Data processing agreement

1Parties and how this agreement applies

This data processing agreement ("DPA") is between the customer named on the account or order form ("Customer") and PN & CPS Technology Ltd ("PN&CPS"), whose address is 20 Swan Street, Manchester, M4 5JW, United Kingdom and whose email is info@pncpstechnology.com.

It forms part of the Terms of service (or the Enterprise order form, if there is one) and applies whenever PN&CPS processes personal data on the Customer's behalf in providing Command Center. It is designed to meet the processor terms that applicable data protection law requires (for example Article 28 of the GDPR or UK GDPR, depending on where the data is processed). Customers who need a countersigned copy can request one through the contact form, topic Legal.

Words such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in applicable data protection law.

2Roles and scope

For the personal data described in Annex 1 ("Customer Personal Data"), the Customer is the controller and PN&CPS is the processor.

Command Center is local first. Code, transcripts, prompts, reports and API keys on the Customer's own devices are not processed by PN&CPS and are outside this DPA. In practice, Customer Personal Data is limited to the sessions members upload to a Team Hub that PN&CPS hosts, and the member records PN&CPS keeps to run the Customer's plan.

Anthropic is not a sub-processor of PN&CPS. Model requests are sent from the Customer's devices directly to Anthropic using the Customer's own API key, under the Customer's own agreement with Anthropic. That processing is outside this DPA, and the Customer is responsible for having appropriate terms in place with Anthropic.

For its own account, billing and security records about the Customer and its users, PN&CPS acts as an independent controller under its Privacy policy.

3Our obligations as processor

PN&CPS will:

1. process Customer Personal Data only on the Customer's documented instructions, which are this DPA, the Terms and the Customer's use and configuration of the Service, unless the law requires otherwise, in which case PN&CPS will tell the Customer first where the law allows;
2. tell the Customer promptly if it believes an instruction breaks data protection law;
3. make sure everyone authorised to process Customer Personal Data is bound by confidentiality;
4. apply the security measures in Annex 2;
5. engage sub-processors only as described in section 7;
6. help the Customer, taking into account the nature of the processing, to respond to data subject requests, carry out data protection impact assessments and consult the competent data protection authority where needed;
7. delete or return Customer Personal Data at the end of the Service as described in section 12;
8. make available the information needed to show compliance with this DPA, and allow audits as described in section 11.

4Customer obligations

• The Customer is responsible for having a lawful basis for the processing and for giving data subjects the information the law requires.
• The Customer decides which companies' sessions are uploaded to the Team Hub, and keeps special category data and secrets out of those sessions. The app's automatic redaction reduces this risk but does not remove it.
• The Customer manages who has access through the admin settings, and removes members who leave.

5Confidentiality of personnel

PN&CPS limits access to Customer Personal Data to the staff and contractors who need it to provide, support or secure the Service, and only for as long as they need it. Each is bound by a written duty of confidentiality that continues after their engagement ends.

6Security

PN&CPS implements and maintains the technical and organisational measures in Annex 2, which are designed to give a level of security appropriate to the risk. PN&CPS may update these measures as technology changes, provided the overall level of security does not decrease.

7Sub-processors

The Customer gives general authorisation for PN&CPS to use sub-processors. The current list is in Annex 3. PN&CPS will:

• give the Customer at least 30 days' notice by email before adding or replacing a sub-processor;
• let the Customer object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may end the affected plan and receive a refund of any prepaid fees for the remaining period;
• impose data protection terms on each sub-processor that are no less protective than this DPA, and remain responsible for its sub-processors' performance.

8International transfers

PN&CPS will transfer Customer Personal Data to another country only when the transfer is protected by the safeguards that applicable data protection law requires, such as an adequacy decision or standard contractual clauses, together with any supplementary measures a transfer risk assessment shows are needed.

9Personal data breaches

PN&CPS will notify the Customer without undue delay, and aims to do so within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as is known at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. PN&CPS will provide further information as it becomes available and will help the Customer meet its own notification duties.

10Data subject requests

If PN&CPS receives a request from a data subject about Customer Personal Data, it will pass the request to the Customer without undue delay and will not respond itself, except to confirm the request has been forwarded. The admin tools let the Customer find, export and delete Team Hub content and member records; where they are not enough, PN&CPS will help on request.

11Audits

PN&CPS will answer reasonable written security questionnaires once a year, and share summaries of relevant security reviews. If that information is not enough to show compliance, or a regulator requires it, the Customer may carry out an audit, at its own cost, on at least 30 days' written notice, during business hours, no more than once in any 12 months, and under confidentiality terms. Requests go through the contact form, topic Security.

12Deletion and return

When the Customer's plan ends, the Customer can export Team Hub content from the admin settings for 30 days. After that period PN&CPS deletes Customer Personal Data from its live systems, and from backups within a further 35 days as they roll over, unless the law requires it to keep some of it. On request, PN&CPS will confirm the deletion in writing.

13Liability

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of service (or the Enterprise order form), except where the law does not allow liability to be limited.

14Term, precedence and law

This DPA lasts as long as PN&CPS processes Customer Personal Data. If it conflicts with the Terms of service, this DPA applies to the processing of Customer Personal Data. It is governed by the same law as the Terms of service.

A1Annex 1: Details of processing

A2Annex 2: Security measures

• Encryption: TLS 1.2 or later in transit.
• Minimal data: the app replaces secrets it recognises in a transcript (API keys, tokens, passwords in URLs and labelled secret values) before the transcript leaves a member's device for the Hub. The API keys stored in the app never leave the device.
• Access control: least privilege, named accounts, access removed on the day someone leaves.
• Isolation: each Customer's Team Hub data is logically separated and scoped by organisation in every query.
• Logging and monitoring: administrative access to production is logged; logs never contain API keys or session content.
• Secure development: code review and an independent audit gate on every change; dependencies monitored and patched; secrets kept out of source control.
• Incident response: a written process covering detection, containment, notification under section 9 and review.
• Vulnerability reports: received through the contact form (topic Security) and handled under the process on the security page.

A3Annex 3: Sub-processors

No payments are taken yet. Paid plans will be billed through a payment provider that we name here before billing starts; it will receive billing details only and may act as an independent controller for them. Anthropic is not a sub-processor (see section 2).