Data Processing Addendum

Last updated: 2 October 2026

This Data Processing Addendum ("DPA") forms part of the Terms and Conditions between Flex Luthor Limited, trading as TrackImpact ("TrackImpact", "we", "us"), and the organisation that purchases a TrackImpact Teams subscription ("Customer", "you"). It applies automatically to every Teams subscription, with no signature needed. If you need a countersigned copy for your records, email support@trackimpact.io.

If this DPA conflicts with the Terms on anything relating to personal data, this DPA takes precedence.

1. Definitions

• Data Protection Law means the UK GDPR and the Data Protection Act 2018, and, where they apply, the EU GDPR and laws implementing it.
• Customer Personal Data means personal data we process on your behalf in providing the Teams service, as described in Annex 1.
• Sub-processor means a third party we engage to process Customer Personal Data.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• "Controller", "processor", "data subject" and "processing" have the meanings given in Data Protection Law.

2. Roles

For Customer Personal Data, you are the controller and we are your processor.

Each Member also holds their own individual TrackImpact account, which exists independently of your team (see the Terms and our Privacy Policy). We are the controller of that individual account data. This DPA covers the processing we carry out for you as a team: team membership, the team-level views and reports built from Members' records while they belong to your team, and any AI usage data imported through an integration you connect.

3. Our Obligations

We will:

• Follow your instructions. We process Customer Personal Data only on your documented instructions, which are the Terms, this DPA, and the way you configure and use the service. If we believe an instruction infringes Data Protection Law, we will tell you. If the law requires us to process data in another way, we will tell you first unless the law prohibits it.
• Keep it confidential. Anyone we authorise to process Customer Personal Data is bound by confidentiality obligations.
• Keep it secure. We maintain the technical and organisational measures in Annex 2.
• Help with data subject requests. If a Member or other person contacts us about Customer Personal Data, we will pass the request to you and not respond to it ourselves unless you ask us to. The service lets your team administrators remove Members and export team data, and we will give you reasonable further help where needed.
• Help with your compliance. We will give you reasonable assistance with data protection impact assessments and consultations with regulators, so far as they relate to our processing.
• Notify you of Security Incidents. If we become aware of a Security Incident affecting Customer Personal Data, we will notify you without undue delay. We will tell you what we know (the nature of the incident, the data and people likely affected, likely consequences, and the measures taken or proposed), and update you as we learn more. Notifying you is not an admission of fault.

4. Sub-processors

You authorise us to use the Sub-processors listed in Annex 3. We impose data protection obligations on each Sub-processor that are no less protective than this DPA, and we remain responsible to you for their performance.

Before we add or replace a Sub-processor, we will update Annex 3 and email your team administrator at least 14 days before the change takes effect. If you object on reasonable data protection grounds and we can't resolve your concern, you may cancel your subscription before the change takes effect.

5. International Transfers

Customer Personal Data is stored in AWS data centres in Ireland and London. Some Sub-processors process data outside the UK and EEA, including in the United States. Where they do, we rely on adequacy regulations (including the UK–US Data Bridge where the recipient is certified) or on appropriate safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

6. Deletion and Return

While your subscription is active, your team administrator can export team data from the service at any time.

After your subscription has ended, the choice of deletion is yours. Your team administrator can permanently delete all Customer Personal Data at any time using "Delete team" in the dashboard, which takes effect immediately. Alternatively, ask us at support@trackimpact.io and we will delete it within 30 days of your request. Until then, we keep your team data so that you can restart your subscription with it intact. Deletion doesn't cover records the law requires us to keep, such as billing records. Copies in our automated backups are overwritten in the normal backup cycle, within 35 days of deletion.

Members' individual accounts are not deleted when your subscription ends, because they belong to the Members (see section 2).

7. Audits

On request, we will provide the information reasonably necessary to demonstrate compliance with this DPA, including completing a reasonable security questionnaire up to once a year.

If that information is not enough to demonstrate compliance, or a regulator requires it, you may audit our compliance with this DPA. Audits must be on at least 30 days' written notice, no more than once in any 12-month period (unless following a Security Incident or required by a regulator), during normal business hours, at your cost, carried out by you or an independent auditor bound by confidentiality, and in a way that doesn't compromise the security of other customers' data.

8. Liability and Governing Law

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms. This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

9. Duration

This DPA applies for as long as we process Customer Personal Data, and ends once that data has been deleted as described in section 6.

Annex 1: Details of Processing

Annex 2: Security Measures

• Encryption in transit: all traffic to the service uses HTTPS/TLS.
• Encryption at rest: databases (Amazon DynamoDB) and file storage (Amazon S3, AES-256) are encrypted at rest.
• Integration credentials: OpenAI and Anthropic administrator keys you connect are encrypted with a dedicated AWS KMS key, and are only decrypted to fetch your usage data.
• Hosting: Amazon Web Services, in the Ireland (eu-west-1) and London (eu-west-2) regions.
• Access control: production systems can only be administered by named personnel using accounts protected by multi-factor authentication. Automated services use separate credentials with no console access.
• Authentication: user sign-in and password storage are handled by Amazon Cognito. We do not store passwords.
• Separation: team data is only accessible to that team's administrators and is separated from other customers' data by access checks on every request.
• Backups: point-in-time backups are kept for core usage data, with a rolling retention of up to 35 days.
• Deletion: team administrators can remove Members and permanently delete their team's data, and Members can delete their own accounts (section 6).
• Incident response: we monitor service logs and errors, and follow the notification commitment in section 3.

Annex 3: Sub-processors