Data processing agreement.

Version: 1.0, 24 October 2026. Approved by Vitalos Technologies Limited.

This data processing agreement ("DPA") forms part of the Askbridge terms of service between Vitalos Technologies Limited ("Vitalos", the processor) and the customer ("Customer", the controller). It sets out the terms required by Article 28(3) of the UK GDPR for personal data that Vitalos processes for the Customer through Askbridge.

1. Definitions

Terms such as controller, processor, personal data, personal data breach, processing, data subject and supervisory authority have the meanings given in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, and, where they apply to the Customer's processing, the EU GDPR and national laws implementing it. "Customer Personal Data" means the personal data described in Annex 1. "Restricted Transfer" means a transfer of Customer Personal Data outside the UK that is restricted under Chapter V of the UK GDPR.

2. Roles and instructions

2.1 The Customer is the controller and Vitalos is the processor of Customer Personal Data.

2.2 Vitalos will process Customer Personal Data only on the Customer's documented instructions, including with regard to Restricted Transfers, unless the law of the UK requires otherwise; in that case Vitalos will tell the Customer before processing unless the law prohibits it.

2.3 The Customer's instructions are: the terms of service, this DPA, and the Customer's use and configuration of Askbridge (for example adding sources, setting retention periods, deleting conversations). Vitalos will tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Law.

2.4 The Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis, giving visitors a privacy notice (Askbridge provides a template), and the content it adds.

3. Confidentiality

Vitalos will ensure that everyone authorised to process Customer Personal Data is under a contractual or statutory duty of confidentiality, and that access is limited to those who need it.

4. Security

4.1 Vitalos will implement appropriate technical and organisational measures under Article 32 of the UK GDPR, including those in Annex 2.

4.2 Vitalos may update the measures, provided the overall level of protection is not reduced.

5. Sub-processors

5.1 The Customer gives general authorisation for Vitalos to engage sub-processors. The current list is on the sub-processors page.

5.2 Vitalos will give at least 30 days' notice of a new or replacement sub-processor by email to the workspace owner and by updating the list. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the affected subscription and receive a refund of prepaid fees for the period after termination.

5.3 Vitalos will impose on each sub-processor, by written contract, data protection obligations that give at least the same protection as this DPA, and remains liable to the Customer for the performance of its sub-processors.

6. Data subject rights

Taking into account the nature of the processing, Vitalos will assist the Customer by appropriate technical and organisational measures to respond to requests from data subjects. Askbridge lets the Customer search, export and delete conversations itself. If Vitalos receives a request directly, it will pass it to the Customer without undue delay and will not respond except on the Customer's instructions.

7. Assistance

Vitalos will provide reasonable assistance to the Customer with its obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to Vitalos. Reasonable assistance is free of charge. If a request needs substantial work beyond the self-service tools, Vitalos will tell the Customer first and may charge a reasonable fee agreed in advance.

8. Personal data breaches

8.1 Vitalos will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

8.2 The notice will include, as far as it is known at the time, the nature of the breach, the categories and approximate numbers of data subjects and records, the likely consequences, and the measures taken or proposed. Vitalos will provide further information as it becomes available.

8.3 Notice of a breach is not an admission of fault.

9. Deletion and return

9.1 On termination, the Customer may export its data for 30 days. After that, Vitalos will delete Customer Personal Data from its live systems, unless UK law requires storage.

9.2 If backups of Customer Personal Data are held, copies in them are deleted as the backups expire on their normal cycle (see data retention) and are not restored except for disaster recovery, after which any deleted data is deleted again.

9.3 On request, Vitalos will confirm deletion in writing.

10. Audits and information

10.1 Vitalos will make available to the Customer the information necessary to demonstrate compliance with Article 28 of the UK GDPR, including this DPA, the sub-processor list, the security summary and, when available, certifications such as Cyber Essentials.

10.2 Vitalos will allow for and contribute to audits, including inspections, by the Customer or an independent auditor it appoints, on at least 30 days' notice, no more than once a year (unless required by a supervisory authority or following a breach), during business hours, under a duty of confidentiality, and at the Customer's cost. Vitalos may first answer written questions or provide existing reports if they reasonably satisfy the request.

11. Restricted Transfers

11.1 Customer Personal Data is stored in the United Kingdom (Supabase, London, AWS eu-west-2), and the application runs in London (Vercel, lhr1).

11.2 Some sub-processors process Customer Personal Data outside the UK, as shown on the sub-processors page. In particular, the AI model provider (Anthropic) processes redacted visitor messages and extracts of the Customer's content in the United States or other regions in order to generate answers.

11.3 Where a sub-processor's processing involves a Restricted Transfer, Vitalos will ensure that one of the following applies:

• the destination is covered by UK adequacy regulations under s.17A DPA 2018 (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified and has opted in to the UK Extension); or
• Vitalos and the sub-processor have entered into the International Data Transfer Agreement (IDTA) issued by the Information Commissioner under s.119A DPA 2018, or the International Data Transfer Addendum to the EU Standard Contractual Clauses (the "UK Addendum"), with a transfer risk assessment; or
• another appropriate safeguard or exception under Chapter V of the UK GDPR applies.

11.4 EU customers. Where the Customer is subject to the EU GDPR and Vitalos processes Customer Personal Data in the UK, the transfer to Vitalos relies on the European Commission's adequacy decision for the UK. Onward transfers by Vitalos to sub-processors outside the UK and EEA are made under the EU Standard Contractual Clauses (module 3, processor to processor) or another valid mechanism.

12. Liability and precedence

12.1 Each party's liability under this DPA is subject to the limitations in the terms of service, except where Data Protection Law does not allow it.

12.2 If this DPA conflicts with the terms of service, this DPA prevails for the processing of Customer Personal Data.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

These are the measures in place at the date of this version.

• Location: the database and file storage are in the UK (London); the application runs in London.
• Encryption: TLS for data in transit; encryption at rest by the database and storage provider. Integration credentials are encrypted in the application before they are stored.
• Tenant isolation: each customer's data carries a workspace identifier; Postgres row-level security is enabled and forced on every customer table; visitor access goes only through functions bound to the public site key and allowed origins; an automated isolation test suite runs on every code change.
• Access control: role-based access in the product (owner, admin, agent), with optional two-step verification that a workspace can require. Vitalos staff do not read customer data except with the Customer's consent, for security, or where the law requires it, and access to the production database is limited to the people who need it. The privileged database role is used only by a small allow-listed set of server modules.
• Redaction: before any text is sent to the AI model, email addresses, phone numbers, UK postcodes, dates of birth, National Insurance numbers, NHS numbers, card numbers, IBANs, sort codes and account numbers are replaced with placeholders.
• Minimisation: contact details are collected only when a visitor asks for a person or leaves a message; IP addresses are stored only as salted hashes; visitor tokens are stored only as hashes.
• Abuse controls: bot check (Cloudflare Turnstile), rate limits per IP address and per site, a daily AI usage cap per workspace, a per-conversation limit, and a switch to turn AI answers off.
• Logging and audit: an audit log of significant actions in each workspace (for example role changes and deletions).
• Secure development: automated tests (including the isolation suite) and secret scanning run in continuous integration before code is merged.
• Resilience: the database provider runs the database on managed, redundant infrastructure. Point-in-time recovery is not enabled, and the current database plan does not include restorable daily backups. Vitalos will update this annex when backups are added.
• Retention: configurable retention with automatic deletion; deletion on request.

Annex 3: Sub-processors

See the sub-processors page, which forms part of this DPA.