Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the agreement between Interest For Good Ltd ("Processor") and you ("Controller") and sets out the terms under which we process personal data on your behalf. This DPA applies where and to the extent that we process personal data subject to applicable data protection legislation, including the UK GDPR and the EU General Data Protection Regulation.

2. Definitions

Terms used in this DPA have the meanings given in applicable data protection laws. "Personal Data", "Data Subject", "Processing", "Controller", and "Processor" shall be interpreted in accordance with those definitions.

3. Scope and Purpose

We process personal data solely to provide the Interest For Good services as described in our Terms of Service and in accordance with your documented instructions. We will not process personal data for any other purpose unless required by law.

4. Obligations of the Processor

We shall:

• Process personal data only on your documented instructions
• Ensure that persons authorised to process personal data are subject to confidentiality obligations
• Implement appropriate technical and organisational security measures
• Assist you in responding to data subject rights requests
• Notify you without undue delay upon becoming aware of a personal data breach
• Delete or return all personal data upon termination of services, at your choice

5. Sub-Processors

We may engage sub-processors to assist in providing the services. A current list of sub-processors is available upon request. We will give you prior written notice of any intended changes to sub-processors, giving you the opportunity to object. All sub-processors are bound by data processing obligations no less protective than those in this DPA.

6. International Transfers

Where personal data is transferred outside the United Kingdom or the European Economic Area, we will ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the relevant authority, or reliance on an adequacy decision. Further details are available in our Privacy Policy.

7. Security Measures

We implement and maintain appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure. These measures are reviewed and updated regularly in line with industry standards.

8. Audits

We will make available to you all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, subject to reasonable notice and confidentiality obligations.

9. Term and Termination

This DPA remains in effect for the duration of our processing of personal data on your behalf. Upon termination of the services, we will delete or return all personal data within 30 days, unless retention is required by applicable law.

10. Contact Us

If you have questions about this Data Processing Agreement, please reach out to us at support@interestforgood.com.