This Data Processing Agreement (the "DPA") forms part of the Pragmon AI Customer Terms published at pragmon.ai/legal/customer-terms and of every Order Form made under them. Together, the Customer Terms and the Order Form are the "Agreement".
The parties are Pragmon AI Ltd, a company registered in England and Wales under company number 17549923, with its registered office at 71-75 Shelton Street, London WC2H 9JQ ("Pragmon", "we", "us"), and the customer named in the Order Form ("you").
This DPA applies whenever we process personal data on your behalf while providing the Service. Where it uses a capitalised term it does not define, that term has the meaning given in the Customer Terms.
1. Our roles
1.1 We act as your processor. Where you are the controller of Customer Personal Data, we process it on your behalf as your processor.
1.2 We act as your subprocessor. Where you process Customer Personal Data on behalf of another controller, we act as your subprocessor.
2. How we process your data
2.1 What we process. Annex I describes the people whose data we process, the kinds of personal data, the purpose, the nature of the processing and how long it lasts.
2.2 Your instructions. You instruct us to process Customer Personal Data:
(a) to provide and maintain the Service;
(b) as you further specify through your use of the Service;
(c) as set out in the Agreement; and
(d) as set out in any other written instruction you give us about Customer Personal Data that we acknowledge in writing.
We follow these instructions unless the law forbids it. If we cannot follow an instruction, we tell you at once. You confirm that your instructions comply with the law, and that they always will.
2.3 We process only as this DPA allows. We process Customer Personal Data only in line with this DPA, including Annex I. When we add or change products, features or functions in the Service, we may update the details in Annex I to match. We tell you when we do.
2.4 When you are a processor. Where you process Customer Personal Data for another controller, you comply with every law that applies to you as a processor. Your agreement with that controller will require the same. You also comply with the subprocessor terms in that agreement.
2.5 Your lawful basis. You have complied, and will keep complying, with data protection law when you give Customer Personal Data to us or to the Service. That includes giving every notice, obtaining every consent, offering every choice and putting in place every safeguard that the law requires.
3. Our people
Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law. They process it only as this DPA allows.
4. Security
We keep in place the technical and organisational measures described in Annex II to protect Customer Personal Data. Annex II is our Security page at pragmon.ai/legal/security. We may update those measures over time, but we will not reduce the overall protection they give Customer Personal Data.
5. Subprocessors
5.1 General authorisation. You give us general authorisation to use subprocessors. Annex III lists the subprocessors we use today. It is our Subprocessors page at pragmon.ai/legal/subprocessors, and it names each subprocessor, what it does, the data it receives and where it is located.
5.2 Notice of a new or replaced subprocessor. We give you at least 10 business days' notice before a new or replacement subprocessor starts processing Customer Personal Data. We give notice by updating the Subprocessors page and by emailing everyone who has subscribed to that page's change notices. To receive these notices, subscribe on the Subprocessors page. Each notice gives you the information you need to decide whether to object.
5.3 Your right to object. You may object to a new or replacement subprocessor on reasonable data protection grounds. Send your objection in writing to contact@pragmon.ai within 30 days of our notice. If you do not object in that time, you accept the change. If you do object, we will work with you in good faith to resolve your concern.
5.4 Our contracts with subprocessors. We have a written agreement with each subprocessor. It allows the subprocessor to use Customer Personal Data only as far as it needs to for the work we give it, and only in a way that is consistent with the Agreement. Where the GDPR or the UK GDPR applies, that agreement imposes data protection obligations that match those in this DPA, as Article 28(3) requires. It also sets out how we and the subprocessor work together to answer enquiries and requests about Customer Personal Data. On request, we will give you a copy of a subprocessor agreement. We may remove commercial terms, confidential information and personal data from the copy first.
5.5 We remain responsible. We remain fully liable to you for the work we pass to our subprocessors, including what they do and fail to do with Customer Personal Data. If a subprocessor fails to meet a material obligation about Customer Personal Data, we tell you.
6. International transfers
6.1 Where we are. Pragmon is established in the United Kingdom. The European Commission has adopted an adequacy decision for the United Kingdom. So when you send Customer Personal Data from the European Economic Area to us, the transfer needs no Standard Contractual Clauses.
6.2 Transfers we make. You agree that we may transfer Customer Personal Data outside the United Kingdom, the European Economic Area or any other relevant territory where we need to in order to provide the Service. Where we transfer it to a country that has no adequacy decision from the relevant authority, we put in place appropriate safeguards for that transfer, as data protection law requires.
6.3 When the Standard Contractual Clauses apply. Sections 6.4 to 6.6 apply only to a Restricted Transfer from you to us. A Restricted Transfer is one that no adequacy decision covers. If an adequacy decision that covers a transfer from you to us stops applying, those sections apply to that transfer from the day it stops.
6.4 Transfers from the European Economic Area. Where the GDPR protects a Restricted Transfer from you to us, you and we are treated as having signed the EU SCCs, with their Annexes, by entering into this DPA. The EU SCCs are completed as follows:
(a) Module Two (controller to processor) applies where you are a controller and we process Customer Personal Data for you as your processor.
(b) Module Three (processor to processor) applies where you are a processor and we process Customer Personal Data on your behalf as your subprocessor.
(c) For each module, where it applies:
(i) the optional docking clause in Clause 7 does not apply;
(ii) in Clause 9, Option 2 (general written authorisation) applies, and the minimum notice period for changes to subprocessors is 10 business days;
(iii) in Clause 11, the optional wording does not apply;
(iv) in Clause 13, all square brackets are removed;
(v) in Clause 17, Option 1 applies, and the EU SCCs are governed by the law of the Governing Member State;
(vi) in Clause 18(b), disputes are resolved in the courts of the Governing Member State; and
(vii) Annexes I, II and III of this DPA provide the information that Annexes I, II and III of the EU SCCs require.
The Governing Member State is Ireland, unless the Order Form names another member state of the European Union.
6.5 Transfers from the United Kingdom. Where the UK GDPR protects a Restricted Transfer from you to us, you and we are treated as having signed the UK Addendum, with its Annexes, by entering into this DPA. The UK Addendum is completed as follows:
(a) section 6.4 of this DPA provides the information that Table 2 of the UK Addendum requires;
(b) Table 4 is changed so that neither party may end the UK Addendum under its Section 19. If the Information Commissioner issues a revised Approved Addendum under Section 18, the parties will work in good faith to revise this DPA to match; and
(c) Annexes I, II and III of this DPA provide the information that Annex 1A, Annex 1B, Annex II and Annex III of the UK Addendum require.
6.6 Transfers from Switzerland. Where Swiss law, and not the law of a member state of the European Economic Area or of the United Kingdom, governs the international nature of a transfer, references to the GDPR in Clause 4 of the EU SCCs refer instead, as far as the law requires, to the Swiss Federal Act on Data Protection or its successor. The term "supervisory authority" then includes the Swiss Federal Data Protection and Information Commissioner.
7. Security incidents
7.1 When we become aware of a Security Incident, we:
(a) tell you without undue delay, and no later than 72 hours after we became aware of it;
(b) give you information about it promptly, as we learn it or as you reasonably ask; and
(c) take reasonable steps at once to contain and investigate it.
7.2 Telling you about a Security Incident, or responding to one, is not an admission by us of fault or liability.
8. Helping you meet your obligations
8.1 Requests from people and authorities. If anyone else contacts us about Customer Personal Data, we tell you and we do not reply without your consent. That includes a request from a data subject and an order from a court, regulator or other authority, unless the law forbids us to tell you. Where the law allows, we follow your reasonable instructions about the request and keep you informed. If a data subject makes a valid request under data protection law to delete their data, or to stop you sharing it with us, we help you meet it. At your cost, we cooperate and help you reasonably with any legal or procedural step you take in answer to a third party's request about how we process Customer Personal Data.
8.2 Impact assessments. Where data protection law requires it, we help you reasonably with any data protection impact assessment or transfer impact assessment, and with any consultation with a data protection authority. Our help reflects the nature of the processing and the Customer Personal Data involved.
9. Deleting or returning your data
9.1 Deletion during the Agreement. You may delete Customer Personal Data in the ways the Service allows, or ask us to delete it. We act on your request as soon as reasonably practicable, unless the law requires us to keep the data.
9.2 At the end of the Agreement. When this DPA ends, we return or delete Customer Personal Data, as you choose, unless the law requires or permits us to keep it. Where return or deletion is impracticable or the law forbids it, we take reasonable steps to stop any further processing and we keep protecting the data we still hold. The law may, for example, require us to keep certain data for a period.
9.3 Certificate of deletion. Where the EU SCCs or the UK Addendum apply, we give you the certificate of deletion described in Clauses 8.1(d) and 8.5 of the EU SCCs only if you ask for one.
10. Audits and information
10.1 Information we give you. We give you the information you reasonably need to show that we comply with this DPA. We allow for, and contribute to, audits, including inspections, to assess that compliance. You agree to exercise your audit rights, under this DPA and under data protection law, by asking us to meet the requirements in sections 10.2 and 10.3. We may withhold information where giving it to you would harm our intellectual property, breach a duty of confidentiality or break the law. We keep records of our compliance with this DPA for 3 years after it ends.
10.2 Reports. If an independent auditor has prepared a report or certification on our security measures, we give you a summary copy of the current one on request, in confidence.
10.3 Questionnaires. We answer reasonable written requests for information about our compliance with this DPA. That includes security, due diligence and audit questionnaires, and further information about our security programme. Send requests to contact@pragmon.ai. You may make them once a year.
11. Liability
11.1 The cap. As far as data protection law allows, each party's total liability to the other arising out of or relating to this DPA is subject to the exclusions and limits of liability in the Customer Terms.
11.2 Who may claim. Only the customer entity that is a party to the Agreement may bring a claim against us or our affiliates arising out of or relating to this DPA.
11.3 Exceptions. This DPA does not limit any liability to an individual for their data protection rights under data protection law. It does not limit any liability between the parties for breach of the EU SCCs or the UK Addendum.
12. Order of precedence
This DPA forms part of the Agreement and adds to it. If the documents conflict, the earlier in this list wins on that point:
(a) the EU SCCs or the UK Addendum;
(b) this DPA;
(c) the rest of the Agreement.
13. Term
This DPA starts when the Agreement starts and lasts as long as the Agreement. Both parties stay bound by this DPA and by data protection law until you stop sending Customer Personal Data to us and we stop processing it.
14. Definitions
"Customer Personal Data" means personal data that you upload to, or provide through, the Service and that this DPA governs.
"Data protection law" means every law that governs how the Service may process or use information about an individual, including the GDPR, the UK GDPR, the Data Protection Act 2018 and the Swiss Federal Act on Data Protection, where each applies.
"EU SCCs" means the standard contractual clauses annexed to the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679.
"European Economic Area" means the member states of the European Union, together with Iceland, Liechtenstein and Norway.
"GDPR" means Regulation (EU) 2016/679, as implemented in each member state of the European Economic Area.
"Restricted Transfer" means (a) where the GDPR applies, a transfer of personal data from the European Economic Area to a country outside it that has no adequacy decision from the European Commission; and (b) where the UK GDPR applies, a transfer of personal data from the United Kingdom to a country not covered by adequacy regulations under section 17A of the Data Protection Act 2018.
"Security Incident" means a personal data breach, as Article 4 of the GDPR or the UK GDPR defines it, affecting Customer Personal Data.
"Service" means the products and services described in the Agreement, including the Review, the Platform, Ask Pragmon AI and support.
"UK Addendum" means the international data transfer addendum to the EU SCCs issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018.
"UK GDPR" means the GDPR as it forms part of the law of the United Kingdom under section 3 of the European Union (Withdrawal) Act 2018.
"Controller", "processor", "subprocessor", "personal data", "processing", "data subject" and "special category data" have the meanings that data protection law gives them.
Annex I: Details of the processing
A. The parties
Data exporter: the customer named in the Order Form, whose contact details are in the Order Form. Role: controller, or processor where the customer processes Customer Personal Data for another controller.
Data importer: Pragmon AI Ltd, England and Wales, company number 17549923, registered office 71-75 Shelton Street, London WC2H 9JQ. Contact: contact@pragmon.ai. Role: processor, or subprocessor where the customer is a processor.
Activities relevant to the transfer: providing the Service under the Agreement.
B. Description of the processing
Data subjects.
- Your users of the Platform.
- People named in the data you share with us, such as contacts at your customers and suppliers.
Personal data.
- Names, business contact details and job titles.
- Sign-in and usage data.
- Questions your users put to Ask Pragmon AI.
- Personal data contained in the documents you upload.
Special category data. None. You agree not to send us special category data.
Frequency of transfer. Continuous, for as long as you use the Service.
Nature of the processing. Collecting, storing, organising, analysing and retrieving Customer Personal Data, and generating content from it with AI models, so that we can provide the Service.
Purpose. To produce the Review and to provide the Platform, Ask Pragmon AI and support.
Duration. For the subscription term, and then until the data is deleted under section 9.
Transfers to subprocessors. As set out in Annex III, for the same purpose, nature and duration as above.
C. Competent supervisory authority
For the EU SCCs, the supervisory authority identified under Clause 13. For the UK Addendum, the Information Commissioner's Office.
Annex II: Technical and organisational measures
Our Security page at pragmon.ai/legal/security, as updated from time to time under section 4.
Annex III: Subprocessors
Our Subprocessors page at pragmon.ai/legal/subprocessors, as updated from time to time under section 5.
Adapted from the Common Paper Data Processing Agreement Standard Terms Version 1.1, licensed under CC BY 4.0 (creativecommons.org/licenses/by/4.0). Changes were made.