GDPR Article 28

Data Processing Agreement

Article 28 UK GDPR / EU GDPR agreement between the Client Organisation (Data Controller) and The BI Method Ltd (Data Processor). Required before any employee assessment data is processed on the Platform.

Last Updated: April 2026 — v1.0

Why This Document Exists — Article 28 GDPR

Under Article 28 of the UK GDPR and EU GDPR, when a business (the Data Controller) uses a third-party service to process personal data on its behalf, it must have a written contract with that third party (the Data Processor). Without this agreement, both parties are in breach of GDPR. This DPA is that contract between your organisation and BIP.

Section 01

Parties & Background

This Data Processing Agreement ("DPA") is entered into between:

The Data Controller

[CLIENT ORGANISATION NAME] — the company, organisation, or individual that has subscribed to the Behaviour Intelligence Platform and is responsible for the lawful basis of processing its employees' and team members' data ("Controller," "you").

This field is completed with your organisation's legal name at the point of subscription acceptance. By using the Platform, you are deemed to have accepted this DPA with your organisation's details inserted.

The Data Processor

The BI Method Ltd, incorporated in England and Wales ("Processor," "BIP," "we").

1.1 Background

The Controller has subscribed to The BI Method platform, which involves the Processor processing personal data of the Controller's employees, contractors, or team members ("Participants") on behalf of the Controller. This DPA governs the Processor's processing of personal data and supplements the Terms of Service. In the event of conflict, this DPA shall prevail in matters relating to data protection.

1.2 Duration

This DPA takes effect on the date of the Controller's first use of the Platform and continues until termination of the subscription agreement, subject to the data retention provisions in Section 13.

Section 02

Definitions

"Applicable Data Protection Law" — the UK GDPR, the Data Protection Act 2018, the EU GDPR (where applicable), and any other applicable data protection legislation.
"Assessment Data" — responses submitted by Participants through the Platform's behavioural assessment methodology, including derived anti-pattern scores, severity classifications, and timestamps.
"Benchmark Dataset" — BIP's proprietary dataset of anonymised, aggregated data derived from Assessment Data across all customers. The Benchmark Dataset does not constitute Personal Data.
"Data Breach" — a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
"Participant" — any employee, contractor, or team member of the Controller who completes a BIP assessment.
"Sub-Processor" — any third party engaged by the Processor to process Personal Data on the Processor's behalf in connection with delivering the Platform services.

Section 03

Details of Processing

Art. 28(3)

The details of the processing carried out by the Processor on behalf of the Controller are as follows:

Subject Matter

Processing of personal data of the Controller's employees and team members in connection with the delivery of The BI Method platform services.

Nature of Processing

Collection of assessment responses from Participants via the Platform
Storage of responses in encrypted database
Automated analysis and scoring against BIP's anti-pattern classification system
Generation of team-level Reports and benchmark comparisons
Anonymisation and aggregation of data for inclusion in the Benchmark Dataset

Types of Personal Data Processed

Assessment responses (moderate sensitivity — workplace behavioural data, not special category data)
Derived anti-pattern scores
Participant identifier (email address or internal ID for deduplication)
Timestamps of assessment completion
Platform usage data (login activity, report access)

Categories of Data Subjects

Employees, contractors, consultants, or other team members of the Controller who are invited to complete a BIP assessment.

Section 04

Processor Obligations

Art. 28(3)

4.1 Documented Instructions

The Processor shall process Personal Data only on the documented instructions of the Controller, as set out in this DPA and the Terms of Service, unless required to do so by Applicable Data Protection Law.

4.2 Confidentiality

All persons authorised to process the Personal Data are subject to appropriate confidentiality obligations and have received adequate data protection training.

4.3 No Further Processing

The Processor will not process, use, or disclose Personal Data for any purpose other than delivering the Platform services to the Controller, except as permitted under Section 12 (Benchmark Dataset) and the Privacy Policy.

4.4 Controller's Obligations

The Controller warrants that:

It has a lawful basis under Article 6 UK GDPR / EU GDPR for processing Participants' Assessment Data (typically legitimate interests in team performance or freely given consent)
Participants have been informed about the assessment, its purpose, and how their data will be processed
It will not use Assessment Data as the sole basis for individual disciplinary action or dismissal without independent legal advice
It is authorised to instruct the Processor to process Participants' data on its behalf

Section 05

Sub-Processors

Art. 28(2) & 28(4)

5.1 General Authorisation

The Controller provides general written authorisation to the Processor to engage Sub-Processors. Current approved Sub-Processors include Supabase (database hosting and authentication), Stripe (payment processing), and email delivery providers. The Processor shall not engage additional Sub-Processors without 30 days' prior notice.

5.2 Sub-Processor Obligations

The Processor shall impose equivalent data protection obligations on all Sub-Processors by written contract. The Processor remains fully liable to the Controller for the performance of Sub-Processors' obligations.

5.3 New Sub-Processors

The Processor will notify the Controller at least 30 days before engaging any new Sub-Processor. If the Controller reasonably objects on data protection grounds within 14 days, the parties will discuss in good faith. If they cannot reach agreement, the Controller may terminate the subscription without penalty.

Section 06

Data Subject Rights

Art. 28(3)(e)

6.1 Assistance to Controller

The Processor shall assist the Controller in fulfilling its obligations to respond to Data Subjects exercising their rights under Applicable Data Protection Law. The Processor will:

Provide a data export of a specific Participant's Assessment Data within 5 business days of a written request from the Controller
Delete or anonymise a specific Participant's Assessment Data within 5 business days of a written instruction
Notify the Controller within 2 business days if a Participant contacts BIP directly exercising their data rights

6.2 Direct Requests from Participants

If a Participant contacts the Processor directly, the Processor will acknowledge receipt and direct the Participant to contact their employer (the Controller) as the Data Controller responsible for their data.

Section 07

Security Measures

Art. 28(3)(c) & Art. 32

The Processor has implemented and maintains the following technical and organisational security measures:

Category	Measure	Detail
Access Control	Authentication	Multi-factor authentication available for all accounts. Enforced for BIP staff with access to production systems.
Access Control	Row-Level Security	Database-level enforcement — authenticated users can only access data belonging to their organisation.
Encryption	In Transit	All data encrypted using TLS 1.2 or higher. HTTPS enforced sitewide.
Encryption	At Rest	Personal Data encrypted at rest using AES-256 in the database layer.
Data Protection	No Raw Data Export	The Platform does not expose raw Assessment Data via any API endpoint or CSV export. Only processed Reports are accessible.
Data Protection	API Rate Limiting	All report-generation and data-access endpoints are rate-limited per authenticated account. High-volume access triggers automated alerts.
Incident Response	Anomaly Detection	Automated monitoring for unusual login patterns and high-volume data access.
Organisational	Staff Training	All BIP staff handling Personal Data receive data protection training at onboarding and annually.
Benchmark Isolation	Data Separation	The anonymised Benchmark Dataset is stored in a logically isolated data store with no join keys to identifiable Personal Data.

Section 08

Personal Data Breaches

Art. 28(3)(f) & Art. 33–34

8.1 Notification to Controller

The Processor shall notify the Controller of any confirmed or reasonably suspected Data Breach within 36 hours of becoming aware of it. This is shorter than the 72-hour regulatory deadline to allow the Controller sufficient time to assess and notify the Supervisory Authority.

8.2 Content of Notification

The breach notification will include, to the extent available at the time:

A description of the nature of the Data Breach, including categories and approximate number of Data Subjects concerned
Contact details of the Processor's data protection contact point
A description of the likely consequences of the Data Breach
A description of measures taken or proposed to address the breach

8.3 Assistance

The Processor shall assist the Controller in meeting its obligations to notify the Supervisory Authority (Article 33 GDPR) and, where applicable, affected Data Subjects (Article 34 GDPR). The decision to notify remains with the Controller as Data Controller.

Section 09

Data Protection Impact Assessments

Art. 28(3)(f) & Art. 35–36

The Processor shall provide reasonable assistance to the Controller in carrying out DPIAs as required by Article 35 UK GDPR / EU GDPR where such assessments relate to the processing carried out by the Processor under this DPA.

DPIA Recommendation for Controllers

The ICO recommends conducting a DPIA before beginning large-scale processing of employee data, particularly where automated processing is used to evaluate aspects of employees' work performance or behaviour. BIP will provide assistance and its own processing records to support this.

Section 10

Audit & Inspection Rights

Art. 28(3)(h)

10.1 Information and Audit

The Processor shall make available to the Controller all information reasonably necessary to demonstrate compliance with Article 28 UK GDPR / EU GDPR, and shall allow for and contribute to audits and inspections conducted by the Controller or a mandated auditor.

10.2 Audit Process

At least 30 days prior written notice to the Processor
During normal business hours and in a manner that minimises disruption to BIP operations
No more than once per calendar year, unless there are reasonable grounds to suspect a material breach
By the Controller or an independent, qualified third-party auditor subject to confidentiality obligations

10.3 Certification as Alternative

As an alternative to an on-site audit, the Processor may provide copies of relevant security certifications, third-party audit reports, or penetration test summaries, which the Controller may accept as sufficient evidence of compliance.

Section 11

International Transfers

Art. 44–49

The Processor shall not transfer Personal Data to any country or territory outside the UK or EEA unless one of the following conditions is met:

The transfer is to a country that has received an adequacy decision from the UK Secretary of State or European Commission
The transfer is subject to appropriate safeguards in the form of a UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCCs) — Module 2, Controller to Processor
The transfer falls within a derogation permitted under Article 49 UK GDPR / EU GDPR

Where Sub-Processors are located outside the UK/EEA, the Processor has put in place appropriate UK IDTAs or EU SCCs with those Sub-Processors.

Section 12

Benchmark Dataset — Special Provision

BIP's Data Strategy — Transparent Disclosure

BIP's core value proposition depends on building a proprietary Benchmark Dataset from anonymised, aggregated assessment data. This section transparently discloses how this works and why it is consistent with GDPR. The Controller's acceptance of this DPA constitutes informed consent to this specific processing activity.

12.1 Anonymisation and Benchmark Building

As part of delivering the Platform services, the Processor derives anonymised, aggregated statistical data from Assessment Data. This involves:

Stripping all individual and organisational identifiers before any data enters the Benchmark Dataset
Aggregating responses at cohort level (minimum team size threshold applied)
Storing Benchmark Data in a logically isolated data store with no technical mechanism to re-identify individuals or organisations
The anonymisation process is irreversible — once data enters the Benchmark Dataset it cannot be traced to any individual or organisation

12.2 GDPR Status of Benchmark Data

Consistent with Recital 26 of the UK GDPR and EU GDPR, the Benchmark Dataset — once anonymised — does not constitute Personal Data and is therefore outside the scope of GDPR. The right to erasure (Article 17) does not extend to anonymised data that cannot be linked to a Data Subject.

12.3 Controller's Rights in Benchmark Data

The Processor may build, maintain, and commercially exploit the Benchmark Dataset
Benchmark Data does not belong to the Controller and will not be returned or deleted on termination of this DPA
The Processor's use of Benchmark Data for commercial purposes is authorised by this DPA

Section 13

Termination & Data Deletion

Art. 28(3)(g)

13.1 On Termination

Upon termination or expiry of the subscription agreement, the Processor shall:

Retain the Controller's identifiable Personal Data in a secure, access-restricted state for 90 days from the date of termination ("Retention Window")
Make the Personal Data available for export by the Controller during the Retention Window
Permanently and irreversibly delete all identifiable Personal Data at the end of the Retention Window

13.2 Deletion Certification

Upon written request, the Processor will provide written certification of deletion of the Controller's Personal Data within 14 days of deletion being completed.

13.3 Legal Retention Obligations

Notwithstanding Section 13.1, the Processor may retain Personal Data for longer where required to comply with applicable law (for example, financial records required under HMRC regulations). Any such retention will be for the minimum period necessary.

13.4 Benchmark Data

Anonymised Benchmark Data is not subject to deletion on termination of this DPA, as it does not constitute Personal Data (see Section 12).

Section 14

Liability & Indemnity

14.1 Each Party's Liability

Each party shall be liable to the other for direct losses arising from its breach of this DPA, subject to the limitations set out in the Terms of Service.

14.2 Regulatory Fines

Each party shall be responsible for regulatory fines and penalties imposed by a Supervisory Authority that arise from its own breach of Applicable Data Protection Law. Where a fine arises from joint fault, liability shall be apportioned in accordance with each party's relative responsibility.

14.3 Data Subject Claims

If a Data Subject brings a claim for compensation under Article 82 UK GDPR / EU GDPR against the Controller arising from the Processor's breach, the Processor shall indemnify the Controller for the portion attributable to the Processor's breach — provided the Controller notifies the Processor promptly and does not settle without the Processor's prior written consent.

Section 15

General Provisions

15.1 Governing Law

This DPA is governed by and construed in accordance with the laws of England and Wales.

15.2 Order of Precedence

In the event of conflict between this DPA and the Terms of Service, this DPA shall prevail in matters relating to the processing of Personal Data.

15.3 Amendments

This DPA may only be amended by written agreement signed by both parties, or by the Processor providing reasonable notice of updates required to comply with changes in Applicable Data Protection Law.

15.4 Records of Processing Activities

The Processor maintains a Record of Processing Activities (ROPA) as required by Article 30 UK GDPR / EU GDPR. A summary relevant to this DPA is available upon written request to privacy@behaviourintelligenceplatform.com.