Data Processing Agreement

Future Cover Ltd t/a IX (company number 14567626) Registered office: 128 City Road, London EC1V 2NX, England Contact: support@ix-platform.com

DRAFT 5 November 2026. For review by a solicitor before use. Text in [square brackets] is a placeholder or a choice still to be made.

1. Parties and purpose

1.1 This agreement ("DPA") is between the Customer named in the Order or sign-up (the "Controller") and Future Cover Ltd t/a IX (the "Processor"). It forms part of the Terms of Service at www.ix-platform.com/terms.html ("Terms").

1.2 It applies where the Processor processes personal data on the Controller's behalf in providing the Service, and meets the requirements of Article 28 of the UK GDPR. "UK GDPR", "personal data", "processing", "data subject", "personal data breach", "controller" and "processor" have the meanings in UK data protection law, which means the UK GDPR and the Data Protection Act 2018. Other capitalised terms are defined in the Terms.

1.3 Where we handle personal data as a controller in our own right (for example website enquiries and account details of people who sign in), our Privacy Policy applies and this DPA doesn't.

2. Details of the processing

The details are set out in Annex 1.

3. The Processor's obligations

The Processor will:

3.1 process personal data only on the Controller's documented instructions, which are the Terms, this DPA, the Order, and the Controller's use of the Service settings. If the law requires other processing, the Processor will tell the Controller first unless the law forbids it. The Processor will tell the Controller if it thinks an instruction breaches data protection law;

3.2 make sure everyone authorised to process the personal data is bound by a duty of confidence;

3.3 take the security measures in Annex 2 and keep them appropriate to the risk, as required by Article 32 of the UK GDPR;

3.4 use sub-processors only under clause 5;

3.5 taking account of the nature of the processing, help the Controller with its duty to respond to requests from data subjects exercising their rights. If a data subject contacts the Processor directly about the Controller's data, the Processor will pass the request on promptly and not respond itself except to say it has done so;

3.6 help the Controller meet its duties on security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the information the Processor has;

3.7 tell the Controller without undue delay and [within 48 hours] after becoming aware of a personal data breach affecting the Controller's personal data, and give the information the Controller reasonably needs to meet its own notification duties;

3.8 at the end of the Service, at the Controller's choice, delete or return the personal data (see clause 8); and

3.9 give the Controller the information it reasonably needs to show compliance with Article 28 and allow and contribute to audits under clause 7.

4. The Controller's obligations

The Controller confirms that it has a lawful basis to give the Processor the personal data and to give these instructions, that it has given the information data subjects are entitled to, and that it will not put special category data or criminal offence data into the Service unless it has told the Processor in writing first and the parties have agreed any extra measures. [The Controller is responsible for the content its users enter, and for using the Service settings, such as the guardrails and the routing policy, to suit its own risk.]

5. Sub-processors

5.1 The Controller gives general written authorisation for the sub-processors listed in Annex 3.

5.2 The Processor will give the Controller at least [30] days' notice of any new or replacement sub-processor, by email to the lead account or by updating the list at [web address]. The Controller may object on reasonable data protection grounds within that time. If the parties can't resolve the objection, the Controller may end the affected part of the Service and receive a refund of prepaid fees for it.

5.3 The Processor will have a written contract with each sub-processor that gives the same data protection obligations as this DPA, and stays responsible to the Controller for the sub-processor's performance.

5.4 AI model providers. AI model providers act as sub-processors only for the requests that the Controller's routing policy sends to them, and only where the Controller has enabled that provider. Where the Controller has connected its own account with a provider (for example its own cloud account), that provider is the Controller's own processor and not the Processor's sub-processor, and the Controller is responsible for that agreement.

6. International transfers

6.1 The Processor will only transfer personal data outside the UK, or allow access to it from outside the UK, where it has a lawful transfer mechanism under UK data protection law. That means an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard the law permits, together with a transfer risk assessment where required.

6.2 The Controller's routing policy decides which AI model providers, and so which countries, receive a request. [The Controller can restrict routing to providers or regions that meet its own data location requirements.]

7. Audit and information

The Processor will answer the Controller's reasonable questions and provide, on request, [security documentation and certifications it holds / its completed security questionnaire]. If that is not enough for the Controller to meet its legal duties, or after a personal data breach, the Controller may audit the Processor, or have an independent auditor do so, on [30] days' written notice, during business hours, no more than [once a year] (unless a regulator requires it or a breach has occurred), under confidentiality, and without access to other customers' data. [Each party bears its own costs.]

8. Return and deletion

8.1 When the Controller's agreement ends, the Processor will, at the Controller's written choice made within [30] days, return the personal data in a common format or delete it. If no choice is made, the Processor will delete it [60] days after the end.

8.2 The Processor may keep personal data only where the law requires it, or in backups until they expire [within [90] days], and will keep it secure and not use it for anything else. Records the Processor must keep as controller (for example billing records) are covered by the Privacy Policy.

9. Liability

Each party's liability under this DPA is subject to the limits in the Terms. This doesn't limit a data subject's rights or either party's liability that can't be limited by law.

10. General

10.1 If this DPA conflicts with the Terms on personal data, this DPA prevails.

10.2 The DPA lasts for as long as the Processor processes personal data for the Controller.

10.3 This DPA and any dispute about it are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1: Details of the processing

Annex 2: Security measures

The Processor will keep measures that are appropriate to the risk. At the date of this draft they include:

• passwords stored only as salted hashes; expiring, rotating session tokens; API keys that can be created and revoked by the account holder;
• role-based access (lead account, manager, developer, with separate IX staff roles) and least privilege for IX staff;
• encryption of connections in transit; [encryption of data at rest where the hosting provider supports it];
• separation of each customer's data [(one IX installation per customer for pilots)];
• restriction of network access to the servers, and monitoring and logging of access and security events;
• guardrails that detect and record certain kinds of sensitive information in requests (the type and count, not the text);
• AI model provider credentials stored as server settings and not shown to users, with cloud access through roles rather than long-lived keys where possible;
• regular backups to storage restricted to the service [and tested restores];
• confidentiality duties for staff and contractors with access; and
• a process for handling and reporting security incidents.

[Add any certifications or independent assessments once held. Do not list a measure here until it is in place.]

Annex 3: Authorised sub-processors

The list below is a draft. Locations and services must be confirmed against what is actually in use on the day of signature.