Data Processing Agreement

Data Protection Legislation means applicable data protection and privacy laws, including the UK GDPR and Data Protection Act 2018 and, where applicable, equivalent legislation in other jurisdictions.

Personal Data means personal data processed by Bidding Brain on behalf of the Customer.

Processing has the meaning given to it under applicable Data Protection Legislation.

Sub-processor means a third party appointed by Bidding Brain to process Personal Data on behalf of the Customer.

The Customer is the Controller of Personal Data uploaded to or processed through Bidding Brain on the Customer's behalf.

Bidding Brain acts as the Processor.

The Customer retains control of Personal Data and its rights to give lawful, documented instructions about the processing.

The Customer is responsible for ensuring that it has an appropriate lawful basis for processing Personal Data and providing any required privacy information to individuals.

Bidding Brain will process Personal Data only on the Customer's documented instructions, including instructions concerning international transfers, unless processing is required by UK law.

• To provide the Bidding Brain services
• As necessary to comply with the agreement
• As required by applicable law.

Where UK law requires processing outside the Customer's instructions, Bidding Brain will inform the Customer before processing unless the law prohibits that notice on important grounds of public interest.

Bidding Brain will immediately inform the Customer if, in its reasonable opinion, an instruction infringes applicable Data Protection Legislation. Bidding Brain will not use Customer Personal Data for unrelated purposes.

The subject matter of the processing is the provision, operation, security and support of the Bidding Brain services selected by the Customer.

Processing continues for the term of the Customer's agreement and for any limited period afterwards during which Bidding Brain returns, exports or securely deletes Personal Data in accordance with the agreement and applicable law.

The nature and purpose of the processing may include:

• Store customer information
• Analyse tender documents
• Identify relevant projects and expertise
• Generate AI-assisted responses
• Provide Smart Assist functionality
• Facilitate collaboration
• Manage workflows and tasks
• Provide reporting and analytics
• Provide technical support
• Maintain and secure the service.

Depending on how the Customer uses the platform, Personal Data may include:

• Names
• Job titles
• Contact details
• CV information
• Employment information
• Professional qualifications
• Project experience
• Performance or feedback information
• User account information
• Communications and comments
• Other information uploaded by the Customer.

Customers should not upload special category data unless it is necessary, lawful and specifically agreed where required.

Data subjects may include:

• Customer employees
• Contractors
• Consultants
• Project team members
• Subject matter experts
• Suppliers
• Business contacts
• Other individuals whose information is included in customer documents.

Bidding Brain will ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations.

Bidding Brain will implement appropriate technical and organisational measures designed to protect Personal Data.

These measures may include:

• Access controls
• Authentication
• Encryption
• Secure hosting
• Backup procedures
• Monitoring
• Security testing
• Staff confidentiality obligations
• Incident response procedures.

Further details are provided in our Security & Data statement.

Bidding Brain may use third-party service providers to support the operation of the platform.

The Customer gives Bidding Brain general written authorisation to use Sub-processors necessary to provide the services. Bidding Brain will provide information about relevant Sub-processors and reasonable advance notice of intended material additions or replacements, giving the Customer an opportunity to raise reasonable data protection objections.

Bidding Brain will enter into a written agreement with each Sub-processor that imposes data protection obligations offering an equivalent level of protection for Personal Data. Bidding Brain remains responsible to the Customer for the Sub-processor's performance of those obligations.

Where Personal Data is transferred outside the UK, Bidding Brain will ensure that an appropriate lawful transfer mechanism and safeguards are used where required.

Taking into account the nature of the processing, Bidding Brain will reasonably assist the Customer in responding to requests from individuals exercising their data protection rights.

If Bidding Brain receives a request directly relating to the Customer's Personal Data, we will, where legally permitted, refer the request to the Customer.

Bidding Brain will notify the Customer without undue delay after becoming aware of a Personal Data breach affecting the Customer's Personal Data, subject to applicable law.

Taking into account the nature of the processing and the information available to Bidding Brain, we will provide reasonably available information and assistance necessary for the Customer to meet its obligations concerning security, breach notification and communication to affected individuals.

The ICO identifies assistance with security, breach notification and related obligations as a required processor contract provision.

Where reasonably necessary and taking into account the nature of the processing and information available, Bidding Brain will assist the Customer with data protection impact assessments and prior consultation with a supervisory authority relating to the Bidding Brain services.

Bidding Brain will make available information reasonably necessary to demonstrate compliance with its obligations under applicable Data Protection Legislation.

Subject to reasonable notice and appropriate confidentiality, security and scope requirements, Bidding Brain will cooperate with reasonable audits and inspections by the Customer or an independent auditor appointed by the Customer.

Bidding Brain will promptly inform the Customer if, in its opinion, an audit instruction infringes applicable Data Protection Legislation.

The Customer is responsible for:

• Determining the purposes of processing
• Establishing an appropriate lawful basis
• Providing appropriate privacy information
• Ensuring uploaded information is accurate and lawful
• Obtaining necessary permissions to process employee and third-party information
• Configuring user access appropriately
• Providing appropriate instructions to Bidding Brain.

At the end of the Customer's subscription, Bidding Brain will, at the Customer's choice and subject to the applicable agreement:

• Return Customer Personal Data and then delete existing copies; or
• Securely delete Customer Personal Data and existing copies.

Bidding Brain may retain Personal Data only where and for so long as UK law requires storage, and will continue to protect retained Personal Data under this DPA.

The liability provisions applicable to data processing are governed by the parties' main agreement, including the Bidding Brain Terms & Conditions where applicable.

Nothing in this DPA limits liability where such limitation is prohibited by law.

This DPA is governed by the laws of Northern Ireland, unless otherwise agreed in writing.

Questions and notices concerning this DPA should be sent to [email protected].