Data Processing Addendum

This Addendum is entered into between the client identified in the engagement letter or account record (the Controller) and Noahsure Group Limited, trading as Undercover Audit, 1 Canada Square, Canary Wharf, London, E14 5AA (the Processor). It forms part of our Terms of Service and applies whenever we process personal data on the Controller's behalf. It is drafted to satisfy Article 28 of the UK GDPR and, where the EU GDPR applies, Article 28 of Regulation (EU) 2016/679.

The Controller determines the purposes and means of processing data drawn from its own systems and premises. The Processor processes that data only on the Controller's documented instructions, being this Addendum, the engagement letter and the configuration of the integrations the Controller connects. The Processor acts as an independent controller only for its own account, billing and security records, which are covered by the Privacy Policy rather than this Addendum.

• Subject matter: provision of the Undercover Audit platform, AI analysis, training and audit services.
• Duration: the term of the engagement or subscription, plus the retention windows in section 9.
• Nature and purpose: read-only collection, storage, transcription, classification, scoring, aggregation and reporting of operational data in order to produce findings, an operational scorecard, a 30/60/90 action plan and training aligned to the Controller's own material.

• Data subjects: the Controller's employees, contractors and managers; its customers, prospects and callers; and job candidates where a hiring engine is in scope.
• Personal data: names, business contact details, job roles, call recordings and transcripts, chat and ticket content, CRM activity and notes, application and interview records, rota and productivity metrics, and identifiers such as agent IDs and IP addresses.
• Special category data: not requested and not required. If the Controller's systems contain it incidentally, the Processor will not target it, and the parties will agree additional safeguards in writing before any scope that would involve it deliberately.

• Process personal data only on documented instructions, and never for its own purposes.
• Never sell personal data, and never use Controller data to train general-purpose or third-party AI models. AI sub-processors are engaged under zero-retention, no-training terms.
• Ensure personnel with access are subject to confidentiality obligations that survive termination, are vetted, and are granted least-privilege access on a named-individual basis.
• Assist the Controller with data protection impact assessments and prior consultations.
• Inform the Controller without undue delay if an instruction appears to infringe data protection law.

• TLS 1.2 or higher in transit; AES-256 or equivalent at rest.
• Logical tenant separation with row-level security so a client can only read its own audits.
• Read-only, least-privilege credentials for every connected source system.
• Multi-factor authentication and quarterly access reviews for all internal accounts.
• Audit logging of administrative access, retained for 12 months.
• Encrypted, access-controlled backups with tested restore procedures.
• Change management, dependency scanning and secure development practices.
• Documented incident response plan, rehearsed at least annually.

The Controller gives general authorisation for the Processor to engage sub-processors for hosting, database and authentication, email delivery, payment processing and AI model inference. Each is bound by written terms no less protective than this Addendum, and the Processor remains liable for their performance.

A current sub-processor list is available from privacy@aisure.uk. The Processor will give at least 30 days' notice before adding or replacing a sub-processor, during which the Controller may object on reasonable data protection grounds; if the objection cannot be resolved, the Controller may terminate the affected service without penalty for the unused period.

Processing takes place in the UK and EEA by default. Where personal data is transferred outside the UK or EEA, the transfer is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the SCCs alone where the EU GDPR applies), supported by a transfer risk assessment and the technical measures in section 6. Those clauses are incorporated into this Addendum by reference, with the Controller as data exporter and the Processor as data importer, module two.

• Raw data ingested from connected systems is deleted or returned within 30 days of the engagement ending, unless law requires retention.
• Derived findings, scorecards and action plans are retained for 24 months so remediation can be tracked, then deleted, or sooner on written request.
• Portal account data is deleted 90 days after account closure. Billing records are retained for 7 years as required by UK law.
• Deletion is confirmed in writing on request.

The Processor will not respond directly to a data subject except to confirm that the request should be directed to the Controller. It will notify the Controller of any request it receives without undue delay and, taking account of the nature of the processing, provide reasonable assistance — including search, export, correction and deletion within the platform — to enable the Controller to respond within statutory deadlines.

The Processor will notify the Controller without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting the Controller's data, with the nature of the breach, categories and approximate volumes of data and data subjects affected, likely consequences, and the measures taken or proposed. It will cooperate with the Controller's regulatory notifications and will not make a public statement identifying the Controller without prior agreement, unless legally compelled.

On request, and no more than once in any 12-month period unless required by a regulator or following a breach, the Processor will make available the information necessary to demonstrate compliance with this Addendum. That may be satisfied by a completed security questionnaire, policy documentation and, where reasonably required, a remote audit at the Controller's cost, on 30 days' notice, during business hours, subject to confidentiality and without access to other clients' data.

Where this Addendum conflicts with the Terms of Service on the processing of personal data, this Addendum prevails. A signed, negotiated DPA between the parties prevails over this Addendum. The Processor may update it to reflect legal or sub-processor change with 30 days' notice, provided protection for data subjects is not reduced. A countersigned PDF copy is available on request from privacy@aisure.uk.