Data Processing Agreement

Data Processing Agreement (DPA)

This DPA forms part of your agreement with Trade Scale Plus Ltd (your subscription, or a signed pilot agreement or order form) and governs our processing of personal data on your behalf, as required by UK GDPR Article 28 and the Data Protection Act 2018.

Version 1.2 · Effective 12 May 2026 · Last updated 15 October 2026

The parties

Controller	The dealer / business entity that subscribes to TradeScale Plus and uses the service to process personal data of its own customers ("you", "the Controller")
Processor	Trade Scale Plus Ltd, registered in England & Wales under company number 17142290, with its registered office at 12 Randell Square, Porth Tywyn, SA16 0TY, United Kingdom ("we", "the Processor")

This DPA is incorporated into and forms part of the Terms of Service between the parties. You accept this DPA by subscribing to TradeScale Plus, or by signing a pilot agreement or order form that refers to it.

1. Definitions

Capitalised terms not defined here have the meanings given in the UK GDPR and the Data Protection Act 2018 (together "Data Protection Law"). Key terms:

• Customer Personal Data: personal data of the Controller's own customers that is processed via the service.
• Data Subject: an identifiable natural person whose data is processed (typically the dealer's customer).
• Sub-processor: any third party engaged by us to process Customer Personal Data on the Controller's behalf.
• Processing: has the meaning set out in UK GDPR Article 4(2).
• Personal Data Breach: has the meaning set out in UK GDPR Article 4(12).

2. Roles & scope

The Controller determines the purposes and means of processing Customer Personal Data. The Processor processes Customer Personal Data on the Controller's documented instructions, namely (a) the use of the platform via the user interface and APIs, and (b) any specific written instructions issued by the Controller.

This DPA applies to the categories of data and processing activities set out in Annex 1.

3. Processor obligations

The Processor will:

1. Process Customer Personal Data only on the documented instructions of the Controller, unless required to do otherwise by UK or EU law (and, if so, will inform the Controller before processing unless the law prohibits notice).
2. Ensure that personnel authorised to process Customer Personal Data are bound by appropriate confidentiality obligations.
3. Implement appropriate technical and organisational measures to protect Customer Personal Data, as set out in Annex 2.
4. Assist the Controller in fulfilling its obligations to respond to requests from Data Subjects (access, rectification, erasure, restriction, portability, objection).
5. Assist the Controller in complying with its obligations under UK GDPR Articles 32-36 (security, breach notification, impact assessments, prior consultation).
6. Engage sub-processors only as permitted by Section 5.
7. At the Controller's choice on termination of the service, return or delete all Customer Personal Data within 30 days, as set out in Section 10, subject to retention obligations imposed by law.
8. Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for audits as set out in Section 8.

4. Controller obligations

The Controller warrants that:

1. It has a lawful basis under UK GDPR Article 6 for processing Customer Personal Data, and where applicable Article 9 for special category data.
2. It has provided all required privacy notices to Data Subjects under UK GDPR Articles 13 and 14.
3. Its instructions to the Processor will comply with Data Protection Law.
4. It will not upload personal data of children under 16 without verifiable parental consent.
5. It will respond promptly to Data Subject requests, using the platform's built-in tools where applicable.

5. Sub-processors

The Controller grants the Processor general written authorisation to engage sub-processors to assist in providing the service, on the following conditions:

1. The Processor maintains an up-to-date list of sub-processors on its security page and in Annex 3.
2. The Processor enters into written contracts with each sub-processor imposing equivalent data protection obligations to those in this DPA.
3. The Processor remains liable to the Controller for the acts and omissions of its sub-processors.
4. The Processor will notify the Controller at least 14 days in advance of any intended addition or replacement of sub-processors, giving the Controller an opportunity to object on reasonable grounds related to data protection.
5. If the Controller objects, the Processor will use reasonable efforts to provide an alternative. If no acceptable alternative is available, either party may terminate the affected service component.

6. International transfers

Where Customer Personal Data is transferred outside the United Kingdom or European Economic Area, the parties agree that such transfers will be made using one of the following mechanisms:

• An adequacy decision under UK GDPR Article 45 or the equivalent UK Data Protection Act provision.
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
• Certification of the sub-processor under the EU-US Data Privacy Framework (where the UK extension applies).
• Binding Corporate Rules approved by the ICO.

The Processor will provide a copy of the relevant transfer mechanism documentation on the Controller's reasonable request.

7. Personal Data Breach

In the event of a Personal Data Breach affecting Customer Personal Data, the Processor will:

1. Notify the Controller without undue delay, and in any event within 48 hours of becoming aware of the breach (typically within 24 hours).
2. Provide all information reasonably requested by the Controller to enable it to comply with its own breach notification obligations under UK GDPR Article 33 (notifying the ICO within 72 hours) and Article 34 (notifying Data Subjects where required).
3. Take all reasonable steps to mitigate the effects of the breach and prevent recurrence.
4. Document the breach and the response in accordance with the Processor's incident response procedures.

8. Audits & information rights

The Processor will, on reasonable request and no more than once per calendar year (except after a Personal Data Breach), provide the Controller with:

• Written information about its technical and organisational security measures.
• Summaries of any third-party audits (e.g. SOC 2 or ISO 27001 reports, when obtained).
• Responses to a written security questionnaire from the Controller.

Physical audits of the Processor's premises or systems are not generally available, but the parties may agree to a remote audit by an independent third party at the Controller's cost where reasonably necessary.

9. Liability

Each party's liability under this DPA is subject to the same limitations and exclusions as set out in the Terms of Service, except where Data Protection Law requires otherwise (e.g. fines imposed by the ICO are not subject to contractual liability caps).

10. Term & termination

This DPA remains in force for as long as the Processor processes Customer Personal Data on behalf of the Controller. On termination of the underlying Terms of Service, the Processor will, at the Controller's choice within 30 days:

• Return all Customer Personal Data in a structured, commonly used and machine-readable format; or
• Securely delete all Customer Personal Data, subject to any retention required by law.

The Processor will provide written confirmation of deletion on completion.

11. Governing law

This DPA is governed by the laws of England & Wales. Any dispute is subject to the exclusive jurisdiction of the courts of England & Wales.

12. Hierarchy

In the event of conflict between this DPA and the Terms of Service, this DPA prevails for matters relating to the processing of Customer Personal Data.

---