Data processing agreement (v1)

This Data Processing Agreement ("DPA") forms part of the agreement between Part Central Limited, trading as Cady (Company 15296116, England and Wales; "Processor", "we", "us") and the customer identified in the Agreement ("Customer", "you") that has executed a subscription agreement or accepted our Terms of Service (together, the "Agreement").

This DPA applies where we process Personal Data on your behalf in providing Cady (the "Services"). You may be a controller or a processor authorised to appoint us as a sub-processor. Each party will perform the duties applicable to its actual role; references to your instructions include lawful instructions you relay from your controller. You remain responsible for the authority, lawful basis and notices for your processing, without reducing our own obligations.

1. Definitions

Capitalised terms not defined here have the meaning given in the Agreement. In this DPA:

• "Data Protection Laws" means laws applicable to the Processing under this DPA concerning privacy, data protection and security of personal data, including, where applicable, the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation 2016/679) and implementing legislation, and applicable United States federal and state privacy and data-protection laws, including the California Consumer Privacy Act as amended ("CCPA").
• "Personal Data", "Data Subject", "Processing", "Controller", "Processor", and "Supervisory Authority" have the meanings given in the applicable Data Protection Laws, including equivalent personal-information and business, controller, processor, service-provider or contractor roles where applicable.
• "Sub-processor" means any third party engaged by us to process Personal Data on your behalf.
• "UK IDTA" means the UK International Data Transfer Agreement issued under Section 119A of the Data Protection Act 2018.
• "SCCs" means the Standard Contractual Clauses approved by the European Commission (Decision 2021/914).

2. Scope of Processing

Agent-tool inputs must not contain payment card details, protected health information, government-issued personal identifiers, passwords, API keys, or other access secrets. Billing and authentication use designated secure flows; those flows are not requests to submit restricted data to your chosen agent.

3. Obligations of the Processor

We shall:

1. Process Personal Data only on your documented instructions, including instructions on international transfers and those in the Agreement and this DPA. Where EU GDPR applies, a departure must be required by Union or Member State law to which we are subject; where UK GDPR applies, by applicable UK law. We will inform you of that legal requirement before processing unless that law prohibits notice on important grounds of public interest. Other applicable compulsory requirements remain subject to Data Protection Laws and the transfer safeguards in Section 5.
2. Inform you immediately if, in our opinion, an instruction infringes Data Protection Laws, and suspend that instruction while the parties resolve it where necessary to comply with law.
3. Ensure that persons authorised to process Personal Data have committed to confidentiality or are under a statutory obligation of confidentiality.
4. Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the binding Security Schedule in Section 12:
   • Encryption of data in transit using TLS and automatic AES-256 encryption at rest for Cloudflare D1 and R2.
   • Company-scoped authorisation for supported Cady operations, with fail-closed company context, company roles, and passkey review for designated consequential actions
   • Sign-in with passkeys or one-time email codes; no passwords
   • Role-based access controls and MFA for staff
   • Risk-based security testing and dependency review under Section 12
   • Access, decision and effect records protected against unauthorised changes, with retention and deletion controls appropriate to their purpose
5. Use Sub-processors under your general written authorisation given by accepting this DPA, subject to the current Subprocessor List and this change process. We will ordinarily give at least 14 days written notice before an addition or replacement. If an urgent security or service-continuity need makes that period impracticable, we will give as much advance notice as reasonably possible, explain the urgency and maintain equivalent protections. You may object on reasonable data-protection grounds; we will consider a reasonable alternative and, if none is available, you may terminate the affected Services with a refund of unused prepaid fees. We will not use a replacement in a way that bypasses a required prior authorisation or a legally required opportunity to object.
6. Ensure each Sub-processor is bound by written data protection obligations no less protective than the applicable obligations in this DPA. We remain fully liable to you for performance of its obligations as required by Article 28(4), subject to lawful contractual limits that do not restrict mandatory third-party rights.
7. Assist you, taking into account the nature of Processing, by appropriate technical and organisational measures (insofar as possible) to fulfil your obligations to respond to Data Subject rights requests (access, rectification, erasure, portability, restriction, objection).
8. Assist you in ensuring compliance with your obligations under applicable Data Protection Laws, including Articles 32–36 of the UK GDPR and EU GDPR where applicable (security, breach notification, data protection impact assessments, prior consultation).
9. At your choice, return or delete Personal Data after the end of the Services, and delete existing copies unless applicable law requires retention. We will preserve the agreed switching and retrieval period and then delete the data without undue delay within the binding Retention Schedule in Section 11. We will identify any law requiring retention and restrict the affected data accordingly. Backup copies awaiting scheduled expiry are isolated from ordinary use, and any restore must reapply deletions before use resumes. We will provide confirmation of completion, including any remaining lawful exception, on request.
10. Make available to you all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or a third-party auditor mandated by you. Ordinarily you must give at least 30 days' notice, except where shorter notice is required by law or reasonably necessary to investigate suspected material noncompliance. Audits will be conducted during normal business hours and shall not unreasonably interfere with our operations, subject to applicable law. We will ordinarily provide current documentation and answers first. If that does not provide sufficient assurance, appropriate inspection remains available. Routine customer audits are ordinarily limited to one in any 12-month period; this limit does not apply to a regulator, a legal requirement, a personal-data breach or reasonable evidence of material noncompliance. Auditors must protect confidential information, other customers’ data and system security; we will provide appropriate alternative evidence where direct access would expose them. The customer bears its appointed auditor’s fees. We do not charge for required compliance information, reasonable audit cooperation or correcting our own noncompliance. Any optional bespoke work and its price must be agreed in advance; a fee dispute does not suspend mandatory assistance.

This DPA covers guest invitations, customer-directed share terms and access history processed on your instructions. Evidence of a guest’s separate contract with Cady, and our own security or legal-compliance processing, is described in our Privacy Policy and is not converted into customer-instructed processing merely by appearing in the same system.

Applicable United States processor terms

Where applicable United States privacy law requires us to act as your processor, service provider or contractor, those obligations apply to Personal Data processed on your behalf under this DPA. The specified business purposes are storing and organising the customer workspace, delivering requested records and files to authorised users and connected recipients, enforcing selected permissions, customer-directed dataroom sharing and notices, and the security, support and continuity necessary to provide those functions, as further described in Section 2. This paragraph does not authorise independent reuse of that data.

Where the CCPA applies to that Processing, you disclose the Personal Data to us only for the limited and specified business purposes above and in Section 2, and we will:

• Not sell or share that Personal Data as those terms are defined in the CCPA.
• Not retain, use or disclose it outside the specified business purposes or our direct business relationship with you, except as expressly permitted by the CCPA and its implementing regulations.
• Not combine it with personal information from other customers, other sources or our own interactions with individuals, except as expressly permitted by the CCPA and its implementing regulations.
• Comply with the applicable CCPA requirements and provide the same level of privacy protection required by them, including assistance with consumer requests and required assessments under Section 3 and reasonable security appropriate to that information.
• Permit reasonable and appropriate steps by you to monitor our compliance, and to stop and remediate any unauthorised use, including the information and audit rights in Section 3.
• Notify you if we determine we can no longer meet the applicable obligations, and cooperate with reasonable and appropriate remediation.
• Require any Sub-processor receiving that Personal Data to comply through a written contract satisfying the applicable requirements of CCPA regulations Section 7051. We will reasonably cooperate with applicable consumer requests, cybersecurity audits, risk assessments and automated-decision requirements to the extent required of our role under applicable law; this does not assert that every customer or use is subject to them.

Where we act as a contractor under the CCPA, we certify that we understand and will comply with the applicable restrictions in this paragraph.

4. Data Breach Notification

We will notify you without undue delay after becoming aware of a personal data breach affecting Personal Data processed on your behalf. We will not wait for a complete investigation before giving an initial notice. We will provide the information then available and further information in phases without undue further delay, including:

• A description of the nature of the breach, including categories and approximate number of Data Subjects and records concerned
• The name and contact details of our data protection contact
• A description of the likely consequences
• A description of measures taken or proposed to address the breach

We will cooperate with your response and keep you informed of material developments. You determine notifications to individuals and regulators for processing you control, unless law requires us to notify directly. For incidents involving US residents, we will promptly provide available information needed to assess applicable state and sector duties and cooperate on required notices. Each party retains responsibility for notifications legally assigned to it; our contractual notice alone does not discharge those duties. Report suspected incidents to data@cadyworks.com and team@cadyworks.com. We will send notices to your designated privacy or incident contact, or your account contact if none is designated. Each party must keep its contact details current.

5. International Transfers

We aim to store company databases, account-directory records and file buckets in the EU; this is best effort, you do not choose a region today, a US region is not offered yet, and we do not offer contractual data residency. Some processing, such as AI features and search, edge execution, queues, email, monitoring and support, may run in other regions through our Sub-processors. Personal Data may be transferred to countries outside the UK/EEA where our Sub-processors operate (see Subprocessor List). For each transfer, we rely on one of the following:

• An adequacy decision by the UK Secretary of State or European Commission
• The UK IDTA (for transfers from the UK)
• The EU SCCs for transfers from the EEA; for UK transfers, the UK IDTA or EU SCCs with the UK Addendum, as applicable
• The EU-US Data Privacy Framework and, for eligible UK transfers, its UK Extension, only where the recipient and processing are covered by current certification

We will identify the applicable safeguard for each restricted transfer and make a copy or meaningful description available on request, subject to necessary redactions. We will perform the assessments and supplementary measures required for that safeguard. Where standard contractual clauses or a UK transfer instrument are needed, the appropriate module, parties, annexes, governing law and competent authority must be completed before the transfer; the menu above does not execute them. Transfer details are recorded in our Subprocessor List.

6. AI/LLM Processing

Cady uses Cloudflare Workers AI and Vectorize for AI and search features, which may run in other regions. When you independently select and contract with an agent provider, its processing is governed by your arrangements with it. Any supplier we ourselves engage to process customer content remains subject to our applicable Sub-processor obligations, including if used for support.

Your separately selected agent host (such as ChatGPT or Claude) and services you contract with directly are governed by your agreements with those providers. When you request a Cady tool call through that host, the requested response may be delivered to it on your instructions. Such a host is not, merely by being connected, a Cady-engaged Sub-processor.

We remain responsible for disclosing Personal Data only through authorised Cady operations and for our own security obligations. Customer selection of an agent does not waive those duties. Revocation cannot recall copies already delivered to an independent recipient. We do not use customer workspace content to train general-purpose AI models.

7. Liability

The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Agreement. This DPA does not limit either party's liability for breaches of Data Protection Laws to the extent such limitation is not permitted by applicable law.

8. Term

This DPA takes effect on the date you accept the Agreement and remains in force for as long as we process Personal Data on your behalf. Clauses that by their nature should survive (including breach notification, deletion, and audit rights) shall survive termination.

9. Governing Law

This DPA is governed by the laws of England and Wales. Disputes shall be subject to the exclusive jurisdiction of the courts in England and Wales, subject to mandatory law and any governing-law, jurisdiction or data-subject provisions required by applicable transfer clauses.

10. Contact

For data protection queries, contact us at data@cadyworks.com.

11. Retention Schedule

This schedule governs customer content processed under this DPA. We may not extend it simply because a supplier offers a longer storage period. A customer instruction for earlier lawful deletion takes priority, subject to applicable law and the security and backup handling below. Termination, workspace closure, statutory rights and switching are distinct events.

• Live workspace content and files: retained during the service term. After termination we preserve the applicable switching and retrieval periods, including at least 30 calendar days after an applicable switching transition. At the customer’s choice we return or delete the content, and remove remaining live copies without undue delay and within 30 days after the applicable period ends or an earlier lawful deletion instruction. This is an outside operational limit, not permission to retain data for an unnecessary extra month. Where the Data Act requires erasure after the retrieval period, we erase at its end; any earlier statutory deadline or valid instruction takes precedence.
• Workspace deletion: workspace access stops when an authorised owner confirms deletion, and the ordinary cancellation window is 30 days. Final purge is carried out by our operators; it is not yet an automated schedule. We do not start it until the cancellation window and any applicable retrieval period end, unless the customer lawfully instructs earlier deletion. This window does not postpone assessment or compliance with a valid individual rights request.
• Deleting a single file: the file leaves the workspace at once and cannot be opened from it. Its stored content and extracted text are not yet erased automatically; we erase them when the workspace is purged or on a request to data@cadyworks.com, and recovery copies expire as set out below.
• Temporary export packages: each download link expires after seven days. We reissue a secure link after authentication throughout the retrieval period. Packages are deleted without undue delay within the live-content deadline above, including erasure at the end of retrieval where the Data Act requires it, or earlier when safely regenerated on request.
• Recovery copies: each copy expires no later than 35 days after its creation. This is a maximum deletion period, not a guarantee that every earlier version can be recovered or a minimum retention period. On live deletion, affected backup data is placed beyond ordinary use; any restore reapplies deletion and revocation instructions before access resumes. We will not make new recovery copies of already deleted live content.
• Ordinary operational logs: up to 30 days from the event. Security and abuse logs: up to 90 days from the event. These are maximum periods; records may be minimised or deleted earlier when no longer needed. Only records necessary for an actual incident or legal hold may be retained longer, with a recorded reason, restricted access and periodic review.
• Customer-directed guest access history: up to 90 days from the event, unless a different justified period is expressly agreed; not beyond the customer’s applicable deletion instruction without a lawful basis. Customer-share terms acceptance evidence follows the customer’s documented instructions and the workspace term and exit schedule.

Where applicable law requires us to retain specified customer Personal Data, we will identify that requirement where permitted, isolate the affected data, process it only for the required purpose and delete it when the requirement ends. A retention lock or a possible future dispute does not itself establish a legal requirement. Our own limited accounting and contract-administration records are separately described in the Privacy Policy and may not be used to preserve the whole workspace.

12. Security Schedule

We will maintain risk-appropriate technical and organisational measures throughout processing, including the controls below. We may improve or replace a control without materially reducing the overall protection. This schedule describes contractual obligations and does not promise certification, zero incidents, or a numerical availability, recovery time or recovery point service level.

• Company isolation and access: deny access without an authorised company context; check current roles and scopes for reads and writes; limit staff production access to approved purposes and least privilege, with individual accounts, MFA, removal on departure and access records.
• Authentication and approval: protect sessions and tokens, support passkeys or one-time email codes, apply recovery safeguards, and bind designated consequential-action review to the action being authorised. Revocation prevents new access through the revoked grant; ongoing deliveries and delegated jobs revalidate authority at the required control points. It cannot recall delivered copies.
• Storage and transmission: use TLS for external transport and Cloudflare D1 and R2 encryption at rest. Limit secret access and rotate compromised credentials. Encryption at rest is not end-to-end encryption against Cady or Cloudflare.
• Safe delivery: enforce share and recipient permissions before file delivery, constrain guest sessions to their share, and avoid credentials, verification codes and unnecessary workspace content in routine monitoring.
• Resilience: maintain protected recovery copies and test restoration of representative records, files and permissions. Restore must preserve effective deletions and revocations and must not revive consumed approval credentials. Review recovery results and correct material failures.
• Change and incident management: review security-sensitive changes, test authorisation and isolation, monitor dependencies and remediate vulnerabilities proportionate to severity. Maintain a monitored incident contact, escalation responsibility, containment and recovery procedures and records, and test incident communication.
• Data lifecycle: operate the retention schedule, authenticate export and deletion requests, record completion and exceptions, and assist lawful individual-rights requests.