Data Processing Agreement (DPA)

Plain English Summary

This Data Processing Agreement ("DPA") explains how Fast Thinking Limited ("FastThinking", "we", "us" or "our") processes personal data on behalf of our customers whenthey use the Fast Thinking Marketing Platform or our marketing services.

It outlines the responsibilities and commitments we have under UK GDPR and otherapplicable data protection laws to protect your data and respect your privacy.

If you have any questions about this DPA or data protection generally, please contactour Data Privacy Officer at privacy@fast-thinking.co.uk.

1. Introduction

This DPA forms part of the contractual relationship between Fast Thinking and you("Customer") and governs the processing of personal data on your behalf.

The terms in this DPA apply whenever Fast Thinking processes personal data inconnection with providing the Fast Thinking Marketing Platform or marketingservices.

2. Roles and Responsibilities

• Data Controller: You (the Customer) determine the purposes and means ofprocessing personal data.
• Data Processor: Fast Thinking acts as proces

3. Subject Matter and Duration

• The subject matter is the processing of personal data for the purpose ofdelivering the Platform and marketing services.
• This DPA remains effective for the duration of our business relationship.

4. Types of Personal Data and Categories of Data Subjects

• We may process user account data such as names, emails, avatars, andpasswords.
• We may process end-user behavioural data collected on your websites as part ofthe Platform.

5. Processing Instructions

We only process data according to your documented instructions and applicable laws.

6. Security Measures

• We implement appropriate technical and organisational measures to protectpersonal data.
• Our platform is hosted on AWS London data centres, with strict access controls.

7. Subprocessors

• We may engage subprocessors to help deliver the Platform and services.
• Our current subprocessors are listed here.
• We will notify customers in advance of any intended changes to subprocessorsvia email or a notification on our website. Customers may object to a newsubprocessor in writing within 14 days if they have reasonable data protectionconcerns.

8. Data Subject Rights

We assist you in responding to data subject requests where applicable.

9. Data Breach Notification

We will notify you without undue delay of any personal data breach affecting your data.

10. Data Retention and Deletion

• We retain personal data in line with documented retention policies. For example,log data is typically retained for up to 6 months unless otherwise agreed.
• Upon termination of services, we will delete or return all personal data asinstructed by the Customer, unless retention is required by law.

11. International Data Transfers

We use AWS London data centres to limit international transfers.

12. Liability

Each party is responsible for compliance with their data protection obligations.

13. Governing Law

This DPA is governed by UK law.

14. Legal Requirements under Article 28 UK GDPR

In accordance with Article 28 of the UK GDPR, Fast Thinking agrees to:

• Process personal data only on documented instructions from the Customer;
• Ensure all authorised personnel are under appropriate confidentiality obligations;
• Implement appropriate technical and organisational security measures;
• Assist the Customer in fulfilling their data protection obligations, including datasubject rights and DPIAs;
• Make available information necessary to demonstrate compliance and allow foraudits (subject to reasonable notice);
• Delete or return all personal data at the end of the provision of services, unlessretention is required by law.

‍

For questions or support, please contact our Data Privacy Officer at privacy@fastthinking.co.uk.

*This document is provided for informational purposes and does not replace a signedcontract where required.*