# Data Processing Agreement

**Between:**

**Data Controller**: [Customer Company Name], registered at [Address] ("Controller")

**Data Processor**: AUTOTENDER LTD, registered in England and Wales, number 17519532, registered office: 128 City Road, London, EC1V 2NX, United Kingdom ("Processor")

**Effective Date**: [Date]

---

## 1. Definitions

**Personal Data**: Any information relating to an identified or identifiable natural person.

**Processing**: Any operation performed on Personal Data, including collection, recording, storage, adaptation, retrieval, consultation, use, disclosure, erasure, or destruction.

**Sub-processor**: Any third party engaged by the Processor to process Personal Data on behalf of the Controller.

**Data Subject**: The identified or identifiable natural person to whom Personal Data relates.

## 2. Scope and Purpose

2.1 The Processor shall process Personal Data on behalf of the Controller solely for the purpose of providing the AutoTender.ai platform services, including: tender discovery, proposal generation, bid management, filling procurement portal forms in the Controller's browser through the Chrome extension, and analytics.

2.2 The categories of Personal Data processed include: user account information (name, email, job title), company information (company name, address, certifications, team member details), and bid-related data. The Processor does not collect or store the Controller's procurement portal logins.

2.3 The categories of Data Subjects include: employees, contractors, and authorized users of the Controller who use the AutoTender.ai platform.

## 3. Processor Obligations

3.1 The Processor shall process Personal Data only on documented instructions from the Controller, including with respect to transfers of Personal Data to a third country, unless required to do so by applicable law.

3.2 The Processor shall ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3 The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

- Encryption of Personal Data at rest (AES-256) and in transit (TLS)
- Row-Level Security on all database tables
- Periodic security reviews of the application code
- Administrative access limited to named administrators, each required to use two-factor authentication
- Connection tokens for cloud storage the Controller links (Google Drive, OneDrive) and stored service secrets are encrypted with AES-256-GCM, with a separately derived key for each stored value

3.4 The Processor shall not engage another processor (Sub-processor) without prior specific or general written authorization of the Controller.

3.5 The Processor shall assist the Controller in ensuring compliance with obligations under Articles 32-36 of the GDPR (security, breach notification, impact assessments).

3.6 The Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of services, and delete existing copies unless applicable law requires storage.

3.7 The Processor shall make available to the Controller all information necessary to demonstrate compliance with this Agreement and allow for and contribute to audits conducted by the Controller or an auditor mandated by the Controller.

## 4. Sub-processors

4.1 The Controller provides general authorization for the Processor to engage the following Sub-processors. The transfer mechanism shown applies to personal data transferred from the United Kingdom:

| Sub-processor category | Purpose | Location | Data processed | Transfer mechanism |
|---|---|---|---|---|
| Database, authentication and file storage provider | Stores your account, company and bid data, and handles sign-in | United States | Account, company and bid data you store in AutoTender | UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses |
| Application hosting provider | Runs the website and the application and delivers them to your browser | United States | Request and session data | UK-US data bridge (listed under the UK Extension to the EU-U.S. Data Privacy Framework) |
| Network, security and rate-limiting providers | Network protection, encryption in transit, bot protection, rate limiting, short-lived caching and fetching public tender pages | Global network, United States | IP addresses, request identifiers and browser signals; public tender pages | UK-US data bridge (listed under the UK Extension to the EU-U.S. Data Privacy Framework) |
| AI model providers | The models that draft and check bid content, answer the in-app help assistant, and suggest which profile field a portal form field the Chrome extension could not place takes | United States | Tender text, the company information used in a proposal, messages you send the help assistant, and the labels of portal form fields (never the values you enter) | UK-US data bridge for a provider listed under the UK Extension to the EU-U.S. Data Privacy Framework, otherwise the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses |
| Payment processor (Stripe) | Takes payments; AutoTender never sees or stores full card numbers | United States | Billing details | UK-US data bridge (listed under the UK Extension to the EU-U.S. Data Privacy Framework) |
| Workflow automation hosting provider | Runs the background jobs behind bid generation, digests, alerts and tender discovery | United States | Tender text and company information passed through a job; user IDs and email content; run history kept for 7 days | UK-US data bridge (listed under the UK Extension to the EU-U.S. Data Privacy Framework) |
| Email delivery providers | Sends account and notification emails, and outreach emails to prospective customers | United States | Email addresses and message content; prospect business contact details | UK-US data bridge for a provider listed under the UK Extension to the EU-U.S. Data Privacy Framework, otherwise the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses |
| Error monitoring provider | Tells us when something breaks | United States | Error and performance data with your user ID (no IP addresses or email addresses); session replays with all text masked, only if you accept analytics cookies | UK-US data bridge (listed under the UK Extension to the EU-U.S. Data Privacy Framework) |
| Cloud browser provider | Checks procurement portals are reachable and reads public tender listings; it never signs in to a portal with your login | United States | Public procurement portal pages; no customer personal data | UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses |

This public template lists the Sub-processors by category. The Controller receives the named list with the signed Agreement, and a signed-in customer can download it at any time from Settings in the AutoTender application.


The Data Privacy Framework status behind each transfer mechanism was last checked on 15 October 2026. Questions about a Sub-processor: legal@autotender.ai.

4.2 The Processor shall inform the Controller of any intended changes to the list of Sub-processors, giving the Controller the opportunity to object.

4.3 The Processor shall ensure that each Sub-processor is bound by data protection obligations no less protective than those set out in this Agreement.

## 5. AI Processing Disclosure

5.1 Personal Data and company information uploaded to the platform is processed by our AI processing providers for the purpose of generating and verifying bid proposals.

5.2 Data sent to these AI providers is processed under their respective API Terms of Service. These providers do not use API input or output data to train their models.

5.3 The Controller acknowledges that AI-generated proposals may contain errors and that human review is recommended before submission. The Controller reviews and submits every bid; the Processor never submits one.

## 6. Data Transfers

6.1 The Processor may transfer Personal Data to Sub-processors located outside the European Economic Area (EEA) only where appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) or adequacy decisions.

6.2 The current Sub-processors, their locations and their transfer mechanisms are listed in Section 4.1.

## 7. Data Breach Notification

7.1 The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach.

7.2 The notification shall include: the nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed to address the breach.

## 8. Data Subject Rights

8.1 The Processor shall assist the Controller in responding to requests from Data Subjects exercising their rights under the GDPR (access, rectification, erasure, portability, restriction, objection).

8.2 The Processor shall promptly notify the Controller if it receives a request from a Data Subject directly.

8.3 The Processor's automated data export (GDPR Article 20) contains the Controller's records and proposal text in a machine-readable file and lists what it leaves out; uploaded and generated files can be downloaded from the Documents page. Error telemetry held by the error monitoring Sub-processor (user UUID, stack traces, browser metadata) is excluded from the automated export and must be requested separately via the Processor's support team.

## 9. Term and Termination

9.1 This Agreement shall remain in effect for the duration of the service agreement between the parties.

9.2 Upon termination, the Processor shall delete all Personal Data, including copies in backups, within 90 days unless retention is required by applicable law.

## 10. Governing Law

This Agreement shall be governed by the laws of England and Wales.

---

**Signatures:**

Controller: _________________________ Date: _____________

Processor: _________________________ Date: _____________

---

*This is a template. Consult legal counsel before use. Customize sections 6 and 10 based on the Controller's jurisdiction.*