Data Processing Agreement

1. Definitions

Terms defined in the ArkyTools Terms of Service carry the same meaning here. Additionally:

"Controller"

The Customer — the organisation or individual that determines the purposes and means of processing personal data through the Service.

"Processor"

ArkyTools LTD — which processes personal data on behalf of the Controller.

"Personal Data"

Any information relating to an identified or identifiable natural person contained within Customer Data.

"Processing"

Any operation performed on Personal Data, including storage, retrieval, use, disclosure, or deletion.

"Sub-processor"

Any third party engaged by ArkyTools to process Personal Data on the Controller's behalf.

"UK GDPR"

The UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.

2. Subject Matter and Details of Processing

Duration

For the duration of the Customer's Subscription and, thereafter, for the retention periods specified in the Terms of Service and Section 8 of this DPA.

Nature and Purpose

ArkyTools processes Personal Data solely to provide the platform features subscribed to by the Customer, including project management tools, task scheduling, document organisation, and AI-assisted features where used.

Types of Personal Data

The Personal Data processed may include: names, email addresses, job titles, and contact details of the Customer's staff, collaborators, and third-party contacts; images and files that incidentally contain personal data; and any other personal data the Customer chooses to enter into the platform.

Categories of Data Subjects

The data subjects may include: the Customer's employees and team members; contractors and consultants; clients and end-clients of the Customer's practice; planning contacts, suppliers, and other project stakeholders.

3. Controller Obligations

The Controller warrants and undertakes that:

• it has a lawful basis under UK GDPR for all Personal Data it submits to the Service;
• it has provided all required notices to data subjects and obtained any necessary consents;
• its instructions to ArkyTools for processing Personal Data comply with applicable data protection law;
• it will promptly notify ArkyTools of any changes to its processing instructions that may affect ArkyTools' ability to comply with this DPA.

4. Processor Obligations

4.1 Processing on Instructions Only

ArkyTools will process Personal Data only on the documented instructions of the Controller, which are set out in these Terms and this DPA, unless required to do otherwise by applicable law. If ArkyTools is required by law to process Personal Data in a manner not covered by the Controller's instructions, it will inform the Controller before such processing unless prohibited by law.

4.2 Confidentiality

ArkyTools will ensure that all personnel authorised to process Personal Data are bound by appropriate confidentiality obligations and receive relevant data protection training.

4.3 Security

ArkyTools will implement and maintain appropriate technical and organisational security measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encrypted data transmission (TLS), access controls, and regular security reviews, taking into account the nature of the data and the risks involved.

4.4 Data Subject Rights

ArkyTools will provide reasonable assistance to the Controller to fulfil its obligations to respond to data subject requests (access, erasure, rectification, portability, restriction, and objection) under UK GDPR. Where a data subject makes such a request directly to ArkyTools, ArkyTools will forward it to the Controller without undue delay.

4.5 Assistance with Compliance

Taking into account the nature of the processing and the information available, ArkyTools will provide reasonable assistance to the Controller in connection with:

• its obligations under Articles 32–36 of UK GDPR (security, breach notification, data protection impact assessments, and prior consultation);
• any audit or inspection of processing activities, on reasonable notice and at the Controller's cost.

4.6 No Use Beyond Service Delivery

ArkyTools will not process Personal Data for any purpose other than providing the Service. Personal Data will never be sold to third parties, used for advertising, or used to train artificial intelligence models.

5. Sub-processors

The Controller provides general authorisation for ArkyTools to engage sub-processors. ArkyTools will: (a) enter into a written agreement with each sub-processor imposing equivalent data protection obligations to those in this DPA; (b) remain fully liable to the Controller for the acts and omissions of its sub-processors; and (c) notify the Controller of any changes to sub-processors at least 30 days in advance, giving the Controller the opportunity to object.

Current sub-processors:

Data sent to Anthropic consists only of content the user explicitly submits through an AI-powered feature (such as an image or URL). No other Personal Data is transmitted. Anthropic does not use API data to train its models.

6. International Data Transfers

Personal Data is primarily processed within the UK and EEA. Where Personal Data is transferred to Anthropic in the United States (solely for user-initiated AI features), ArkyTools relies on Standard Contractual Clauses approved for use under UK GDPR as the transfer mechanism. Copies of applicable SCCs are available on request at hello@arkytools.com.

7. Personal Data Breaches

ArkyTools will notify the Controller without undue delay — and in any event within 72 hours of becoming aware — of a Personal Data breach affecting Customer Data, providing sufficient information to allow the Controller to meet its own notification obligations to the ICO and to affected data subjects under Articles 33 and 34 of UK GDPR.

8. Deletion and Return of Data

On termination of the Subscription for any reason, ArkyTools will:

• make Customer Data available for export for a period of 30 days from the termination date;
• permanently delete all Customer Data, including Personal Data and copies held in backups, within 90 days of the end of that export window;
• provide written confirmation of deletion to the Controller on request.

ArkyTools may retain Personal Data for longer periods where required by applicable law (for example, billing records retained for 7 years under UK financial regulations), provided such data is processed only for the purposes of that legal obligation.

9. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms of Service. Nothing in this DPA limits either party's liability for fraud, wilful misconduct, or any liability that cannot be limited by applicable law.

10. Governing Law

This DPA is governed by the laws of England and Wales and is subject to the exclusive jurisdiction of the courts of England and Wales.

11. Countersigned Version

If your organisation requires a countersigned PDF version of this DPA (for example, for internal procurement or compliance purposes), please contact us at hello@arkytools.com and we will provide one within 5 business days.