of other customers' data.

14.1 The Processor processes Client Data for the retention period configured by the Controller. The Controller is solely responsible for determining that period having regard to its own regulatory obligations, including SYSC 10A.1.10 and, where relevant, longer periods applicable to pension transfer and defined benefit advice.

14.2On expiry or termination, the Processor deletes or returns Client Data at the Controller's election within 15 days, save to the extent retention is required by law.

14.3 Client Data may persist in encrypted backups for the backup cycle then in effect, after which it is overwritten.

14.4 The Processor certifies deletion in writing on request.

Liability under this Agreement is subject to the limitations and exclusions in the Principal Agreement, save that nothing limits liability which cannot lawfully be limited.

16.1 This Agreement takes effect on the Effective Date and continues while the Processor processes Client Data.

16.2 In the event of conflict, this Agreement prevails over the Principal Agreement in respect of data protection matters. Where a Chapter V transfer mechanism applies, that mechanism prevails over this Agreement to the extent of any conflict.

16.3 This Agreement is governed by the laws of England and Wales, and the Parties submit to the exclusive jurisdiction of the English courts.