last updated 21 October 2026 · Human Forward LTD · hello@humanforward.io

Data processing agreement

This Data Processing Agreement (DPA) forms part of the App and AI Tools Terms, and of any proposal, order form or engagement letter under which Human Forward LTD provides services to a customer (together, the Agreement). It applies whenever we process personal data on your behalf in providing the services. It is pre signed by us: by accepting the Agreement you accept this DPA, and no separate signature is needed. If you need a countersigned copy, email hello@humanforward.io.

Where this DPA and the Agreement conflict on data protection, this DPA applies. Where this DPA and the Standard Contractual Clauses or the UK Addendum conflict, those apply.

1. Who does what

You are the controller (or, under US law, the business) of the personal data we process for you, and we are your processor (or service provider). This covers the personal data in your store, your site, your accounts, your community and anything you give us for consulting work. In Annex 1 it is called Customer Personal Data
For some data we are a controller in our own right: your account details, billing, our website, our marketing, our own business records, and data we gather about your store or site from public sources to run the services. Our Privacy Policy governs that, not this DPA
Where you run a community on our platform, you are the controller of your members' data and we are your processor. Where you accept payments through Stripe Connect, Stripe is an independent controller for card data
Each of us complies with the Data Protection Laws that apply to it

2. Definitions

Data Protection Laws means all laws that apply to the processing of personal data under the Agreement, including the UK GDPR and the Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679), the ePrivacy rules, the Swiss Federal Act on Data Protection, and the US State Privacy Laws
US State Privacy Laws means the California Consumer Privacy Act as amended by the California Privacy Rights Act, and the comparable laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Iowa, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and any other US state, each as in force
SCCs means the EU Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914. UK Addendum means the UK Information Commissioner's International Data Transfer Addendum to the SCCs, version B1.0. IDTA means the UK International Data Transfer Agreement
Restricted Transfer means a transfer of personal data to a country that the UK, the EU or Switzerland (as applicable) has not found adequate, where the transfer would be unlawful without a safeguard
Sub processor means a third party we engage to process Customer Personal Data on your behalf
Personal data, processing, controller, processor, data subject, personal data breach, business, service provider, sell and share have the meanings in the Data Protection Laws

3. Your obligations

You are responsible for the personal data you put into the services and for what you ask us to do with it. You warrant and undertake that:

You have a lawful basis for the processing, have given data subjects every notice the law requires, and have obtained every consent needed, including for us to process the data, for our sub processors to process it, and for any Restricted Transfer that the services involve
Your instructions to us are lawful, and you will not instruct us to do anything that would put either of us in breach of the Data Protection Laws
You will not give us, or let us collect, special category or sensitive data (health, biometric, genetic, racial or ethnic origin, political, religious, sexual life or orientation, criminal data, precise geolocation, financial account credentials, children's data, government identifiers) unless we have agreed it in writing and the Agreement provides for it. The services are not designed for such data
You will only give us the personal data the services need, keep it accurate, and keep your own copies and backups
Where our agents act on accounts you connect, you are the controller of everything in those accounts and responsible for the lawfulness of what the agents are set to do
You will respond to data subjects, regulators and third parties about the processing, and handle any complaint about your use of the services
You will compensate us for any fine, claim, loss or cost we suffer because you breached this section or the Data Protection Laws

4. Our obligations

We will:

Instructions. Process Customer Personal Data only on your documented instructions, which are the Agreement, this DPA, your configuration of the services and any written instruction you give us, unless the law requires otherwise, in which case we tell you first unless the law forbids it. We will tell you if we think an instruction breaks the Data Protection Laws, and we may suspend that instruction until it is resolved. An instruction outside the Agreement is a change we may charge for or decline
Confidentiality. Make sure anyone we authorise to process the data is bound by confidentiality
Security. Put in place the technical and organisational measures in Annex 2, keep them under review, and update them as technology and risk change. We may change them, but not so as to lower the overall level of protection during the Agreement
Sub processors. Engage them only as section 5 says
Assistance. Taking into account the nature of the processing and the information we have, assist you with data subject requests (section 7), with your security obligations, with breach notifications, with data protection impact assessments and with consultations with a regulator, to the extent you cannot do it yourself through the services. We may charge our rates for assistance that goes beyond what the services already provide
Deletion and return. Handle the data at the end of the Agreement as section 9 says
Information and audits. Make available the information needed to show we comply with this DPA, and allow audits as section 8 says

We are not responsible for what any AI engine, search engine or other third party that we do not engage as a sub processor says, does or stores. Asking an engine a question about your store, in the Findability app, sends public store content to that engine; the engine is not our sub processor for that purpose and its own terms apply.

5. Sub processors

You give us general authorisation to use sub processors. The current list is in Annex 3 and at humanforward.io/dpa
We give at least 30 days notice of a new or replacement sub processor by updating that page and emailing the address on your account. You may object in writing within those 30 days on reasonable, documented data protection grounds. We will then try to resolve the objection. If we cannot, you may terminate the affected service by written notice before the change takes effect, with a pro rata refund of any fees paid in advance for the period after termination. That is your only remedy. If you do not object within 30 days, the sub processor is approved
We put a written contract on each sub processor with data protection obligations no less protective than this DPA, and we remain responsible to you for their performance
Where an emergency replacement is needed to keep the services running or secure, we may engage the replacement first and tell you promptly afterwards, and you keep the right to object as above

6. International transfers

We are based in the United Kingdom. Our infrastructure and most sub processors are in the United States, and some are elsewhere. You authorise us to make Restricted Transfers of Customer Personal Data to the locations in Annex 3, subject to the following, which apply only to the extent a Restricted Transfer is actually made:

From the UK. Where the UK Extension to the EU to US Data Privacy Framework or another adequacy decision does not cover the transfer, the UK Addendum to the SCCs applies, with the SCCs completed as below and the Addendum completed as follows: Table 1 parties as in the Agreement; Table 2 the SCCs as completed in this section; Table 3 the Annexes to this DPA; Table 4 either party may end the Addendum as its section 19 allows
From the EEA. Where the EU to US Data Privacy Framework or another adequacy decision does not cover the transfer, the SCCs are incorporated into this DPA with the following choices: Module Two (controller to processor) where you are a controller and Module Three (processor to processor) where you are a processor; Clause 7 (docking) does not apply; Clause 9 Option 2 (general authorisation) with the 30 day period in section 5; the optional language in Clause 11 does not apply; Clause 13 and Annex I.C: the supervisory authority of the EEA member state in which you are established, or where you are not established in the EEA, the Irish Data Protection Commission; Clause 17 Option 1: the law of Ireland; Clause 18: the courts of Ireland. Annex I of the SCCs is Annex 1 of this DPA, Annex II is Annex 2, Annex III is Annex 3
From Switzerland. The SCCs as above, read with the Federal Data Protection and Information Commissioner as the competent authority, references to the GDPR read as references to the Swiss FADP, and data subjects in Switzerland able to enforce their rights in Switzerland
Where we are certified under a Data Privacy Framework, or another valid mechanism becomes available, we may rely on it instead and will tell you
If a safeguard above is invalidated or replaced, we will put a replacement in place within a reasonable time, and you will cooperate, including by signing anything needed
We will tell you if we receive a legally binding request from a public authority for Customer Personal Data, unless the law forbids it, and we will challenge requests we reasonably believe to be unlawful

7. Data subject requests

If a data subject contacts us about Customer Personal Data we will, where we can identify you, redirect them to you and tell you, and we will not respond ourselves unless you ask us to or the law requires it. You will use the services' own features to export, correct or delete data where they exist. Where they do not, we will assist at our rates, within a reasonable time.

8. Audits

We maintain records of our processing and security. On written request, no more than once in any 12 months, we will provide them, together with any third party reports or certifications we hold for the infrastructure we use, and will answer reasonable written questions. In most cases that satisfies your audit right
Where the Data Protection Laws give you a right to audit that a report does not satisfy, or a regulator requires it, you (or an independent auditor you appoint, who is not our competitor and who signs our confidentiality terms) may audit our compliance with this DPA: once in any 12 months unless a regulator requires more or a breach has occurred; on at least 30 days written notice; during business hours; for no more than two business days; without disrupting the services; and at your cost, including our time at our rates. The audit covers our processing of your data only, not other customers' data, our other customers, our source code, our prompts or our sub processors' premises
You will give us a copy of any findings, and treat the audit and its results as our confidential information

9. Deletion and return

You can export your data through the services while the Agreement runs, and you should do so before it ends
Within 30 days of the end of the Agreement, or of the service in question, we delete Customer Personal Data, unless you have asked in writing before the end date for a return, in which case we provide an export in a standard format of our choosing and then delete
Copies in backups are deleted on the backup cycle, within 90 days, and are not accessed in the meantime except to restore the services
We may keep data the law requires us to keep, and data needed for billing, disputes or the defence of claims, for as long as needed, protected as this DPA requires and used for nothing else
We confirm deletion in writing on request

10. Personal data breaches

We will tell you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information we have at the time and more as it becomes available: what happened, the data and data subjects likely affected, the likely consequences, and what we are doing about it. Our notice is not an admission of fault or liability. You are responsible for notifying regulators and data subjects where the law requires you to; we will assist. You will not name us in a notification without first giving us a reasonable chance to comment, unless the law requires it.

11. US State Privacy Laws

Where US State Privacy Laws apply, we are your service provider or processor and we certify that we understand and will comply with the following. We will not sell or share Customer Personal Data; will not retain, use or disclose it for any purpose other than the business purpose of providing the services, or outside the direct business relationship with you; will not combine it with personal data we receive from others, except as the law permits a service provider to; will tell you if we decide we can no longer meet our obligations; and will allow you to take the reasonable and appropriate steps the law provides to stop and remedy unauthorised use. You may give us instructions on the handling of consumer requests, and we will assist as section 7 says. The disclosure of Customer Personal Data to us is not a sale, and we receive no monetary or other valuable consideration for it beyond the fees for the services.

12. Liability

Each party's liability under or in connection with this DPA, including under the SCCs and UK Addendum as between the parties, is subject to the exclusions and limits of liability in the Agreement, and counts towards the cap there. Nothing in this DPA limits either party's liability to a data subject or regulator where the law does not allow it. You will compensate us for fines, claims, losses and costs that arise from your breach of this DPA or of the Data Protection Laws, from your instructions, or from data you should not have given us.

13. General

This DPA lasts as long as we process Customer Personal Data for you, and sections 9, 12 and 13 survive after that
We may update this DPA where the Data Protection Laws, a regulator's guidance, a transfer mechanism or our services change. We will give notice of material changes by email and on this page; continued use after the notice period is acceptance. Where a change is required by law it takes effect when the law does
If any part of this DPA is unenforceable the rest applies, and the part is read as narrowly as needed to make it enforceable
This DPA is governed by the law of England and Wales, and its courts have exclusive jurisdiction, except where the SCCs or UK Addendum provide otherwise for the matters they cover
Notices to us: hello@humanforward.io, with a copy by post to Human Forward LTD, 66 Paul Street, London EC2A 4NA

Annex 1. Details of the processing

Subject matter. Provision of the services described in the Agreement: the Findability app and its connector, Human Forward Plus, the Agentic Team, the community platform, and consulting work
Duration. The term of the Agreement plus the deletion period in section 9
Nature and purpose. Hosting, storing, analysing and reporting on store and site data; asking AI engines about the customer's store and scoring their answers; generating recommendations and content; operating accounts the customer connects within the policies it sets; running a community platform; sending transactional email; providing support; and the related technical operations (backups, logging, security monitoring)
Data subjects. The customer's staff and users; the customer's own customers and site visitors, where their data is in a connected store, account or site; community members; people named in content the customer submits
Categories of data. Names, email addresses, roles and account identifiers of the customer's users; store and site content, which may incidentally contain personal data (reviews, blog posts, staff pages); order, customer and marketing data only where a service expressly reads a connected account (the Agentic Team and the community platform), and only the fields the service needs; community member profiles, memberships, event attendance and messages; usage and log data (IP address, device, timestamps); support correspondence
Special category data. None intended. The customer must not submit it without written agreement
Frequency. Continuous while the services run; on demand for consulting
Retention. As in section 9 and the Privacy Policy

Annex 2. Security measures

Encryption in transit (TLS 1.2 or higher) for every connection, and at rest for databases and backups, provided by our hosting platforms
Credentials, API keys, access tokens and sign in codes are stored as one way hashes, never in plain text; secrets are held in the hosting platform's secret store, never in source code
Access to production systems is limited to named people who need it, protected by multi factor authentication, and reviewed when roles change
Separate environments for development and production; changes go through version control and review before deployment
Logging of access and administrative actions on infrastructure; alerts for failed deployments and errors
Daily backups held by the hosting platform, tested by restore
Our crawler is restricted to public hosts and cannot be pointed at private networks; rate limits and bot protection on public endpoints; security headers on every response
AI providers are used under business API terms under which inputs and outputs are not used to train their models
Vendors are assessed before use for security and data protection terms
Staff and contractors are bound by confidentiality and receive data protection guidance
An incident response process with the notification timeline in section 10
Data minimisation: the services read only the data they need, and public content wherever possible

Annex 3. Sub processors

Sub processor	Purpose	Location
Railway Corporation	Application hosting and databases for the apps	United States
Vercel Inc.	Website hosting, edge network, file storage and analytics	United States, with edge servers worldwide
Cloudflare, Inc.	Bot protection, DNS and network security	United States, with servers worldwide
Stripe, Inc. and Stripe Payments Europe Ltd	Subscription billing and the customer billing portal (Stripe is an independent controller for card data)	United States, Ireland
Resend, Inc.	Transactional email, including sign in codes	United States
Klaviyo, Inc.	Email, newsletter and forms	United States
Cal.com, Inc.	Session bookings	United States
Shopify International Ltd and Shopify Inc.	App hosting inside a Shopify store, billing, install data	Canada, Ireland, United States
Anthropic PBC, OpenAI OpCo LLC, Google LLC, Perplexity AI Inc., xAI Corp	Generating scores, reports, recommendations and content from data the customer submits; checking how a store appears in each engine's answers	United States
DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd)	Checking how a store appears in its answers. Receives public store content only, never account or customer data	China
Google LLC (Workspace)	Email, documents and business tools used to deliver consulting and support	United States, EU

Changes to this list are notified as section 5 says. The list was last updated on 21 October 2026.