Data Processing Agreement

1. Parties and scope

This Data Processing Agreement (DPA) is between Formatix AI Limited, a company registered in England and Wales with number 15626717, whose registered office is at 20-22 Wenlock Road, London N1 7GU, and which is registered with the UK Information Commissioner's Office under number ZC184545 (Formatix, we, us), and the business customer that has accepted our Terms of Service (Customer, you).

It applies whenever Formatix processes Customer Personal Data in providing the Formatix platform at platform.formatix.ai, the Formatix API, the MCP connectors and assistant apps, the browser extension, email-in formatting at [email protected] and the integrations you connect (together, the Services).

This DPA forms part of the Terms of Service. It takes effect when you accept the Terms, or on 20 October 2026 for customers who accepted them earlier, and lasts for as long as we process Customer Personal Data. If anything in the Terms conflicts with this DPA on the processing of personal data, this DPA prevails. A countersigned copy is available on request.

2. Definitions

• Data Protection Law means the UK GDPR, the Data Protection Act 2018 and, where it applies to the processing, the EU General Data Protection Regulation (EU GDPR), each as amended or replaced.
• Customer Personal Data means personal data contained in the content you or your users upload to or create in the Services, such as CVs, candidate profiles, assessment reports, consultant notes, job descriptions, contact records and the documents the Services produce, and personal data we receive from integrations you connect.
• Controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in Data Protection Law.
• Sub-processor means a third party we engage to process Customer Personal Data on our behalf.

3. Roles of the parties

For Customer Personal Data you are the controller (or a processor acting for your own client) and Formatix is your processor (or sub-processor). Formatix is a separate controller for its own account, billing, support and website data, as described in our Privacy Policy; that data is outside this DPA.

The details of the processing (subject matter, duration, nature and purpose, types of personal data and categories of data subjects) are set out in Annex 1.

4. Your obligations

• You are responsible for having a lawful basis for the processing, for giving candidates and other data subjects the privacy information Data Protection Law requires, and for the accuracy of the data you upload.
• Your instructions to us must comply with Data Protection Law. You will not upload special category or criminal offence data unless you have a lawful basis to do so and it is needed for the documents you ask us to produce.
• You are responsible for reviewing AI-generated documents before you rely on them or send them to your clients, and for any decision about a candidate. Formatix does not make decisions about candidates.

5. Our obligations as processor

Formatix will:

• Instructions: process Customer Personal Data only on your documented instructions, which are this DPA, the Terms and your use and configuration of the Services, unless the law requires otherwise; in that case we will tell you before processing unless the law forbids it. We will tell you if we believe an instruction infringes Data Protection Law.
• No other use: not sell Customer Personal Data, not use it for our own purposes, and not use it to train AI models. We use our AI providers under terms or account settings under which they do not use it to train their models either.
• Confidentiality: make sure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality and has access only as far as needed to provide or support the Services.
• Security: apply the technical and organisational measures in Annex 2, which we may improve over time but will not reduce in overall effect.
• Data subject rights: taking into account the nature of the processing, help you by appropriate technical and organisational measures to respond to requests from data subjects. If a data subject contacts us directly about Customer Personal Data, we will pass the request to you where we can identify you, and will not respond to it ourselves except to say we have done so.
• Assistance: provide reasonable help with your security obligations, personal data breach notifications, data protection impact assessments and prior consultations with a supervisory authority, taking into account the information available to us.
• Records: keep the records of processing that Data Protection Law requires of processors.

6. Sub-processors

You give us general authorisation to engage sub-processors. Our current sub-processors are listed in Annex 3.

• Each sub-processor is bound by a written contract that imposes data protection obligations no less protective than this DPA, as far as they apply to the service it provides.
• We will update Annex 3 and email the account owner at least 14 days before a new sub-processor starts processing Customer Personal Data. Where a change is urgent, for example to keep the Services secure or available, we will tell you as soon as we can.
• You may object to a new sub-processor on reasonable data protection grounds by emailing [email protected] within that notice period. We will discuss it with you in good faith; if we cannot resolve it, you may stop using the affected part of the Services or end your subscription, and we will refund any prepaid fees for the unused period.
• We remain responsible to you for the performance of our sub-processors' obligations.

Services you choose to connect, such as your applicant tracking system or CRM, your own Gmail or Outlook mailbox, or a data enrichment or messaging service, are not our sub-processors: we exchange data with them on your instructions, and your own terms with those providers govern what they do with it. The same applies to an AI assistant you use with Formatix, such as ChatGPT, Claude, Microsoft Copilot or Perplexity: content you give the assistant is governed by your terms with that provider, and what it sends to Formatix is then covered by this DPA.

7. International transfers

The Formatix platform, its database and stored files are hosted in the United Kingdom (Amazon Web Services, London). Some sub-processors, including our AI providers, process data in or from other countries such as the United States, as shown in Annex 3.

We will transfer Customer Personal Data outside the UK or the European Economic Area only with an appropriate safeguard under Data Protection Law, such as UK adequacy regulations (including the UK-US Data Bridge for certified US companies), the EU-US Data Privacy Framework, the UK International Data Transfer Agreement or Addendum, or the European Commission's Standard Contractual Clauses. Where the EU GDPR applies to you, the Standard Contractual Clauses (module two or three, as applicable) are incorporated by reference for any transfer that needs them. You can ask us which safeguard applies to a particular sub-processor.

8. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will send the notice to the account owner's email address and give you the information you reasonably need to meet your own obligations, including, as far as we know it, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed. Where we cannot give all the information at once, we will give it in phases. We will take reasonable steps to contain and remedy the breach.

Our notice of a breach is not an admission of fault or liability.

9. Retention, return and deletion

• While your account is active, you control retention: you can delete records at any time, and team owners can set automatic deletion after 30, 60, 90 or 365 days. You can download your documents from the platform at any time.
• Emails sent to [email protected] are removed from the processing inbox about 24 hours after they are processed.
• When your account closes, or on your written request, we will delete Customer Personal Data within 30 days, unless the law requires us to keep it. Any backup copies are deleted as backups are overwritten, and are not used in the meantime. On request before closure we will help you export your data.

10. Information and audits

We will make available to you the information reasonably necessary to demonstrate compliance with this DPA and Article 28 of the UK GDPR, normally by answering your security and data protection questionnaire and providing relevant documentation.

Where that information is not enough, or a supervisory authority requires it, you may audit our compliance, by yourself or through an independent auditor bound by confidentiality, no more than once a year, on at least 30 days' written notice, during business hours and in a way that does not disrupt the Services or compromise other customers' data. Each party bears its own costs.

11. Liability, changes and governing law

• Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where Data Protection Law does not allow liability to be limited.
• We may update this DPA to reflect changes in the law, a supervisory authority's guidance or the Services. We will not make a change that reduces the protection of Customer Personal Data without your agreement. The current version is always published at formatix.ai/dpa, and we will tell account owners about material changes.
• This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the Standard Contractual Clauses require otherwise.

Annex 1: Details of the processing

Annex 2: Technical and organisational security measures

• Encryption: HTTPS (TLS) for all traffic to the platform, API and connectors; stored data encrypted at rest.
• Access control: customer data separated by account and team; role-based permissions within a team; administrative access to servers restricted to named staff using key-based authentication only (no password log-ins).
• Network security: traffic routed through Cloudflare's network protection; server firewalls restricted to the services needed.
• Application security: secure password storage (hashing only), protection against cross-site request forgery, signed and time-limited links for private files, and regular security reviews of our code and infrastructure, with fixes prioritised by risk.
• AI providers: document text is sent only for the output requested, under terms or settings under which the provider does not train on it.
• Data minimisation and retention: configurable automatic deletion of records; short retention of email-in messages and demo uploads; deletion on request.
• People: confidentiality obligations for everyone with access, and access granted only as needed.
• Incidents: a breach response procedure, including notification under section 8, and a published route for reporting security issues at formatix.ai/security.

Annex 3: Sub-processors

Formatix's own billing, accounting and website providers (such as Stripe and FreeAgent) process account and billing data for which Formatix is the controller; they are listed in the Privacy Policy and do not receive Customer Personal Data.

Contact

Data protection questions, requests for a countersigned copy, security questionnaires and objections to sub-processors: Dominic Gonsalves, Data Protection Officer, [email protected]. Formatix AI Limited, 20-22 Wenlock Road, London N1 7GU. ICO registration ZC184545.