Data Processing Agreement

01Definitions

The defined terms used in this DPA and their meanings.

1.1 In this DPA, the following terms have the meanings given below. Terms defined in the Terms of Service and not defined here have the same meaning as in the Terms of Service.

1.2 "Controller" means the entity that determines the purposes and means of processing personal data. For the purposes of this DPA, the Subscriber is the Controller in relation to personal data included in Customer Content.

1.3 "Data Subject" means an identified or identifiable natural person whose personal data is processed under this DPA.

1.4 "DPA 2018" means the Data Protection Act 2018.

1.5 "Personal Data" has the meaning given in UK GDPR -- that is, any information relating to an identified or identifiable natural person.

1.6 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed under this DPA.

1.7 "Processing" has the meaning given in UK GDPR and includes any operation performed on Personal Data, including collection, storage, retrieval, use, transmission, and deletion.

1.8 "Processor" means the entity that processes Personal Data on behalf of the Controller. For the purposes of this DPA, Bluto is the Processor in relation to Personal Data included in Customer Content.

1.9 "Restricted Transfer" means a transfer of Personal Data to a country or territory outside the United Kingdom that is not subject to an adequacy decision made by the Secretary of State under UK GDPR.

1.10 "Security Incident" means any confirmed breach of security affecting Bluto's systems or infrastructure that results in a Personal Data Breach.

1.11 "Standard Contractual Clauses" means the standard data protection clauses approved under UK GDPR for the transfer of Personal Data to countries outside the United Kingdom, including where applicable the UK Addendum to the European Commission's standard contractual clauses issued by the Information Commissioner's Office.

1.12 "Sub-Processor" means any third party engaged by Bluto to process Personal Data on behalf of the Subscriber in connection with the provision of the Service.

1.13 "UK GDPR" means the UK General Data Protection Regulation, being Regulation (EU) 2016/679 as it forms part of domestic law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended from time to time.

02Details of Processing

The subject matter, nature, purpose, duration, and scope of processing under this DPA.

2.1 Subject matter. This DPA governs the processing of Personal Data included in Customer Content by Bluto as Processor on behalf of the Subscriber as Controller, in connection with the provision of the Service.

2.1.1 This DPA applies to Personal Data contained in Customer Content, in respect of which the Subscriber is the Controller. It does not apply to personal data that Bluto processes as Controller in its own right -- including account and billing data, and correspondence between the Subscriber and Bluto such as support enquiries. Bluto's processing of that data is described in the Privacy Policy at bluto.ai/legal/privacy.

2.2 Nature of processing. Bluto processes Personal Data included in Customer Content by storing, hosting, retrieving, and transmitting it as necessary to provide the Service. Where the Service applies automated processing to Customer Content -- including AI-powered features and the automated extraction of data from documents you submit -- that processing may be carried out by Sub-Processors in accordance with clause 04. Bluto does not access the substantive content of Customer Content except as expressly described in the Terms of Service and this DPA.

2.3 Purpose. Bluto processes Personal Data under this DPA solely for the purpose of providing the Service to the Subscriber in accordance with the Terms of Service, and for no other purpose.

2.4 Duration. Processing under this DPA begins when the Subscriber first submits Customer Content containing Personal Data to the Service and continues for the duration of the Agreement. Upon termination or expiry, Bluto shall retain and delete Personal Data in accordance with clause 3.10.

2.5 Types of Personal Data. The categories of Personal Data processed under this DPA are determined by the Subscriber and depend on the nature of the Customer Content it submits to the Service. They may include names, email addresses, job titles, financial data, and other business contact or biographical information relating to founders, investors, employees, advisers, and other individuals referenced in the Subscriber's financial models, cap tables, pitch decks, and business plans. The Subscriber is responsible for ensuring that it does not submit special category personal data as defined under UK GDPR unless it has an explicit lawful basis for doing so and has notified Bluto accordingly.

2.6 Categories of Data Subjects. Data Subjects whose Personal Data may be processed under this DPA include founders and co-founders, investors and shareholders, employees and contractors, professional advisers, and other individuals whose personal details the Subscriber includes in Customer Content.

2.7 The Subscriber, as Controller, is responsible for determining the categories of Personal Data it submits to the Service, ensuring that it has a lawful basis for each processing activity it carries out using the Service, and ensuring that Data Subjects have been informed of the processing in accordance with applicable data protection law.

03Processor Obligations

Bluto's obligations as Processor under Article 28 of UK GDPR.

3.1 Instructions. Bluto shall process Personal Data only on documented instructions from the Subscriber, as set out in the Terms of Service and this DPA. If Bluto is required by applicable law to process Personal Data in a manner not covered by the Subscriber's instructions, Bluto shall notify the Subscriber of that legal requirement before processing unless prohibited from doing so by law.

3.2 Unlawful instructions. Bluto shall notify the Subscriber promptly if, in Bluto's reasonable opinion, an instruction from the Subscriber would cause Bluto to act in breach of UK GDPR or DPA 2018. Bluto is not obliged to comply with any instruction it reasonably determines to be unlawful.

3.3 Confidentiality. Bluto shall ensure that all personnel authorised to process Personal Data under this DPA are subject to binding confidentiality obligations in relation to that Personal Data and are aware of their data protection obligations under applicable law.

3.4 Security. Bluto shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access, in accordance with Article 32 of UK GDPR. Such measures shall take into account the nature, scope, context, and purposes of processing and the risks to the rights and freedoms of Data Subjects. Bluto's current security measures are described in the Security Policy at bluto.ai/legal/security and form part of this DPA.

3.5 Sub-Processors. Bluto shall not engage Sub-Processors except as permitted under clause 04. Bluto shall impose on each Sub-Processor data protection obligations equivalent to those set out in this DPA and shall remain liable to the Subscriber for the performance of each Sub-Processor's obligations.

3.6 Data Subject rights. Bluto shall, taking into account the nature of the processing, assist the Subscriber by appropriate technical and organisational means to fulfil the Subscriber's obligations to respond to Data Subject rights requests under UK GDPR, including requests relating to access, rectification, erasure, restriction of processing, and data portability. Where Bluto receives a rights request directly from a Data Subject in relation to Personal Data for which the Subscriber is the Controller, Bluto shall forward that request to the Subscriber without undue delay and in any event within five working days of receipt.

3.7 Security assistance. Bluto shall assist the Subscriber in ensuring compliance with its obligations under Articles 32 to 36 of UK GDPR, including in relation to security of processing, notification of Personal Data Breaches, and data protection impact assessments, taking into account the information available to Bluto and the nature of the processing carried out under this DPA.

3.8 Personal Data Breach notification. Bluto shall notify the Subscriber without undue delay, and in any event within 72 hours of becoming aware of a Security Incident affecting Personal Data processed under this DPA.

3.8.1 Such notification shall include, to the extent then known, a description of the nature of the Security Incident including the categories and approximate number of Data Subjects and Personal Data records affected.

3.8.2 Bluto shall provide the name and contact details of its data protection contact, a description of the likely consequences of the Security Incident, and a description of the measures taken or proposed to address it and mitigate its effects.

3.8.3 Where it is not possible to provide all information within 72 hours, Bluto shall provide the available information and supply further details as soon as reasonably practicable thereafter.

3.9 Supervisory authority notification. Bluto shall not notify the Information Commissioner's Office or any other supervisory authority of a Security Incident on the Subscriber's behalf unless the Subscriber has expressly requested it to do so in writing. The Subscriber, as Controller, retains sole responsibility for notifying the relevant supervisory authority and affected Data Subjects in accordance with its obligations under UK GDPR.

3.10 Deletion and return. Upon expiry or termination of the Agreement, or upon the Subscriber's written request, Bluto shall at the Subscriber's election delete or return all Personal Data processed under this DPA, together with all existing copies, unless Bluto is required by applicable law to retain the Personal Data for a longer period.

3.10.1 Bluto shall confirm completion of deletion to the Subscriber in writing within 7 days of the relevant trigger event.

3.10.2 Personal Data is backed up automatically on a daily basis. Automated backups are retained for 7 days. After expiry of the 7-day backup retention period, backup copies are permanently purged. Personal Data cannot be recovered from backup after this period.

3.11 Audit rights. Bluto shall make available to the Subscriber all information reasonably necessary to demonstrate compliance with this DPA and with Article 28 of UK GDPR, and shall permit and contribute to audits and inspections conducted by the Subscriber or a mandated auditor.

3.11.1 The Subscriber shall give Bluto reasonable prior written notice of not less than 30 days before conducting any audit or inspection.

3.11.2 Any audit shall be conducted during normal business hours in a manner that does not unreasonably disrupt Bluto's operations or those of its other customers.

3.11.3 Any third-party auditor appointed by the Subscriber shall enter into a confidentiality agreement with Bluto on reasonable terms before commencing any review.

3.11.4 The Subscriber shall bear all reasonable costs associated with any audit or inspection it conducts under this clause 3.11.

3.12 Bluto may satisfy its obligations under clause 3.11 in whole or in part by providing the Subscriber with copies of relevant third-party audit reports, security certifications, or penetration test summaries, subject to appropriate confidentiality obligations.

04Sub-Processors

The terms on which Bluto may engage third parties to process Personal Data on the Subscriber's behalf.

4.1 The Subscriber grants Bluto general authorisation to engage Sub-Processors for the purpose of providing the Service, subject to the conditions set out in this clause 04.

4.2 Current Sub-Processors. A current list of Sub-Processors engaged by Bluto to process Personal Data in connection with the Service, including the name, location, and nature of processing of each provider, is published at bluto.ai/legal/subprocessors and is updated as changes are made.

4.3 New Sub-Processors. Bluto shall provide the Subscriber with at least 14 days' prior written notice of any intended addition of a new Sub-Processor or material change to an existing Sub-Processor, by updating the Sub-Processor list at bluto.ai/legal/subprocessors and, where the Subscriber has subscribed to update notifications, by email to the address associated with the Subscriber's account.

4.4 Right to object. The Subscriber may object to a new Sub-Processor within 14 days of receiving notice under clause 4.3 by notifying Bluto in writing at [email protected], provided that the objection is based on reasonable and documented data protection grounds.

4.4.1 Where the Subscriber raises a valid objection, Bluto shall use commercially reasonable efforts to make available a change in the configuration or provision of the Service that avoids the use of the new Sub-Processor.

4.4.2 If Bluto is unable to make such a change available within a reasonable time and the Subscriber maintains its objection, either party may terminate the Subscriber's Subscription Plan on written notice, and Bluto shall provide a pro-rated refund of prepaid unused Subscription Fees.

4.5 Flow-down obligations. Bluto shall, by written contract, impose on each Sub-Processor data protection obligations that are at least equivalent to those imposed on Bluto under this DPA. Bluto shall remain fully liable to the Subscriber for the performance of each Sub-Processor's data protection obligations under this DPA.

4.6 AI and document processing providers. The Subscriber acknowledges that certain automated processing within the Service -- including AI-powered features and the extraction of data from submitted documents -- is carried out in whole or in part by third-party providers acting as Sub-Processors.

4.6.1 Bluto assesses each such provider for compliance with its data protection obligations before engaging it, and maintains a data processing agreement with each.

4.6.2 Bluto shall not engage a Sub-Processor that reserves the right to use Personal Data submitted through the Service to train or improve its own artificial intelligence or machine learning models, and shall maintain contractual protections to that effect with each such Sub-Processor.

4.6.3 Where a Sub-Processor changes its position such that Bluto can no longer maintain the protection described in clause 4.6.2, Bluto shall cease using that Sub-Processor for the processing concerned or, where that is not immediately possible, notify the Subscriber in accordance with clause 4.3.

4.6.4 Bluto shall notify the Subscriber of any material change to a provider engaged under this clause in accordance with clause 4.3.

05General Provisions

The remaining terms that govern this DPA.

5.1 Relationship to Terms of Service. This DPA forms part of the Agreement and is incorporated into the Terms of Service by reference. In the event of any conflict between this DPA and the Terms of Service in relation to the processing of Personal Data, this DPA shall prevail.

5.2 Governing law. This DPA and any dispute or claim arising out of or in connection with it, whether contractual or non-contractual, shall be governed by and construed in accordance with the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction to settle any such dispute.

5.3 Liability. Each party's liability under this DPA is subject to the limitations and exclusions set out in clause 11 of the Terms of Service. Nothing in this DPA excludes or limits either party's liability to the extent that it cannot lawfully be excluded or limited under UK GDPR, DPA 2018, or other applicable law.

5.4 International transfers. Where Bluto makes a Restricted Transfer of Personal Data in the performance of this DPA, it shall ensure that such transfer is subject to appropriate safeguards in accordance with UK GDPR, including where applicable the Standard Contractual Clauses. Information about the specific safeguards relied upon for any transfer is available on request at [email protected].

5.5 Term. This DPA enters into force on the Effective Date and continues for the duration of the Agreement. It terminates automatically on expiry or termination of the Agreement, subject to clause 3.10.

5.6 Amendments. Bluto may update this DPA from time to time to reflect changes in applicable law, regulatory guidance, or its processing activities. Bluto shall notify the Subscriber of material amendments in accordance with clause 14.5 of the Terms of Service. The Subscriber's continued use of the Service after the effective date of an amendment constitutes acceptance of the updated DPA.

5.7 Contact. For all queries relating to this DPA, data subject rights requests, and data protection concerns, please contact Bluto's data protection contact at [email protected] or by post at Bluto AI Limited, 20 Red Lion Street, London, England, WC1R 4PS.