Data Processing Agreement

This Agreement is entered into between [Customer legal name] ("Controller") and COBE Research CIC, a Community Interest Company registered in England and Wales (company number [registration number], registered office [registered address]) ("Processor"), and supplements the parties' agreement for COBE Research's provision of the COBE Intelligence platform (the "Principal Agreement"), dated [date].

Processor processes personal data on Controller's behalf for the duration of the Principal Agreement, for the purpose of providing the COBE Intelligence platform — workplace wellbeing and workplace-equity assessment, aggregate reporting, and related account administration. Full details of the processing are set out in Annex 1.

Processor shall:

• process personal data only on Controller's documented instructions, including regarding international transfers, unless required to do otherwise by law (in which case Processor will inform Controller before processing, unless prohibited from doing so);
• ensure that persons authorised to process the personal data are subject to a duty of confidentiality;
• implement the technical and organisational security measures set out in Annex 2;
• not engage a sub-processor without Controller's general or specific written authorisation (see clause 5) and shall impose the same data protection obligations on any sub-processor it does engage;
• assist Controller, at Controller's cost for anything beyond reasonable effort, in responding to requests from data subjects exercising their rights under UK GDPR;
• assist Controller with its obligations relating to data protection impact assessments and prior consultation with the ICO, taking into account the nature of processing and information available to Processor;
• notify Controller without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting Controller's data, and provide the information set out in clause 6;
• at Controller's choice, delete or return all personal data to Controller at the end of the Principal Agreement, and delete existing copies, unless retention is required by law (see clause 8);
• make available to Controller all information reasonably necessary to demonstrate compliance with this Agreement, and allow for and contribute to audits, including inspections, conducted by Controller or an auditor mandated by Controller, on reasonable notice.

Controller warrants that it has, and will maintain throughout the term of this Agreement, a valid lawful basis for the processing described in Annex 1, including — where the processing involves special category data — a valid Article 9 condition, and that its instructions to Processor comply with applicable data protection law.

Controller authorises Processor to engage the sub-processors listed in Annex 3 as at the date of this Agreement. Processor will give Controller at least [30 days'] notice of any intended change (addition or replacement), during which Controller may object on reasonable data-protection grounds; if the parties cannot resolve the objection, Controller may terminate the affected part of the service without penalty.

Processor's breach notification to Controller will describe, to the extent then known: the nature of the breach and, where possible, categories and approximate number of data subjects and records affected; the likely consequences; and the measures taken or proposed to address the breach, including to mitigate its possible adverse effects. Processor will update Controller as further information becomes available.

[COBE Research to confirm: whether any sub-processor processes personal data outside the UK, and if so, the transfer mechanism relied on — e.g. the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy regulation.]

On termination or expiry of the Principal Agreement, Processor will, at Controller's election, return a full export of Controller's personal data in a commonly-used format and/or delete it, within [30 days], except to the extent applicable law requires Processor to retain some or all of the data, in which case Processor will isolate and protect that data from further processing.

[Liability allocation between the parties for this Agreement — needs drafting by qualified counsel before publication.]

• Application-layer encryption of open-text and other sensitive response fields, in addition to encryption at rest
• Mandatory multi-factor authentication for all administrator accounts, with optional enterprise SSO (OIDC/SAML)
• Role-based access control, scoped so one customer organisation's administrators can never see another's data
• Encrypted, tested backups against a defined recovery point and recovery time objective
• Automated suppression of any aggregate report below the Rule of Ten minimum cohort size
• Error monitoring configured to exclude personal and mental-health-adjacent data by default
• [Add: penetration testing cadence, employee security training, incident response plan reference — as applicable]