Data Processing Agreement

Parties

This Data Processing Agreement ("DPA") is between the customer that uses the Productivity Workbench service ("Customer" or "Controller") and:

• MDTS UK Limited ("Processor"), Charlotte House, 500 Charlotte Road, Sheffield, S2 4ER, United Kingdom
• Company number: 05149485 (registered 9 June 2004)
• Contact: privacy@productivityworkbench.com

This DPA supplements the agreement under which the Customer uses the service, such as the Terms of Use, the Enterprise Agreement or an order form (the "Agreement"), and applies where the Processor processes Personal Data on behalf of the Controller in connection with the Productivity Workbench service (the "Service"). A Customer that wants a copy signed by both parties can ask at privacy@productivityworkbench.com.

1. Definitions

1.1 Terms used in this DPA have the meanings given in the UK GDPR and the Data Protection Act 2018 unless defined here:

• "Personal Data": any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller through the Service.
• "Processing": any operation performed on Personal Data, as defined in UK GDPR Article 4(2).
• "Sub-processor": any third party engaged by the Processor to process Personal Data (Schedule A).
• "Security Incident": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

1.2 Roles. For workspace content (features, stories, team names and the like) the Controller is the data controller and the Processor is the data processor. For account data (the email address and display name used to access the Service) the Processor acts as an independent controller for account administration, as our Privacy Policy describes.

2. Subject Matter and Duration

2.1 Subject matter: provision of the Productivity Workbench software-as-a-service platform.

2.2 Duration: this DPA remains in effect for the term of the Agreement and until all Personal Data is deleted or returned under section 10.

2.3 Nature and purpose: storage, organisation, retrieval, disclosure by transmission, and erasure of Personal Data as necessary to provide collaboration, product delivery management, audit logging, and the optional integrations the Controller enables.

3. Categories of Data Subjects and Personal Data

Special category data is not intended to be processed. The Controller shall not upload special category data unless agreed in writing.

4. Processor Obligations

The Processor shall:

4.1 Process Personal Data only on documented instructions from the Controller (the Agreement, this DPA, and the Controller's use of the Service), unless required to do otherwise by UK law, in which case the Processor shall inform the Controller unless the law prohibits it.

4.2 Ensure that persons authorised to process Personal Data are bound by confidentiality.

4.3 Implement appropriate technical and organisational measures under section 6.

4.4 Respect the conditions for engaging Sub-processors in section 5.

4.5 Assist the Controller with data subject requests (section 8) and with data protection impact assessments where feasible.

4.6 Delete or return Personal Data under section 10 at the end of the service.

4.7 Make available the information necessary to demonstrate compliance, and allow audits under section 11.

4.8 Notify the Controller without undue delay (target: within 72 hours) on becoming aware of a Security Incident affecting the Controller's Personal Data, with the details available and the remediation steps.

5. Sub-processors

5.1 The Controller gives general written authorisation for the Processor to engage the Sub-processors listed in Schedule A.

5.2 The Processor shall impose data protection obligations on each Sub-processor equivalent to those in this DPA.

5.3 The Processor shall notify every Controller that has this DPA of an intended change to its Sub-processors 30 days in advance. The Controller may object on reasonable grounds relating to data protection.

5.4 Customer-configured integrations (the Controller's AI provider, Jira, its source repositories) are the Controller's choice and are not the Processor's Sub-processors. The Processor sends data to them at the Controller's instruction but does not control their terms.

5.5 AI providers. The AI providers used in the product (such as Anthropic, OpenAI or Azure OpenAI) are the customer's own. The customer chooses the provider, holds the contract with it and supplies its key; we have no AI provider of our own. When an AI step runs, whether a customer's user starts it or the customer has configured it to run (such as the reviewer agents on a gate, or Auto Pilot), we send the prompt and the context it needs to that provider, at the customer's instruction, from our servers in eu-west-1 (Ireland). What the provider does with it, where it processes it and how long it keeps it are set by the customer's agreement with that provider.

6. Security Measures

The Processor implements measures including (the list is not exhaustive):

7. International Transfers

7.1 The primary processing location is AWS eu-west-1 (Ireland). The UK recognises the EEA as adequate, so storage there is not a restricted transfer.

7.2 Where a Sub-processor processes Personal Data outside the UK and EEA, the transfer relies on the safeguard that Sub-processor offers, as listed in Schedule A. Information about these transfers is available on request.

7.3 A transfer to the Controller's own AI provider, Jira site or source repository is made at the Controller's instruction under the Controller's own agreement with that provider (section 5.4).

8. Data Subject Rights

8.1 The Processor shall assist the Controller in responding to requests under UK GDPR Chapter III (access, rectification, erasure, restriction, portability and objection).

8.2 The Controller may send such a request to privacy@productivityworkbench.com; the Processor answers within one month.

8.3 The Processor shall not respond directly to data subjects unless authorised by the Controller or required by law.

9. Controller Obligations

The Controller shall:

9.1 Ensure a lawful basis exists for all Processing it instructs.

9.2 Configure the security settings (multi-factor authentication, the network allow-list, single sign-on where available) appropriate to its risk.

9.3 Not upload unlawful content, or special category data without agreement.

9.4 Keep user access accurate, removing leavers promptly.

10. Return and Deletion

10.1 A copy before termination. The Controller may ask at privacy@productivityworkbench.com for a copy of its workspace and studio data, and the Processor shall provide it in a machine-readable form within one month of the request.

10.2 What is deleted. The Controller may delete a workspace or a studio at any time, or ask at privacy@productivityworkbench.com for it to be deleted. Deleting a workspace or a studio deletes its records at once. Files stored with it are not deleted at once: a file uploaded to an Ideas Board expires 180 days after it was uploaded, and a file uploaded to a workspace 365 days after it was uploaded. The AI-generated summaries of Ideas Board items are kept until the Processor removes them, which the Controller can ask for at privacy@productivityworkbench.com. Point-in-time backups age out within 35 days of a deletion.

10.3 What is kept, and why. Some records are kept after a deletion because they are the Controller's own compliance record, which UK GDPR Article 17(3)(b) and (e) allow to be kept:

• the audit log entries of the Controller's users' actions, until the end of their retention period (section 10.4);
• the delivery evidence ledger of the AI Product Studio, and the implementation plans a coding agent wrote. These are append-only by design, so that they cannot be altered or removed after the event. They have no expiry, and nothing in the Service deletes them.

10.4 Audit log retention: 365 days by default (at least 90), configurable per workspace or organisation in its security settings. Expiry is enforced automatically.

11. Audit Rights

11.1 The Processor shall provide a SOC 2 report or ISO certificate when one is available.

11.2 The Controller may carry out one audit a year on 30 days' notice, during business hours and without disrupting operations, or accept a third-party audit report instead.

11.3 A redacted executive summary of a penetration test is available under a non-disclosure agreement once one has been carried out.

12. Liability

Liability under this DPA is subject to the limitation of liability in the Agreement. Nothing limits either party's liability for breaches of data protection law where such a limitation is prohibited.

13. Order of Precedence

If there is a conflict: (1) this DPA, (2) the Agreement, (3) the Service documentation, except where UK GDPR requires stricter Processor obligations.

Schedule A: Sub-processors and Transfer Safeguards

These are the Sub-processors that process the Controller's Personal Data on the Processor's behalf. Each Amazon Web Services component is listed in our vendor pack.

Integrations the Controller chooses (not Sub-processors)

When the Controller enables one of these, data goes to a provider the Controller chose and contracts with itself, at the Controller's instruction (section 5.4):

• The customer's AI provider (such as Anthropic, OpenAI or Azure OpenAI): Prompts and the context they need, for the AI steps the customer's users start or have configured
• The customer's Jira site (Atlassian): Issue and story fields the customer chooses to sync
• The customer's source repositories (GitHub, GitLab, Bitbucket or Azure DevOps): Check results, comments, branches and pull requests, under the customer's own account

Our own suppliers (not Sub-processors)

These suppliers serve MDTS UK Limited as a controller, for our own billing, email, source code, public website and sign-in. They do not process the Controller's workspace content, so they are not Sub-processors under this DPA. They are listed here, with the terms each works under, for transparency; our Privacy Policy covers them.

• Stripe Payments Europe, Ltd. (EU, with Stripe, Inc. in the United States): Payments, subscriptions, invoices and VAT. The Stripe Data Processing Agreement, which carries the EU Standard Contractual Clauses and the UK Addendum. Stripe is also certified to the UK Extension of the EU-US Data Privacy Framework.
• Microsoft (Microsoft 365) (UK and the EU Data Boundary): Our support and privacy email. The Microsoft Products and Services Data Protection Addendum.
• GitHub, Inc. (United States): Our own source code and build pipelines. The GitHub Data Protection Agreement, with the EU Standard Contractual Clauses and the UK Addendum.
• Google LLC (Google Analytics) (United States and EU): Analytics on our public pages, only if you accept it; never in the signed-in product. The Google Ads Data Processing Terms with the UK Addendum. Google is also certified to the UK Extension of the EU-US Data Privacy Framework.
• Google LLC (Sign in with Google) (United States and EU): Signing in with your Google account, only if you choose it. Google acts as an independent controller under its own terms and privacy policy. Google is certified to the UK Extension of the EU-US Data Privacy Framework.

Schedule B: Technical and Organisational Measures

The measures in section 6, described in full in the security white paper in our vendor pack.