Data Processing Agreement

This DPA forms part of the agreement between ADEPTABLE LTD ("Processor") and the organisation purchasing or using BoardCue Live ("Customer" or "Controller") where ADEPTABLE processes personal data on the Customer's behalf.

1. Scope and instructions

This DPA applies only where ADEPTABLE acts as processor or subprocessor. ADEPTABLE will process Customer Personal Data only on the Customer's documented instructions, including instructions embodied in the Customer's use and configuration of BoardCue, except where law requires other processing.

2. Nature of the service and intended data scope

BoardCue provides governance intelligence, board/committee content management, meeting support, search, AI analysis and governance workflows.

BoardCue is not intended to replace sector-specific operational systems or to act as the primary repository for routine individual case-management records or datasets. The Customer may nevertheless lawfully include personal or special-category information where it is necessary for a governance purpose, in which case that information is Customer Personal Data under this DPA.

3. Confidentiality and security

ADEPTABLE will ensure that personnel authorised to process Customer Personal Data are subject to appropriate confidentiality obligations and access data only where necessary.

ADEPTABLE will implement and maintain technical and organisational measures appropriate to risk, taking into account the state of the art, cost, and the nature, scope, context and purposes of processing. The current framework is summarised in Schedule 2 and the Security and Information Governance Overview.

4. Customer responsibilities

determine and document the applicable Article 6 basis and any Article 9, criminal-offence or sector-specific condition;

meet transparency obligations, including to meeting participants;

decide whether transcription is lawful and proportionate and approve the browsers/devices its users may use;

configure roles, committee access and MFA appropriately;

apply data minimisation and retention requirements;

respond to data-subject requests as controller and complete a DPIA where required; and

ensure BoardCue is not used as the sole basis for unlawful solely automated or other high-impact decisions.

5. Subprocessors

The Customer gives general written authorisation for ADEPTABLE to appoint subprocessors needed to provide BoardCue. ADEPTABLE will maintain a current Subprocessor Register, conduct proportionate due diligence, impose applicable written data-protection obligations, and remain responsible for subprocessor performance to the extent required by law.

ADEPTABLE will provide advance notice of a material new subprocessor where reasonably practicable, with a target of at least 15 days before routine processing of existing Customer Personal Data. Emergency changes required for security, law or service continuity may occur on shorter notice.

6. International transfers

ADEPTABLE will not knowingly make a restricted transfer of Customer Personal Data for which it is responsible unless a lawful transfer route is in place. The authoritative Subprocessor Register identifies verified destination and transfer information and flags vendor-confirmation points.

7. Data-subject rights and DPIAs

Taking into account the nature of processing, ADEPTABLE will provide reasonable assistance to enable the Customer to respond to valid data-subject requests and to carry out DPIAs or regulator consultation where required.

8. Personal data breaches

ADEPTABLE will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data for which ADEPTABLE acts as processor.

Where practicable, ADEPTABLE's operational target is to provide an initial customer notice within 24 hours of becoming aware of the personal data breach. ADEPTABLE will not delay the initial notice solely because the investigation is incomplete or all facts have not yet been confirmed.

Information may be provided in phases. To the extent known, the notice will describe the nature of the breach, awareness time, affected service/data, approximate categories and numbers of affected data subjects/records, likely consequences, containment/mitigation, contact point and information reasonably required for the Customer's own notification assessment.

9. Audits and information rights

ADEPTABLE will make available information reasonably necessary to demonstrate compliance with Article 28 and this DPA. A Customer may conduct a reasonable audit no more than once in any 12-month period unless a regulator requires more or a relevant material incident justifies it. The parties will normally use a staged evidence-first approach.

10. Return, export and deletion

At the end of the services, at the Customer's choice, ADEPTABLE will delete or return Customer Personal Data and delete existing copies unless UK law requires storage.

Where the Full Organisation Exit workflow is included in the order form and enabled for the deployment, the organisation workspace becomes read-only at termination, ADEPTABLE makes a full organisation export available to authorised organisation administrators for 14 calendar days after notification that it is ready, and active-system deletion begins when that window ends unless the Customer requests immediate deletion or gives another lawful instruction.

ADEPTABLE's target is to complete active-system deletion within 30 days after the applicable export window or deletion instruction. Protected backups are put beyond normal use and expire through the ordinary verified backup lifecycle. If a backup is restored, the deletion state must be reapplied before data returns to ordinary use.

11. Term and liability

This DPA continues while ADEPTABLE processes Customer Personal Data on the Customer's behalf. Liability is subject to the main agreement unless law or an order form provides otherwise.

Schedule 1: Processing details

Schedule 2: Technical and organisational measures

authenticated user access and Supabase-backed identity controls;

organisation administrators can require MFA for organisation users;

role and committee access restrictions and row-level database controls;

audit logging for relevant governance/security events;

rate and payload limits on sensitive routes;

controlled support access with explicit authorisation, time limits, revocation and read-only default;

TLS/HTTPS in production deployment;

quarantine and fail-closed attachment handling where malware scanning is configured;

governance export capabilities and deletion-integrity controls as implemented;

production Supabase primary database and document-storage region: United Kingdom; enterprise go-live requires Pro or higher under the current assurance baseline.

Schedule 3: Authorised subprocessors

The authoritative list is the BoardCue Subprocessor and Data Flow Register. Cloud AI processing uses direct Google Cloud Vertex AI and OpenAI API accounts controlled by ADEPTABLE. Browser/OS speech-recognition providers selected through the customer's endpoint environment are not automatically ADEPTABLE subprocessors.