Data Processing Agreement

1 Definitions

In this Agreement, the following terms have the meanings set out below:

• "Controller" means the Tenant: the business that determines the purposes and means of processing personal data within the Always On platform.
• "Processor" means Plan Grow Do Ltd, which processes personal data on the Controller's behalf in operating the Platform.
• "Data Subject" means any living individual whose personal data is processed within the Platform, including the Tenant's team members and their contacts and prospects.
• "Personal Data" has the meaning given in UK GDPR Article 4(1).
• "Processing" has the meaning given in UK GDPR Article 4(2).
• "Special Category Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (where used to uniquely identify someone), health data, or data concerning a person's sex life or sexual orientation, as defined in UK GDPR Article 9.
• "Platform" means the Always On sales management software accessible at alwayson.plangrowdo.com.
• "AI Agents" means the AI-powered assistants Sally, Dan, and Caroline, available within the Platform to assist with contact handling, sales qualification, and intelligence tasks.
• "Email Sync" means the feature that connects a Tenant user's Gmail or Microsoft Outlook mailbox to the Platform, enabling emails to and from contacts to be recorded against the relevant contact record.
• "Sub-Processor" means any third party engaged by Plan Grow Do Ltd to process personal data as part of delivering the Platform.
• "UK GDPR" means the UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.

2 Scope and Subject Matter

This DPA applies to all personal data that Plan Grow Do Ltd processes on behalf of the Tenant in connection with operating the Platform. Full details of those processing activities are set out in Schedule 1.

Plan Grow Do Ltd acts as a Data Processor in relation to all personal data entered into the Platform by or on behalf of the Tenant. The Tenant remains the Data Controller and is responsible for ensuring its use of the Platform complies with applicable data protection law.

2.1 Plan Grow Do Ltd as an Independent Controller

This DPA applies only where Plan Grow Do Ltd acts as a processor on the Tenant's behalf. For certain activities Plan Grow Do Ltd acts as an independent data controller in its own right, including:

• Billing, invoicing, and account administration
• Service communications and support administration
• Legal compliance and enforcement of its terms of service
• Its own internal business records and audit trails

Processing carried out by Plan Grow Do Ltd in its capacity as an independent controller is governed by Plan Grow Do Ltd's own Privacy Notice, not this DPA.

3 Controller's Obligations

The Tenant (Controller) agrees to:

• Ensure there is a valid lawful basis for all personal data entered into the Platform
• Provide any required privacy notices to data subjects whose data is entered into the Platform
• Ensure that any instructions given to Plan Grow Do Ltd comply with applicable data protection law
• Not instruct Plan Grow Do Ltd to process personal data in a way that would breach data protection law
• Inform Plan Grow Do Ltd promptly of any changes to the nature of personal data being processed that may affect Plan Grow Do Ltd's obligations under this DPA
• Ensure that users are made aware of, and have authorised, any Email Sync connection they establish within the Platform
• Not intentionally submit Special Category Data into the Platform unless satisfied that the processing is lawful and appropriate instructions have been provided (see Section 9)

4 Processor's Obligations

Plan Grow Do Ltd agrees to:

4.1 Process only on documented instructions

Process personal data only on the documented instructions of the Controller, including in relation to international transfers, unless required to do so by law (in which case Plan Grow Do Ltd will inform the Controller before processing, unless prohibited by law).

4.2 Confidentiality

Ensure that all persons authorised to access personal data within the Platform are subject to appropriate confidentiality obligations.

4.3 Implement security measures

Implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as detailed in Section 5.

4.4 Sub-processor restrictions

Not engage sub-processors without the general authorisation of the Controller, subject to Section 6 of this DPA.

4.5 Assist the Controller

Assist the Controller, by appropriate technical and organisational measures, in fulfilling obligations to respond to data subject rights requests and to comply with UK GDPR Articles 32–36 (security, breach notification, DPIAs).

4.6 Deletion or return

At the choice of the Controller, delete or return all personal data on termination of services, unless applicable law requires retention, as further detailed in Section 14.

4.7 Audit cooperation

Make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA, and cooperate with audits as set out in Section 15.

5 Security Measures

Plan Grow Do Ltd implements the following technical and organisational measures to protect personal data processed within the Platform:

5.1 Technical measures

• Encryption in transit: all data is encrypted using TLS 1.2 or higher (HTTPS) between users, the Platform, and sub-processors
• Encryption at rest: all data stored within the Supabase (PostgreSQL) database is encrypted at rest
• Tenant isolation: Tenant isolation is enforced at database level through Row Level Security (RLS) and tenant_id controls, designed to prevent users from accessing data belonging to another tenant
• OAuth token security: OAuth tokens for Email Sync connections are encrypted using a dedicated application-level encryption key, separate from general data encryption, and are never visible to other users or Plan Grow Do Ltd staff
• Invite-only access: the Platform has no public self-registration; access is granted by invitation only
• MFA for admin access: multi-factor authentication is enforced for Plan Grow Do Ltd administrative and infrastructure access
• Least privilege access: access to production systems and personal data is restricted to those who need it to perform their role
• Access logging: access to production systems is logged and reviewed periodically
• Automated backups: all tenant data is backed up regularly; backup retention follows Plan Grow Do Ltd's operational backup schedule

5.2 Organisational measures

• All Plan Grow Do Ltd personnel with access to personal data are subject to confidentiality obligations
• Access controls and security configurations are reviewed on a regular basis
• Vulnerability management and patching processes are maintained for all Platform infrastructure
• An incident response process is in place to detect, contain, investigate, and notify in the event of a personal data breach
• Tenant isolation controls are reviewed periodically to confirm that RLS and access controls remain correctly configured
• Sub-processors are selected with regard to their data security standards and contractual commitments

6 Sub-Processors

The Tenant gives general authorisation to Plan Grow Do Ltd to engage the sub-processors listed below. Plan Grow Do Ltd will give the Tenant reasonable advance notice of any intended change to this list (additions or replacements) and the Tenant may object within a reasonable period.

Plan Grow Do Ltd ensures all sub-processors are bound by written data processing agreements providing at least equivalent data protection obligations to those in this DPA.

7 Mailbox Connection and Email Sync

The Platform allows individual users to connect their Gmail or Microsoft Outlook mailbox. When Email Sync is enabled, the following applies:

7.1 What is processed

Once a user connects their mailbox, the Platform accesses and processes the following data:

• Email metadata: sender, recipient, subject line, date and time
• Email body content: the text content of emails sent to or received from contacts whose records exist in the Platform
• Sent emails: where the user sends an email from within the Platform, it is sent via their connected mailbox and recorded against the contact record
• OAuth tokens: the access and refresh tokens that authorise the connection; these are encrypted at rest using a dedicated key and are never exposed to other users or Plan Grow Do Ltd staff

The Platform does not process email attachments or access emails unrelated to contacts with existing records in the Platform. Historical emails are not bulk-imported; only emails sent or received after connection is established are synced, unless a specific historical sync is configured.

7.2 Authorisation

Mailbox connections are only established where the individual user explicitly authorises access via OAuth. Plan Grow Do Ltd does not connect mailboxes without user authorisation. Users can disconnect their mailbox at any time from their profile settings, which immediately revokes access and stops further syncing.

7.3 Disconnection and token deletion

When a user disconnects their mailbox, the Platform immediately revokes the OAuth token and deletes it from storage. No further email syncing takes place after disconnection. Emails already synced and stored against contact records remain, unless deleted by a Tenant manager.

Users may also revoke access directly via their Google Account permissions page or Microsoft My Apps portal at any time.

8 AI Agents and Automated Processing

8.1 Role of the AI agents

The Always On platform includes three AI agents (Sally, Dan, and Caroline) powered by Anthropic's Claude models. These agents assist with inbound contact handling, sales qualification, daily pipeline management, and market intelligence. When an AI agent processes a contact interaction, relevant contact record data and communication context are sent to the Claude API to generate a response, qualification score, recommendation, or suggested action.

8.2 AI outputs are advisory only

All outputs produced by the AI agents, including qualifications, scores, draft responses, recommendations, and suggested next actions, are advisory and assistive only. They are tools to support the Tenant's team, not decisions in themselves.

The Tenant remains responsible for reviewing, approving, and acting on any AI-generated output before it is relied upon or communicated to a contact. Plan Grow Do Ltd does not accept responsibility for decisions taken by the Tenant on the basis of AI-generated outputs without appropriate review.

8.3 No solely automated decisions

The Platform does not make solely automated decisions that produce legal effects or similarly significant effects on individuals within the meaning of UK GDPR Article 22. Human review is always part of the process.

8.4 AI data handling

• The AI agents do not independently retain data between sessions
• Under Anthropic's Commercial Terms of Service, which govern Plan Grow Do Ltd's use of the Claude API, customer inputs and outputs are not used to train Anthropic's models by default
• Data processed by the AI agents remains subject to this DPA and is not used for any purpose beyond delivering the Platform to the Tenant

9 Special Category Data

The Always On platform is designed for B2B sales management and is not intended for the processing of Special Category Data or criminal offence data.

The Tenant must not intentionally submit Special Category Data into the Platform unless it has:

• Satisfied itself that processing that data is lawful under UK GDPR Articles 9 and 10
• Identified an appropriate lawful basis and condition for processing
• Provided Plan Grow Do Ltd with any specific instructions required for handling that data

Plan Grow Do Ltd recognises that Special Category Data may occasionally appear incidentally in free-text fields (for example in emails, WhatsApp messages, or form submissions) without having been intentionally submitted. In those cases, Plan Grow Do Ltd will process such data only as necessary to provide the Platform and in accordance with this DPA and the Tenant's instructions.

10 Data Subject Rights

Plan Grow Do Ltd will assist the Controller in fulfilling its obligations to respond to data subject rights requests under UK GDPR, including requests relating to:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)

Where a data subject contacts Plan Grow Do Ltd directly regarding their rights, Plan Grow Do Ltd will promptly refer the request to the Controller. The Controller is responsible for determining how to respond.

Plan Grow Do Ltd provides tools within the Platform to enable the Controller to export, rectify, and delete personal data to support data subject requests.

11 Personal Data Breaches

Plan Grow Do Ltd will notify the Controller without undue delay and, where feasible, within 24 hours of becoming aware of a personal data breach affecting data processed under this DPA.

Where not all information is available within 24 hours, Plan Grow Do Ltd will provide an initial notification with the information available at that time, followed by further updates in phases as the investigation progresses. Initial notification will include, where known:

• The nature of the breach, including the categories and approximate number of data subjects and records likely to be affected
• Contact details for Plan Grow Do Ltd's data protection point of contact
• The likely consequences of the breach
• Steps taken or proposed to address the breach and mitigate its effects

Plan Grow Do Ltd will cooperate with the Controller throughout the investigation and provide reasonable assistance where the Controller is required to notify the ICO or affected data subjects.

To report a suspected breach: info@plangrowdo.com

12 Data Protection Impact Assessments

Where the Controller is required to conduct a Data Protection Impact Assessment (DPIA) in connection with processing on the Platform, Plan Grow Do Ltd will provide reasonable assistance, including:

• Supplying information about the Platform's processing activities and security measures on request
• Describing sub-processors and data flows involved in the processing
• Cooperating with prior consultation with the ICO where required under UK GDPR Article 36

13 International Transfers

All primary data storage is within the EU (Ireland). Where personal data is transferred to or processed by sub-processors outside the UK or EU, including Anthropic (Claude API), Google (Gmail API), Microsoft (Microsoft Graph), and Meta, Plan Grow Do Ltd ensures appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission or ICO, as applicable
• International Data Transfer Agreements (IDTAs) for UK-specific transfers where required
• Transfer Impact Assessments (TIAs) conducted where required by law or guidance

Details of transfer mechanisms for each sub-processor are available on request from info@plangrowdo.com.

14 Return and Deletion of Data

On termination of the service agreement, Plan Grow Do Ltd will, at the Controller's written election within 30 days of termination:

• Return: provide an export of all personal data held in active production systems in a machine-readable format (CSV or equivalent); or
• Delete: securely delete all personal data held in active production systems and confirm in writing that deletion is complete.

Where no election is made within 30 days of termination, Plan Grow Do Ltd will securely delete active production data by default.

14.1 Backups

The Platform maintains automated backups of all tenant data. Deletion from active production systems will be completed within the timeframe above, but backup copies may remain until they are overwritten or expire under Plan Grow Do Ltd's standard backup retention cycle.

Backup data is held solely for disaster recovery purposes and will not be accessed, used, or restored for any other purpose. If a backup containing deleted customer data is restored following a disaster recovery event, the previously deleted data will be re-deleted promptly following restoration.

15 Audit Rights

The Controller has the right to audit Plan Grow Do Ltd's compliance with this DPA. Plan Grow Do Ltd will first respond to audit requests by providing relevant documentation (such as security policies, sub-processor agreements, and breach records) within a reasonable timeframe.

Where a physical audit or inspection is required, this will be agreed in advance, conducted at the Controller's cost, with no less than 30 days' written notice, and no more than once per calendar year, unless a personal data breach has occurred.

The Controller agrees not to request information that would compromise the security of other tenants' data or Plan Grow Do Ltd's commercially confidential information.

16 Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the main service agreement between the Tenant and Plan Grow Do Ltd.

Where Plan Grow Do Ltd has processed personal data in breach of this DPA or UK GDPR and this has caused damage to the Controller or a data subject, Plan Grow Do Ltd accepts liability to the extent it is responsible for the breach.

Where the Controller has given inaccurate or unlawful instructions that caused a breach, the Controller bears responsibility to the extent of those instructions.

17 Term and Termination

This DPA comes into effect when the Tenant activates their Always On workspace and accepts the service terms. It remains in force for the duration of the service agreement between the parties.

This DPA terminates automatically on termination or expiry of the service agreement, subject to any continuing obligations under Section 14 (return and deletion of data).

18 Governing Law

This DPA is governed by and construed in accordance with the laws of England and Wales. Any disputes arising under this DPA are subject to the exclusive jurisdiction of the courts of England and Wales.

S1 Schedule 1: Processing Details

This Schedule sets out the details of the processing carried out by Plan Grow Do Ltd on behalf of the Controller, as required by UK GDPR Article 28(3).

Subject matter

The provision of the Always On B2B sales management platform, including AI-assisted contact qualification, pipeline management, email and WhatsApp communication sync, and sales analytics.

Duration

For the duration of the service agreement, plus any post-termination period required to fulfil obligations under Section 14.

Nature and purpose of processing

Types of personal data

• Contact identity data: name, email address, telephone number, job title, company name
• Commercial data: enquiry content, pipeline stage, BANT qualification scores, meeting notes, AI-generated outputs
• Communication data: email metadata and body content, WhatsApp messages, form submission content
• User account data: rep and manager name, email address, profile details, login activity
• OAuth tokens: encrypted mailbox connection tokens (Email Sync users only)

Categories of data subjects

• The Tenant's sales representatives and managers (platform users)
• The Tenant's contacts, prospects, and customers whose data is entered into or captured by the Platform