Data Processing Agreement

Draft — pending legal review. Not yet in force.

This is a template for review by our lawyers. It is not yet offered for signature. Text in square brackets is still to be decided; numbers marked "proposed" are not yet agreed. When in force, the English version governs; the Chinese version is a translation.

Version: draft of 29 September 2026

This Data Processing Agreement ("DPA") is between the customer named in the order form or account ("Customer", the controller) and NICETO LTD, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ ("Provider", the processor). It forms part of the agreement for Preworld Review (the Terms of Service and any order form, together the "Agreement") and applies whenever Provider processes Customer Personal Data.

1. Definitions

• Data Protection Law: the UK GDPR, the Data Protection Act 2018 and other data protection law applicable in the United Kingdom.
• Customer Personal Data: personal data in Customer's content that Provider processes on Customer's behalf under the Agreement.
• Personal Data Breach, controller, processor, data subject and processing have the meanings given in the UK GDPR.
• Sub-processor: another processor Provider engages to process Customer Personal Data.

2. Roles and scope

2.1 Customer is the controller and Provider the processor of Customer Personal Data. Annex 1 describes the processing.

2.2 Customer is responsible for having a lawful basis for the processing and for its instructions complying with Data Protection Law. Under the Acceptable Use Policy, Customer uses test data and test credentials; Customer will not provide special category data or real customers' personal data unless the parties agree it in writing.

3. Provider's obligations (UK GDPR Article 28(3))

Provider will:

(a) process Customer Personal Data only on Customer's documented instructions, including about international transfers, unless the law requires otherwise, in which case Provider tells Customer first unless the law forbids it. The Agreement, Customer's configuration of the Service and its use of the Service's features are Customer's instructions. Provider tells Customer if it believes an instruction breaches Data Protection Law;

(b) ensure that everyone authorized to process Customer Personal Data is bound by confidentiality;

(c) take the technical and organizational measures required by Article 32, as described in Annex 2;

(d) engage Sub-processors only as set out in section 4;

(e) taking into account the nature of the processing, help Customer by appropriate technical and organizational measures to respond to requests from data subjects exercising their rights;

(f) help Customer comply with Articles 32 to 36 (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to Provider;

(g) at the end of the Agreement, delete or return Customer Personal Data as set out in section 7;

(h) make available all information necessary to demonstrate compliance with this section, and allow for and contribute to audits as set out in section 8.

4. Sub-processors

4.1 Customer gives general authorization for Provider to engage Sub-processors. The current Sub-processors are listed in Annex 3.

4.2 Provider will give Customer at least [30 days — proposed] notice before adding or replacing a Sub-processor, by email to Customer's organization owner and on the data processing page. Customer may object on reasonable data protection grounds within that period; the parties will then discuss it in good faith, and if they cannot resolve it, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.

4.3 Provider imposes on each Sub-processor data protection obligations that offer at least the same protection as this DPA, and remains liable to Customer for its Sub-processors' performance.

5. International transfers

Customer Personal Data is stored in the United Kingdom. Provider will transfer it outside the United Kingdom only to the Sub-processors in Annex 3 and only with a safeguard recognized by Data Protection Law: [the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or adequacy regulations such as the UK–US data bridge — mechanism per Sub-processor to be confirmed].

6. Personal Data Breaches

6.1 Provider will notify Customer without undue delay, and at the latest 72 hours after becoming aware, of a Personal Data Breach affecting Customer Personal Data.

6.2 The notice will describe, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Provider will add information as it becomes available and will cooperate with Customer's investigation and any notifications Customer must make.

7. Deletion and return

7.1 Customer can export its reports and delete its projects at any time through the Service.

7.2 When the Agreement ends, Provider will make Customer's reports available for export for [30 days — proposed] and then delete Customer Personal Data, unless the law requires Provider to keep it. On a written request from Customer, Provider deletes it at once.

7.3 Copies in backups are deleted as the backups expire, within 90 days, and are not used in the meantime except to restore the Service.

8. Information and audits

8.1 Provider will answer Customer's reasonable written questions about its data protection and security, including through its published security questionnaire.

8.2 If that is not enough to demonstrate compliance, Customer (or an independent auditor bound by confidentiality) may audit Provider once in any 12 months, on at least [30 days — proposed] notice, during business hours, at Customer's cost, in a way that does not disrupt the Service or expose other customers' data. Additional audits are allowed where a supervisory authority requires them or after a Personal Data Breach.

9. General

9.1 Each party's liability under this DPA is subject to the limits in the Agreement [treatment of data protection liability to be decided].

9.2 If this DPA and the Agreement conflict about personal data, this DPA prevails.

9.3 This DPA is governed by the law of England and Wales.

Annex 1 — Details of the processing

Subject matter	Providing Preworld Review: testing Customer's AI agents and chat AIs and reporting the results
Duration	The term of the Agreement, plus the deletion periods in section 7
Nature and purpose	Storing Customer's tests, test files and configuration; running tests in cloud sandboxes, through the platform executor, or on Customer's own test runners; sending test content to the judge model for grading; producing and storing reports; the in-app assistant; support
Types of personal data	Whatever Customer puts in its content, expected to be limited to test data: for example names, email addresses and account identifiers of test accounts, and any personal data in conversations, tool calls, data snapshots and test files. For repository connections, any personal data in the source code, while the run lasts
Special categories	None expected; not to be provided without written agreement (section 2.2)
Data subjects	People whose data appears in Customer's test data (usually fictitious or Customer's own staff and test accounts)
Frequency	Continuous, whenever Customer uses the Service
Location	United Kingdom (Google Cloud, London), with the transfers in section 5. For a project whose sandbox cloud Customer sets to Azure, the cloud runs of that project are processed on virtual machines in Microsoft Azure Sweden Central (EU), and in UK South (London) once Provider moves them there

Annex 2 — Technical and organizational measures

These match our security overview, which also marks what is still planned.

1. Isolation of cloud runs: one fresh virtual machine per run, deleted afterwards; a maximum run time with a hard backstop; a separate network with no external IP, no inbound traffic and outbound traffic on ports 443 and 80 only (the AI under test on 443 only); no cloud identity on the virtual machine; the AI under test runs as an unprivileged user in a per-attempt resource-limited scope; single-use bootstrap tokens and per-job session tokens; automated isolation checks on each machine image.
2. Encryption: TLS 1.2 or later in transit with HSTS; Google Cloud encryption at rest, and Microsoft Azure's for the disks of sandbox virtual machines on Azure; customer secrets sealed with the platform's public key so the API cannot read them back, with the private key held only by the platform executor; secret values masked in uploaded logs.
3. Access control: every query scoped to Customer's organization; sensitive actions only by a signed-in person; tokens and sessions stored as hashes; least-privilege service accounts; administrative access only through Identity-Aware Proxy with OS Login; database on a private IP address only.
4. Logging and monitoring: control-plane logs kept 30 days; external uptime monitoring with alerting; a record of the in-app assistant's tool calls; an organization audit log (planned).
5. Availability and backups: daily database backups with 7 days of point-in-time recovery; a second daily export kept 90 days; versioned object storage; quarterly restore drills.
6. Data residency and minimization: storage in London only (a sandbox virtual machine on Azure holds its run's data only while the run lasts); source code deleted with the sandbox; test environments and test data only under the Acceptable Use Policy.
7. Retention and deletion: evidence and sandbox logs kept 90 days by default (configurable); deleted projects permanently deleted after 30 days; deletion on written request.
8. Incident response: alerting, an operations runbook, and breach notification as in section 6.
9. Change management: automated tests and a staging environment before each production release; additive database migrations so releases can be rolled back.
10. Personnel: confidentiality obligations for everyone with access [screening and training to be confirmed].

Annex 3 — Sub-processors

Sub-processor	Purpose	Location
Google Cloud	Hosting, database, storage, backups, secrets, logs, sandbox virtual machines	United Kingdom (London, europe-west2)
OpenAI	Judge model and in-app assistant; the model requests of an agent in a sandbox project that has no OPENAI_API_KEY of its own, when the agent asks for an OpenAI model the platform offers	United States
Anthropic	Judge model and in-app assistant, when configured	United States
Microsoft Azure	Platform models, only when the customer picks one, or for an agent in a sandbox project that has no OPENAI_API_KEY of its own: prompts and replies of a platform-model chat AI, of an Azure judge model and of such an agent's model requests. Sandbox virtual machines, only for a project the customer sets to run on Azure: the code, test data and output of its runs, deleted with the virtual machine after each run	Sweden Central (EU). Platform models: deployment type [to be confirmed]. Sandbox virtual machines: Sweden Central until moved to UK South (London)
Stripe	Payments and invoicing (from the start of billing)	[to be confirmed]
Email provider [to be confirmed]	Sign-in links and notifications	[to be confirmed]
Status page provider [to be confirmed]	Status page and incident notices	[to be confirmed]