Data Processing Agreement

For the purposes of this DPA:

• Controller means the entity that determines the purposes and means of processing personal data.
• Processor means Feasibly Ltd, which processes personal data on behalf of the Controller.
• Personal Data has the meaning given under the UK GDPR.

Feasibly processes personal data solely for the purpose of providing the Platform and related services.

Processing activities may include:

• storing user account information
• processing user queries submitted through the Platform
• generating AI responses
• maintaining service logs
• providing customer support

The Controller is responsible for:

• ensuring it has a lawful basis for processing personal data;
• ensuring that any personal data submitted to the Platform complies with applicable data protection laws;
• providing appropriate notices to data subjects where required.

Feasibly shall:

• process personal data only on documented instructions from the Controller;
• ensure personnel handling personal data are subject to confidentiality obligations;
• implement appropriate technical and organisational security measures;
• assist the Controller in responding to data subject rights requests where reasonably required.

Feasibly maintains appropriate security measures including:

• secure cloud hosting
• access controls
• monitoring and logging systems
• protection against unauthorised access

These measures are designed to protect personal data against accidental or unlawful destruction, loss, alteration, or disclosure.

Feasibly may engage third-party subprocessors to support the provision of the Platform.

Typical categories of subprocessors include:

• cloud infrastructure providers
• payment processors
• analytics services
• email delivery providers

Feasibly shall ensure such subprocessors are subject to appropriate data protection obligations.

Feasibly shall assist the Controller, where reasonably possible, in responding to requests from data subjects exercising their rights under applicable data protection laws.

Feasibly will notify the Controller without undue delay after becoming aware of a personal data breach affecting personal data processed on behalf of the Controller.

Upon termination of the customer relationship, Feasibly will delete or return personal data processed on behalf of the Controller, unless retention is required by law.

Where personal data is transferred outside the UK or EEA, Feasibly shall ensure appropriate safeguards are implemented in accordance with applicable data protection legislation.

This DPA is governed by the laws of England and Wales.