Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Impacturi (the "Processor", "we", "us") operated by Clickonic Ltd, and the organisation subscribing to the Impacturi platform (the "Controller", "you", "your organisation").

This DPA is entered into pursuant to Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person that is processed by the Processor on behalf of the Controller through the Impacturi platform. "Processing" has the meaning given in the UK GDPR. "Data Subject" means the individual to whom the Personal Data relates. "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

2. Scope and purpose of processing

The Processor processes Personal Data solely to provide the Impacturi platform services, specifically:

• Storing and displaying donor records (names, organisations, contact details, donation amounts and history)
• Generating impact web pages and reports using donor and donation data
• Providing CRM integration services (importing donor data from external systems)
• Recording page view analytics (anonymised where possible)
• Sending platform notifications to subscribed users

3. Categories of data subjects and personal data

Data subjects:

• Charity staff and administrators (platform users)
• Corporate donor contacts
• Individual donors (where charity uploads individual donor data)

Categories of personal data:

• Names and job titles
• Email addresses and phone numbers
• Organisation names and addresses
• Donation amounts, types, and dates
• Testimonials and quotes (where provided by the Controller)
• CRM identifiers and external system references

Clickonic does not intentionally process special category data. However, charities supporting beneficiaries with health conditions, disabilities, or financial hardship may upload content that constitutes special category data under UK GDPR Article 9. Charities are responsible for ensuring appropriate safeguards are in place for any such data they upload.

4. Obligations of the Processor

The Processor shall:

• Process Personal Data only on documented instructions from the Controller, unless required by law
• Ensure that all persons authorised to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk (see Section 7)
• Not engage a sub-processor without the prior written authorisation of the Controller (see Section 6)
• Assist the Controller in responding to Data Subject rights requests (access, rectification, erasure, portability, restriction, objection)
• Assist the Controller in meeting its obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, impact assessments, prior consultation)
• At the choice of the Controller, delete or return all Personal Data on termination of the service, and delete existing copies unless required by law to retain them
• Make available to the Controller all information necessary to demonstrate compliance with this DPA

5. Obligations of the Controller

The Controller shall:

• Ensure it has a lawful basis for processing the Personal Data it uploads to the platform
• Ensure Data Subjects have been informed about the processing in accordance with Articles 13 and 14 of the UK GDPR
• Ensure the accuracy of Personal Data provided to the Processor
• Notify the Processor promptly of any Data Subject rights requests received directly

6. Sub-processors

The Controller provides general written authorisation for the Processor to engage the following sub-processors:

The Processor shall impose data protection obligations equivalent to those set out in this DPA on each sub-processor, by contract, in accordance with Article 28(4) UK GDPR, ensuring the sub-processor provides sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of UK GDPR. Executed Data Processing Agreements compliant with Article 28(4) UK GDPR are in place with each sub-processor listed above. Copies are available on request from dermot@clickonic.co.

The Processor will notify the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object. If the Controller reasonably objects, the Processor will work with the Controller to find an alternative solution.

ElevenLabs. When a voice note is made for an impact page, the text of the voice note script is sent to ElevenLabs (Eleven Labs Inc.), a text-to-speech service, which returns spoken audio. That text is the story as written for the page, so it can include the charity’s name, a supporter’s name and what the support achieved. Email addresses and telephone numbers are not part of that text, and photographs are not sent. ElevenLabs is based in the United States. Voice notes are currently switched off, so nothing is sent to ElevenLabs.

Brandfetch. To show the logo of a charity, or the logo and brand colours of a company that supports it, we may send that organisation’s website domain name (for example, example.org) to Brandfetch, a brand information service. Brandfetch receives the domain name only. It never receives a person’s name, email address or anything else about donors, supporters or the people a charity helps.

Google favicon service. If we cannot find a logo on an organisation’s own website, we may ask Google’s favicon service for that website’s icon, sending only the website domain name. A link to the icon may then be saved as the organisation’s logo, and when a charity’s own screens show it, the charity’s browser loads it from Google, which then receives the details any website receives from a browser, such as its IP address. We never send Google a person’s name, email address or anything else about donors, supporters or the people a charity helps.

Clearbit logo service. If we cannot find a logo on a charity’s own website, we may ask Clearbit’s logo service for one, sending only the website domain name. If Clearbit has a logo, a link to it may be saved as the charity’s logo. Wherever that logo is shown, including on pages a charity shares with its donors, the viewer’s browser loads it from Clearbit, which then receives the details any website receives from a browser, such as its IP address. We never send Clearbit a person’s name, email address or anything else about donors, supporters or the people a charity helps.

7. Technical and organisational security measures

The Processor implements the following measures:

• Encryption at rest: All database records are encrypted using AES-256 via the hosting provider (Supabase)
• Encryption in transit: All connections use TLS 1.2 or higher
• Access control: Row-level security enforced at the database layer, so a charity signed in with its own credentials reads and writes only its own rows. Server routes that must run with elevated privilege sit outside that database check by design, so each one proves ownership of the record before it acts. Tenant isolation is probed weekly against the live database using the public key, exactly as an attacker would, and a failure stops everything else
• Authentication: User authentication via Supabase Auth with secure password hashing (bcrypt)
• Staff access: Platform administrators do not have routine access to customer data. Access is only granted in exceptional circumstances with the Controller's knowledge
• Backups: Daily database backups managed by the hosting provider and retained 8 days. A scheduled daily job is built to copy uploaded files (logos and photographs) to separate storage, but we have not yet shown that it runs reliably, so we do not currently promise that a separate copy of uploaded files exists.
• Monitoring: Application error logging and uptime monitoring. Everything sent to the error monitoring service passes through a redaction layer first, which strips credentials, email addresses and telephone numbers at any depth, and session recording is deliberately not enabled
• Review: An automated security review runs weekly and covers tenant isolation, known vulnerabilities in production dependencies, the security headers, and regression guards on previously closed faults. It records a dated result every week and raises an alert when a check fails

8. Personal data breach notification

The Processor will notify the Controller without undue delay, and in any case within 24 hours of becoming aware of a Personal Data breach. The 72-hour statutory window for ICO notification is the Controller's (charity's) obligation, not the Processor's. The notification will include:

• The nature of the breach, including where possible the categories and approximate number of Data Subjects and records affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach
• The name and contact details of the Processor's point of contact

9. Data subject rights

The Processor will assist the Controller in fulfilling its obligation to respond to Data Subject requests. Where a Data Subject contacts the Processor directly, the Processor will redirect the request to the Controller without undue delay.

The Controller can fulfil most Data Subject rights directly through the platform (viewing, editing, and deleting donor records). For data portability requests, the platform provides spreadsheet (CSV file) export functionality.

10. International data transfers

Where Personal Data is transferred outside the UK (for example, to sub-processors located in the United States), such transfers are protected by appropriate safeguards. As this DPA is governed by UK law, transfers rely on:

• Standard Contractual Clauses (SCCs) with the UK Addendum as approved by the UK Information Commissioner's Office under the UK GDPR and Data Protection Act 2018. Where a sub-processor operates under EU SCCs, the International Data Transfer Addendum (UK Addendum) is applied to ensure the transfer also meets UK GDPR requirements.
• The sub-processor's own data protection certifications and policies

Executed copies of applicable transfer agreements are available on request. Contact dermot@clickonic.co.

11. Duration and termination

This DPA remains in effect for the duration of the Controller's subscription to the Impacturi platform. On termination:

• The Controller may request export of all their data via a spreadsheet (CSV file) before account closure
• The Processor will delete all Personal Data within 30 days of account termination, unless required by law to retain it
• The Processor will confirm deletion in writing on request

12. Audit rights

The Controller has the right to audit the Processor's compliance with this DPA. The Processor will cooperate with reasonable audit requests, subject to reasonable notice and confidentiality obligations. Audits will be conducted during normal business hours and will not unreasonably disrupt the Processor's operations.

13. Automated writing and checking (OpenAI and Anthropic)

The Impacturi platform uses the OpenAI API and the Anthropic API to help write impact pages and to check them. Both are listed as sub-processors in Section 6. The following applies to this processing:

• Data sent: text only. This is the charity's answers to the monthly questions, the captions of its photographs, the charity's own description of itself ("Who you are"), the charity name, the name of the person who signs the page and the month. Where it is needed to write or check a page, it also includes a donor's name and giving details. Photographs themselves are not sent. Email addresses and telephone numbers are not part of the text we send.
• What each provider does: OpenAI screens what the charity types for safety, and checks finished pages. It also writes page text where the page writer is set to OpenAI. Anthropic writes the shared monthly story from the charity's answers and checks pages, including the checks on young people's names and health details. Anthropic also provides the monitoring assistant described in Section 6.
• Purpose: Writing and checking the charity's impact pages, and monitoring the service. Nothing is sent to a donor until a named person at the charity has approved it.
• Review: Pages produced with the help of these services are drafts for the charity's review. Section 8 of the Terms of Service sets out the charity's responsibility to check them.
• Model training (OpenAI): Per OpenAI's enterprise API terms, data submitted via the API is not used to train OpenAI models. OpenAI retains submitted data for up to 30 days for abuse monitoring purposes, after which it is deleted.
• Location and safeguards: Both providers are US companies. Transfers are protected as set out in Section 10.

Template clause for charity privacy notices: "We use Impacturi to produce personalised impact pages for our donors. Impacturi uses the OpenAI and Anthropic APIs to help write and check them. Donor names and giving amounts may be processed by these providers solely for the purpose of writing and checking the page text. For full details see the Impacturi Data Processing Agreement at impacturi.com/legal/dpa."

14. Backup retention and personal data deletion

Personal data present in automated backups at the time of deletion will be purged when those backups age out of the retention window. The database is backed up daily and each backup is retained for 8 days; there is no monthly or longer-term backup tier. Uploaded files are held separately from the database. A scheduled daily job is built to copy uploaded files (logos and photographs) to separate storage, but we have not yet shown that it runs reliably, so we do not currently promise that a separate copy of uploaded files exists. If a separate copy does exist, the job only ever adds files and never removes them, so we cannot give a fixed period after which a deleted file leaves it. Clickonic does not restore personal data from backup solely for data access purposes after a deletion request has been fulfilled.

This means that following a deletion request or account closure, personal data may persist in encrypted database backups for up to 8 days, before those age out. Uploaded files are covered separately above, and we set no fixed period for them. Both are disclosed to data subjects in our Data Retention Policy.

15. Data Protection Impact Assessments (DPIA)

Clickonic will provide reasonable assistance to the Controller in carrying out any Data Protection Impact Assessments required under Article 35 UK GDPR. This assistance includes providing information about Clickonic's processing activities, technical and organisational measures, and sub-processor arrangements on request. Requests should be directed to dermot@clickonic.co.

16. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the main service agreement between the parties.

17. Contact

For any questions about this DPA or to request a signed copy, contact:

Data Protection contact, Clickonic Ltd
dermot@clickonic.co

This address is monitored by the data protection contact. For urgent matters, contact dermot@clickonic.co.