CREATE LINKS LTD

DATA PROCESSING AGREEMENT (DPA)

Version: 1.0

Effective Date: 9 August 2026

DATA PROCESSING AGREEMENT

This Data Processing Agreement ("DPA") forms part of the agreement between Create Links Ltd ("Create Links", "Processor", "we", "our") and the Client ("Controller", "you") for the provision of the Services.

This DPA applies whenever Create Links processes Personal Data on behalf of the Client.

Where Create Links processes Personal Data for its own business purposes, Create Links acts as an independent Controller and this DPA shall not apply to those processing activities.

1. Definitions

Unless otherwise defined within this Agreement, terms such as:

• Personal Data
• Processing
• Controller
• Processor
• Data Subject
• Personal Data Breach
• Supervisory Authority
• Sub-processor

shall have the meanings given under the UK GDPR.

2. Scope

This DPA applies whenever:

• the Client uploads Personal Data;
• the Client instructs Create Links to process Personal Data;
• Links access Personal Data in order to perform the Services.

It applies only to Personal Data processed on behalf of the Client.

3. Roles of the Parties

The parties acknowledge that different processing activities involve different legal roles.

3.1 Create Links as Processor

Create Links acts as a Processor where it processes Personal Data solely on behalf of the Client to provide the Services.

Examples include:

• editing Client documents;
• designing marketing materials containing customer data;
• managing uploaded files;
• assisting with administrative work;
• processing CRM information;
• creating presentations;
• project management.

3.2 Create Links as Controller

Create Links acts as an independent Controller when processing Personal Data relating to:

• Client accounts;
• subscriptions;
• billing;
• payments;
• fraud prevention;
• recruitment of Links;
• website analytics;
• customer support;
• marketing;
• legal compliance.

Such processing is governed by our Privacy Policy.

4. Subject Matter

The subject matter of processing is the provision of subscription-based creative and business support services.

5. Duration

Processing continues for the duration of the Subscription unless otherwise required by law.

6. Nature of Processing

Processing may include:

• collection;
• organisation;
• storage;
• consultation;
• editing;
• design;
• transmission;
• retrieval;
• analysis;
• deletion;
• destruction.

7. Types of Personal Data

Depending on the Client's instructions, Create Links may process:

• names;
• email addresses;
• telephone numbers;
• addresses;
• photographs;
• customer records;
• employee information;
• supplier information;
• invoices;
• project documents;
• communications;
• marketing information.

8. Categories of Data Subjects

Data Subjects may include:

• Clients
• employees
• contractors
• suppliers
• customers
• leads
• website visitors
• business contacts

9. Client Instructions

Create Links shall process Personal Data only:

• in accordance with this DPA;
• under the Subscription Agreement;
• following documented instructions from the Client;
• where otherwise required by law.

If Create Links believes an instruction breaches applicable data protection legislation, it will notify the Client before processing where legally permitted.

10. Confidentiality

Create Links shall ensure that any person authorised to process Personal Data:

• is subject to contractual confidentiality obligations;
• receives appropriate privacy training;
• accesses Personal Data only where necessary.

This includes employees, contractors and Links.

11. Security Measures

Create Links shall implement appropriate and proportionate technical and organisational measures designed to protect Personal Data, having regard to the nature, scope, context and purposes of the processing, the risks presented by the processing, available technology and the resources reasonably available to Create Links.

Such measures may include, where reasonably practicable and appropriate:

• encrypted communications;
• access controls;
• least-privilege permissions;
• authentication controls;
• secure hosting;
• audit logging;
• appropriate password protection and hashing;
• malware protection;
• backup procedures; and
• security monitoring.

The specific measures implemented may vary depending on the nature and sensitivity of the Personal Data and the systems used. Create Links shall review its security measures periodically and make reasonable improvements where appropriate and proportionate to the identified risks.

12. Links and Independent Contractors

The Client acknowledges that Create Links may engage employees, contractors and independent Links to perform the Services.

Where a Link processes Personal Data:

• Create Links shall ensure the Link is contractually bound by confidentiality obligations;
• the Link shall process Personal Data only as necessary to perform the allocated Services;
• Create Links shall remain responsible for managing authorised processing activities carried out by the Link in accordance with this DPA.

13. Sub-processors

The Client grants general authorisation for Create Links to appoint Sub-processors where reasonably necessary.

Current categories include:

• cloud hosting providers;
• payment processors;
• customer support platforms;
• communication providers;
• project management software;
• authentication providers;
• analytics providers;
• AI providers approved by Create Links.

Create Links shall impose contractual data protection obligations on Sub-processors that are substantially equivalent to those contained within this DPA.

14. International Transfers

Where Personal Data is transferred outside the United Kingdom or European Economic Area, Create Links shall ensure appropriate safeguards are implemented, including:

• International Data Transfer Agreements;
• UK Addendum to the EU Standard Contractual Clauses;
• European Commission Standard Contractual Clauses;
• adequacy regulations.

15. Assistance

Taking into account the nature of the processing and the information reasonably available to Create Links, Create Links shall provide the Client with such reasonable assistance as is required under applicable Data Protection Law in relation to:

• Data Subject Requests;
• data protection impact assessments (DPIAs);
• consultations with supervisory authorities;
• security obligations; and
• Personal Data Breach notification and response obligations.

Where reasonably possible, such assistance shall be provided through the functionality of the Services, information already available to Create Links, or Create Links’ standard processes.

Create Links shall not be required to incur disproportionate cost or undertake activities beyond those reasonably required of it under applicable Data Protection Law.

To the extent permitted by applicable Data Protection Law, assistance requiring material additional work beyond Create Links’ standard obligations or Services may be subject to reasonable additional charges, provided that Create Links informs the Client of such charges in advance where reasonably practicable.

Nothing in this Clause limits or excludes any assistance that Create Links is required by applicable Data Protection Law to provide as a processor.

16. Data Subject Requests

If Create Links receives a request from a Data Subject relating to Personal Data processed on behalf of the Client, Create Links shall:

• notify the Client promptly;
• not respond directly unless legally required or authorised;
• provide reasonable assistance where appropriate.

17. Personal Data Breaches

If Create Links becomes aware of a Personal Data Breach affecting Personal Data processed on behalf of the Client, Create Links shall:

• notify the Client without undue delay;
• provide available information regarding the breach;
• investigate the incident;
• take reasonable steps to mitigate its effects;
• cooperate with the Client regarding regulatory obligations.

18. Deletion or Return of Data

Upon termination of the Services and subject to legal retention obligations, Create Links shall, at the Client's written election:

• securely delete Personal Data; or
• return Personal Data in a commercially reasonable format.

Backup copies retained as part of routine disaster recovery systems may continue to exist until automatically overwritten.

19. Audit Rights

The Client may request reasonable evidence demonstrating Create Links' compliance with this DPA.

Create Links may satisfy such requests through:

• certifications;
• security documentation;
• policies;
• audit summaries;
• questionnaires.

On-site audits shall occur only where reasonably necessary, upon reasonable notice, during business hours and subject to confidentiality obligations.

20. AI-Assisted Processing

Create Links may use AI-assisted tools to support the delivery of the Services.

Where Personal Data is processed using AI-assisted technologies:

• Create Links shall use reputable commercial providers;
• appropriate contractual safeguards shall be implemented where reasonably available;
• Personal Data shall not knowingly be used to train publicly available AI models without the Client's authorisation;
• AI processing shall remain subject to appropriate human oversight where necessary.

21. Liability

The liability provisions contained within the Subscription Agreement apply equally to this DPA.

Nothing within this DPA limits liability where such limitation is prohibited by applicable data protection legislation.

22. Governing Law

This DPA shall be governed by the laws of England and Wales.

Schedule 1 – Processing Activities