Jojan One Data Processing Agreement

The provider is Jojan One Technologies Ltd, company number 17348476, whose registered office is 66 Paul Street, London, England, United Kingdom, EC2A 4NA (Jojan One, we or us). The Customer is the business customer identified in the subscription order or verified workspace registration that incorporates this DPA. The underlying agreement includes the Jojan One Terms of Service and applicable order (the Service Agreement).

This DPA takes effect when an authorised representative accepts it electronically, signs an order incorporating it, or otherwise agrees it in writing. The customer identity, accepting representative, date, time and version must be recorded and retained. Both parties agree to this method of contracting; a handwritten signature is not required. Merely publishing or linking this DPA does not by itself record a particular customer's agreement.

Data Protection Law means the UK GDPR and Data Protection Act 2018 as amended and, where applicable to the processing, the EU GDPR and relevant implementing law. Controller, processor, personal data, processing, personal data breach and supervisory authority have the meanings given by that law. Customer Personal Data means personal data in Customer Content that we process on the Customer's behalf under the Service Agreement.

The Customer is controller and Jojan One is processor. Where the Customer acts as processor for another controller, Jojan One is sub-processor and the Customer confirms authority to appoint us and pass on instructions. The Customer must identify any additional requirements of its controller that need to be agreed. References to controller obligations apply to the Customer to the extent relevant to its role.

Jojan One acts as a separate controller for its own account administration, billing, security and legal-compliance purposes as described in the Privacy Notice. These purposes do not give it an unrestricted right to repurpose Customer Personal Data. Any controller activity remains subject to applicable law and transparency duties.

This DPA prevails over conflicting terms concerning Customer Personal Data. Mandatory transfer clauses prevail where required by their terms. Other provisions of the Service Agreement remain in effect. Neither party may use an order or general change to the Terms to reduce mandatory data protection rights or obligations.

The Customer determines the purposes and authorised scope of processing described in Schedule 1. Its documented instructions comprise this DPA, the Service Agreement, authorised use and configuration of the Services and further lawful written instructions agreed through support@jojanone.com. These include instructions about integrations, AI use, exports, deletion and international transfers within the agreed arrangements.

The Customer must have a lawful basis for processing and disclosure, provide required notices, obtain any necessary permissions, ensure its users act within their authority, and minimise the information uploaded. It is responsible for accuracy and correction of source records and any additional conditions for special category or criminal offence data. It must not issue unlawful instructions.

The Customer may monitor our compliance, request evidence, give lawful instructions, choose return or deletion and exercise the rights in this DPA. Additional processing outside the agreed scope requires written agreement. If an instruction requires a material service change, the parties will discuss scope, safeguards and any reasonable agreed charges; we will not start it merely because a request has been received.

We will process Customer Personal Data only on documented instructions, including for transfers, unless UK law or other applicable law permits and requires otherwise. Where legally allowed, we will inform the Customer of a legal requirement before the processing. We will immediately inform the Customer if, in our opinion, an instruction infringes applicable data protection law and may pause the affected processing while the concern is resolved.

We will not sell Customer Personal Data, use it for unrelated advertising, combine it for unrelated commercial purposes or disclose it except as authorised by this DPA or required by law. We will use the minimum access and data reasonably necessary to provide, support and secure the instructed Services. Truly anonymised statistics that cannot identify a person or customer may be used to improve the service; anonymisation itself must be within lawful instructions.

When the Customer enables or requests an AI feature, it instructs us to process the relevant prompts, selected workspace context and outputs for that feature. Automated monitoring may operate only within the feature scope disclosed to and enabled for the Customer. We must limit transmitted context to what is relevant and apply Schedule 2 controls.

Customer Personal Data must not be used to train general-purpose AI models by us or our AI sub-processors under this DPA. Separate written agreement and a lawful basis would be required for a different use. Provider operational retention, abuse monitoring and any human review must be disclosed in the provider register and consistent with these instructions. A training prohibition is not a promise of zero provider retention.

An AI gateway, routing intermediary or additional model provider that processes Customer Personal Data is a sub-processor requiring the authorisation and disclosure in clause 9. We must not route data through an undisclosed provider or select a route that permits training contrary to this clause.

We will limit access to authorised people who need it for the instructed work. Personnel with access must be bound by contractual confidentiality or an appropriate statutory obligation, receive relevant data protection and security instruction and have access removed when no longer required. Confidentiality continues after their engagement ends.

We will implement and maintain appropriate technical and organisational measures to meet Article 32 requirements, taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and risks to individuals. Schedule 2 specifies the minimum contractual measures. We will regularly assess their effectiveness and address identified material weaknesses.

We may improve or replace measures if the overall protection is not materially reduced. We will inform the Customer of a material adverse change and cooperate on necessary safeguards. We will not process data that requires protections the Services cannot provide; the parties must agree additional measures or limit the processing.

The Customer grants general written authorisation to engage the sub-processors identified in the completed and supplied Schedule 3 register for the stated functions, locations and data. A supplier that handles only Jojan One's own controller data is not authorised as a Customer Personal Data sub-processor merely because it appears on a general vendor list.

Before appointment, we will assess the supplier's ability to protect the data and enter a binding written contract imposing data protection obligations offering at least the same level of protection as this DPA and meeting Article 28. We remain fully liable to the Customer for performance of those obligations by our sub-processors, subject only to lawful limitations in the Service Agreement.

We will give at least 30 days' written notice before adding or replacing a sub-processor, identifying its legal entity, function, processing locations and relevant safeguards. The Customer may object on reasonable data protection grounds during that period. We will discuss the objection in good faith and seek a reasonable alternative, such as a different provider, configuration or exclusion of the affected feature.

If no reasonable solution is available before the change, either party may terminate the affected Services before that supplier processes the Customer's data. We will refund the unused prepaid portion of those Services. We will not send the affected data to the new supplier while a timely, reasonable objection remains unresolved, except to the extent a legal obligation requires otherwise.

We will not make a restricted transfer, including by remote access, unless it follows the Customer's documented instructions and a valid mechanism under applicable law. A European primary database location does not exclude transfers by AI, email, hosting or support suppliers. Locations and the basis for transfers must be documented in Schedule 3 before processing starts.

Where there is no applicable adequacy basis, the responsible exporter must implement an appropriate safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the relevant EU Standard Contractual Clauses, and carry out the required transfer assessment and supplementary measures. EU processing requires a valid EU mechanism where applicable. We will make relevant evidence available on request, with proportionate confidential redactions.

This DPA is not itself the IDTA, UK Addendum or EU Standard Contractual Clauses and does not execute those instruments by mentioning them. The correct instruments, modules, parties and annexes must be completed for the actual transfer. If adequate protection cannot be maintained, we will suspend the affected transfer and cooperate on a lawful alternative or termination of the affected Services.

Taking account of the nature of processing, we will provide appropriate technical and organisational assistance so the Customer can respond to requests for access, correction, erasure, restriction, objection, portability and other applicable individual rights. We will promptly forward requests concerning Customer Personal Data to the Customer and will not respond substantively except on its instructions or where law requires us to do so.

Taking account of the processing and information available to us, we will assist with security duties, breach assessment and notification, data protection impact assessments and prior consultation with a supervisory authority. We will provide relevant information about our processing and controls and cooperate with the competent authority as legally required.

If we receive a binding demand for Customer Personal Data, we will notify the Customer before disclosure where lawful, review the demand's legal basis where appropriate and limit disclosure to what is required. We will not voluntarily provide wider access.

Ordinary assistance is included in the Services. If an exceptional request involves substantial additional work, reasonable charges must be agreed in advance, must not prevent or delay compliance with a legal deadline and must not apply to remediation of our breach or demonstration of our compliance.

We will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. We will aim to give the initial notice within 24 hours and in any event within 72 hours of awareness; the outer period does not permit avoidable delay or replace the without-undue-delay duty. Notification will go to the registered administrator or designated incident contact.

As information becomes available, we will describe the nature of the breach, affected data and individuals, approximate numbers where known, likely consequences, measures taken or proposed, and a contact for further information. We may provide information in stages rather than delay the initial alert. We will preserve relevant evidence, investigate, contain the incident and cooperate on mitigation and remediation.

The Customer is responsible for deciding and making its controller notifications to authorities or individuals, with our assistance. Its own regulatory deadline may run independently from receipt of our notice. We will not notify individuals or issue a public statement identifying the Customer without its agreement unless legally required. An incident notification does not by itself admit fault.

We will make available all information necessary to demonstrate our Article 28 compliance and allow and contribute to audits and inspections by the Customer or an independent auditor it appoints. Available reports and questionnaires may be used first where sufficient, but do not remove inspection rights where further checks are reasonably necessary.

The parties will agree reasonable notice, scope, timing, confidentiality and security arrangements without obstructing lawful audits. Urgent checks may require shorter notice. Audits must protect other customers' data and avoid unnecessary disruption. Each party bears its own ordinary costs; we bear reasonable corrective work and repeat verification costs arising from our material breach. Neither fees nor frequency limits may prevent legally necessary audits or regulator access.

This DPA applies while we or our sub-processors hold Customer Personal Data. On termination, expiry or an earlier valid instruction, we will, at the Customer's choice, return the data in an available commonly used format or securely delete it, and delete remaining copies unless law requires storage. A return request includes deletion of remaining copies after return unless the Customer gives another lawful instruction.

The Customer should give its choice before closure or during the export opportunity, normally at least 30 days after subscription end under the Terms, unless a legal or urgent security restriction applies. If no instruction is received after notice and the export opportunity, the default instruction is deletion. Return or deletion, including protected backup copies, must be completed within 90 days of closure unless law requires retention or a different lawful timetable is expressly agreed with the Customer.

Backups awaiting deletion must be isolated from ordinary use, remain protected and not be restored except for recovery or legal necessity. If restored, deletion instructions must be reapplied. Legally retained data must be limited to what is required, restricted to that purpose and deleted when the requirement ends. We will explain any required retention where lawful and provide written confirmation of completed return or deletion on request.

Contractual liability between the parties follows the Service Agreement, including its lawful limitations, except where mandatory law or binding transfer clauses require otherwise. Nothing in this DPA limits a person's rights to a remedy or compensation, either party's direct statutory duties, a supervisory authority's powers or liability that cannot lawfully be limited. Sub-processor obligations remain as stated in clause 9.

Changes to this DPA require a documented agreement or a valid change process under the Service Agreement. Changes must preserve mandatory protection; sub-processor and transfer changes also follow clauses 9 and 10. The laws and courts of England and Wales govern contractual disputes, subject to mandatory rights, applicable data protection law and any controlling provisions in transfer instruments.

Subject matter and purpose: providing the Customer's subscribed business platform, including workspace storage, document and policy management, compliance and risk records, HR administration, reports, search, support, authorised integrations and enabled Jova analysis or generation. Processing is limited to contracted functions and the Customer's lawful instructions.

Nature and frequency: collection, recording, organisation, storage, retrieval, consultation, analysis, AI-assisted generation, alteration, permitted transmission or disclosure, export, restriction and deletion. Processing is ongoing during the subscription and any instructed transition period; individual operations depend on use and enabled features.

Duration: the subscription and transition or retention periods in clause 14. Customer rights and obligations: the Customer determines purposes, chooses features and permissions, provides lawful instructions, monitors compliance and exercises the rights described in this DPA.

Data subjects: authorised users, administrators, employees, job applicants, contractors, directors, shareholders, business customers, suppliers, advisers and other people identified in records the Customer lawfully provides.

Data types: identity and business contact details; account and workspace identifiers; employment, role and training information; contractual and commercial correspondence; governance, risk, policy and compliance records; relevant financial or billing information; documents and attachments; audit and activity records; prompts, selected context and AI outputs. The actual scope is limited to data the Customer provides and the information needed for authorised features.

Sensitive data: health, disability, trade union or other special category information and criminal offence or background-check information may be included in lawful customer records only where necessary, permitted by the agreed service scope and protected by appropriate additional controls. No blanket authorisation for sensitive data is created. The Customer must establish applicable Article 9 or Article 10 and domestic-law conditions and identify any required additional measures before processing.

These are contractual minimum requirements for the processing. They do not represent a certification or guarantee that security incidents cannot occur. Jojan One must maintain evidence of implementation and configure providers consistently with the processing scope.

Access and workspace separation

Use individual authorised accounts, least-privilege permissions and timely removal of access. Protect privileged production and provider access with multi-factor authentication. Enforce workspace separation and authorisation at the data and application layers and test it before material releases. Protect and rotate service credentials; do not expose production secrets to browsers or public repositories.

Data protection in transit and storage

Protect transmitted data with current, appropriately configured encryption and encrypt stored production data and backups where supported by the agreed infrastructure. Limit accessible data to the feature and authorised role, and use minimisation, redaction or pseudonymisation where appropriate. Ensure AI prompts and support logs do not unnecessarily duplicate sensitive records.

Operations and resilience

Maintain access-controlled event and administrative logs, monitor relevant security alerts and address vulnerabilities according to risk. Review code and material configuration changes, manage dependencies and separate development from production. Maintain protected backups and recovery procedures, test restoration periodically and document backup retention and deletion within clause 14.

People and incident management

Maintain confidentiality obligations, appropriate training, a documented incident response process and a contact for escalation. Periodically assess control effectiveness, record material findings and track remediation. Supplier selection and ongoing review must consider data protection risks, access, transfer mechanisms and the ability to honour deletion and rights requests.

The following service brands and functions are identified in Jojan One's published provider information. Before this schedule is used as the initial authorisation under clause 9, Jojan One must provide the Customer with the completed supplier register described below. A brand name or a region description alone does not establish the contracting entity or the legal basis for a transfer.

Vercel

Function: application hosting and content delivery. Relevant data can include request and technical information and application data passing through hosted functions. Published location description: global edge delivery with a European primary region. Exact execution, logging, support locations and legal entity must be specified in the supplier register.

Supabase

Function: managed database, authentication and uploaded-file storage. Relevant data includes account authentication information and Customer Personal Data held in the database or storage. Published location description: a European production region using managed infrastructure. Exact project, backup and support locations and contracting entity must be specified in the register.

Anthropic

Function: AI processing for Jova. Relevant data includes prompts and the selected business context needed to produce outputs. Published location description: United States processing. The register must specify the contracted entity, access route, retention and security-monitoring terms, training exclusion and applicable transfer instrument. Any separate gateway or intermediary must have its own entry.

Resend

Function: transactional email. Relevant data includes recipient details, message content and delivery metadata. Published location description: European and United States processing. The register must identify the legal entity, actual locations, retention and applicable transfer mechanism. Messages must avoid unnecessary workspace data.

Stripe

Function: payment processing. Data can include billing contact and transaction information. Published location description: UK and European processing. The register must distinguish processing on behalf of the Customer from Stripe's own controller activities and identify relevant entities, locations and arrangements. Listing Stripe does not automatically make all its activities sub-processing under this DPA.

Required supplier register information

For each relevant supplier, the completed register must record its full contracting legal entity, purpose and data categories, storage and remote-access countries, retention and deletion periods, contract or DPA reference, sub-processor chain and applicable transfer basis. It must identify any executed transfer clauses, assessment and supplementary safeguards, as well as the date supplied to the Customer. The register becomes part of this schedule when supplied and accepted with the DPA, and is then maintained under clause 9.

No additional analytics, support, monitoring or AI-routing provider is authorised to receive Customer Personal Data unless disclosed and authorised under clause 9. The initial register must not omit an active provider. Customer Personal Data must not be sent to a supplier with an unresolved authorisation or transfer requirement.

Jojan One Technologies Ltd | Company number 17348476 66 Paul Street, London, England, United Kingdom, EC2A 4NA Website www.jojanone.com | Email support@jojanone.com