Instructions, safeguards and subprocessors
P1. This agreement applies when ModelProp Ltd (“Processor”) processes personal data on behalf of the agency customer (“Controller”) under a completed order. It does not relabel independently controlled processing. If either party determines a new purpose or the parties jointly determine it, document the proper role and required arrangement before that processing starts.
P2. The Controller determines its lawful purposes, instructions, data accuracy, lawful basis and notices, and selects appropriate service access. The Processor processes only on documented instructions, including for transfers, unless UK law requires otherwise. It will inform the Controller before legally required processing unless prohibited, and immediately flag an instruction it considers unlawful.
P3. Processing covers provision and support of the selected services for the agreement’s duration and the agreed return/deletion period. Annex 1 must specify the subject matter, duration, nature, purposes, data subjects, data types, instructions, retention, recipients, systems and approved transfers before access is enabled. Do not submit unnecessary sensitive data.
P4. The Processor will bind authorised personnel to confidentiality, limit access to trained people who need it, and implement technical and organisational measures appropriate to risk under Article 32. The security section of Annex 1 records the actual measures, including tenant isolation, role-based access, authentication, secure transmission/storage, backup, vulnerability management, logging and incident response. The measures must be appropriate to the agreed processing.
P5. The Controller gives general authorisation for only the subprocessors identified in the completed register. Give at least 30 days’ prior notice of an intended addition or replacement where practicable, with equivalent information and an opportunity to object on reasonable data-protection grounds. If an objection cannot be resolved, offer a workable alternative or termination of the affected processing with a proportionate refund of undelivered prepaid service. Do not send data to an unapproved replacement while an unresolved objection prevents lawful use.
P6. Impose equivalent relevant data-protection obligations on each subprocessor and remain responsible to the Controller for its performance. Identify the legal entity, function, countries, data and onward providers; a vendor brand name or privacy-policy link alone is insufficient.
P7. Restricted international transfers require the Controller’s instructions and an applicable transfer mechanism, such as adequacy or executed UK IDTA/Addendum, with required risk assessment and supplementary measures. A US headquarters, EU server or supplier certification alone does not establish the full transfer analysis.
Assistance, incidents and exit
P8. Taking account of the processing, assist the Controller with rights requests through appropriate technical and organisational measures. Promptly forward requests relating to its data; do not respond substantively except on instructions or as law requires. Agree secure export, correction, deletion and search methods. Assistance must not obstruct the Controller’s statutory deadlines.
P9. Notify the Controller without undue delay after becoming aware of a personal-data breach affecting its data. We will provide an initial notice as soon as reasonably possible and update it as further information becomes available. Provide known facts, affected systems/data/people, consequences, mitigation and a contact, without waiting for a complete investigation. Preserve evidence and cooperate. The Controller determines regulator/data-subject notification for its processing, without preventing either party’s own legal obligations.
P10. Assist with security obligations, DPIAs and prior consultation under Articles 32–36, taking account of the information available. Do not begin a materially higher-risk or newly scoped activity without the Controller’s instructions and the required safeguards. Any charge for optional additional assistance must be reasonable and agreed, and cannot excuse mandatory assistance.
P11. At the Controller’s choice, return or delete personal data and copies when the service ends, except where law requires retention. Annex 1 states the export period, live-system deletion timing and restricted-backup expiry. Any legally retained data remains protected, used only for that purpose, and deleted when no longer required. Restore backups only with deletion restrictions reapplied; do not recreate erased data in live services.
P12. Make information available to demonstrate compliance and allow/contribute to audits and inspections by the Controller or its mandated auditor. Reasonable scheduling, confidentiality and measures to protect other customers are permitted, but cannot remove these rights or delay urgent incident/regulatory access. Certifications and reports may reduce duplication, not replace a necessary audit.
P13. Do not use identifiable Controller personal data for our wider AI model development, advertising or an unrelated customer. Creating a separately requested likeness or synthetic voice requires the individual’s specific authorisation solely for that service, without giving us permission for wider training or other identity uses. Necessary service processing and any instructed anonymisation remain within the Controller’s documented lawful instructions. Genuinely anonymous information may be used for development and improvement under the Data Use and AI Improvement terms only where anonymisation is effective and lawful and the relevant content rights permit it. Pseudonymous transcripts, voices, room images and embeddings are not automatically anonymous; private agency records must not be disclosed to another customer.
P14. This DPA prevails for processor data. Commercial liability arrangements do not remove either party’s direct statutory duties, an individual’s rights, or regulator powers. Each party remains responsible for its legally required records, contracts and fee obligations. The parties’ authorised acceptance of a completed order also accepts the incorporated completed DPA.
P14. Supplier processing follows the selected service’s applicable standard terms and data-use policies, as explained in the Data Use and AI Improvement terms and relevant privacy information. This does not replace the Controller’s lawful instructions, required data-protection safeguards or either party’s statutory obligations.
Processing particulars incorporated in the order
The order or an attached processing record must identify the actual controller, selected services, purposes, data and people involved, authorised recipients and suppliers, processing locations and transfer safeguards, retention and return/deletion arrangements, security measures and incident contacts. These particulars may be updated only through documented authorised instructions and the applicable change procedure. Publishing this agreement does not authorise a new provider or a new processing purpose.