Data processing agreement

What the DPA covers

• The subject matter, duration, nature, and purpose of our processing of personal data on the customer's behalf.
• The categories of personal data and data subjects involved.
• The customer's instructions to us as processor, and our obligations to process only on those documented instructions.
• Our obligation to ensure persons authorised to process the data are bound by appropriate confidentiality.
• The technical and organisational measures we have in place to protect personal data, aligned with Article 32 UK GDPR.
• The conditions under which we engage sub-processors (general written authorisation; the live list of sub-processors is published at govn.ai/sub-processors).
• Our obligations to assist the customer in responding to data-subject rights requests.
• Our obligation to notify the customer without undue delay of any personal data breach affecting their data.
• The customer's audit rights and the conditions on which they may be exercised.
• The treatment of personal data on termination — return or deletion at the customer's choice, subject to the 90-day export window described in the Terms of Service.
• The UK International Data Transfer Agreement provisions where we transfer personal data out of the UK (e.g. to sub-processors based in the United States).

Signing the DPA

The DPA is signed alongside the order form. We accept electronic signatures (DocuSign or equivalent). If the customer requires a wet-ink original, we can accommodate — please contact us at legal@govn.ai.

For customers with their own preferred DPA template, we will review on a best-effort basis; substantial deviations from the standard template may require us to adjust the Subscription Fees to reflect the additional operational risk.

Questions

Email legal@govn.ai. We aim to respond within 2 working days.