Data Processing Agreement

Effective date: 24 April 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer", the data controller) and FunzEventz Limited (Company No. 14903733), trading as Prism Discovery ("Provider", the data processor). It is incorporated by reference into the Terms of Service. By using the service, Customer accepts this DPA.

1. Definitions

Terms defined in the UK GDPR (and the EU GDPR where applicable) have the same meaning here. "Applicable Law" means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation 2016/679) where relevant, and the Privacy and Electronic Communications Regulations.

2. Roles

Customer is the Controller of personal data processed through the service (project data, team members, content assets, analytics imported on Customer's behalf). Provider is the Processor, acting only on Customer's documented instructions as set out in the Terms of Service and this DPA.

3. Subject matter, duration, nature, purpose

Item	Description
Subject matter	Provision of the SaaS platform for SEO and AI-visibility optimisation
Duration	For as long as Customer holds an active account plus applicable retention windows
Nature and purpose	Storing and processing personal data to deliver the contracted service
Types of data	Account data, authentication credentials, analytics exports, content drafts, team-member metadata, audit logs
Categories of data subjects	Customer's users, team members, and any individuals whose data Customer chooses to import

4. Provider obligations

Provider shall:

Process personal data only on documented instructions from Customer (including transfers to a third country — see §9).
Ensure persons authorised to process personal data are bound by confidentiality.
Implement appropriate technical and organisational measures as described in §7.
Assist Customer in responding to data-subject requests (see §6).
Assist Customer with personal-data-breach notification, DPIAs, and prior consultation (see §§6, 8).
At Customer's choice on termination, delete or return all personal data (see §10).
Make available to Customer all information necessary to demonstrate compliance with Art. 28 UK GDPR and contribute to audits (see §11).

5. Subprocessors

Customer grants Provider general authorisation to engage subprocessors. The current subprocessor list is published at /policies/subprocessors and kept current. Provider will give Customer 30 days' advance notice of new subprocessors by email to the workspace owner. Customer may object; if the objection cannot be resolved, Customer may terminate the affected service.

Each subprocessor is bound by equivalent data-protection obligations under a written contract.

Social media platforms (Meta Platforms, Inc.; LinkedIn Corporation; ByteDance Ltd) are engaged as subprocessors when the Social Connectors feature is used. These platforms receive only the content the user explicitly publishes and the minimum account identifiers needed for connection management. See the Subprocessors page at /policies/subprocessors for full details and transfer mechanisms.

6. Data subject rights and assistance

Provider provides self-serve tools for Customer and Customer's users to:

Access and export personal data (UK GDPR Art. 15, 20)
Rectify account data (Art. 16)
Erase account data (Art. 17)

Where a request exceeds the self-serve tools, Provider will assist Customer within 10 working days.

7. Security measures

Provider maintains the following measures, proportionate to risk:

HTTPS with TLS 1.2+ for all transport
Argon2 password hashing
AES-256-GCM encryption at rest for Bring-Your-Own-Model keys and data-source credentials
Role-based access control (OWNER / ADMIN / EDITOR / VIEWER)
Comprehensive audit logging on administrative and write actions
Rate limiting on authentication and sensitive endpoints
Regular dependency scanning and vulnerability patching
Nightly automated cleanup of expired data per retention policy

Full security documentation is available on request under NDA for enterprise customers.

8. Data breach notification

Provider will notify Customer without undue delay and in any event within 72 hours of becoming aware of a personal-data breach affecting Customer's data. Notification will include all information required by Art. 33(3) UK GDPR so Customer can meet its own notification obligations.

9. International transfers

Application hosting, database storage, and some subprocessors operate outside the UK/EEA. For each such transfer, Provider relies on:

Adequacy decisions where available (currently UK ↔ EU adequacy);
UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs);
EU Standard Contractual Clauses (2021 version) for EEA-originating data;
Transfer Impact Assessments where required.

10. Termination

On termination of the Terms of Service:

Customer has 30 days to export data via the self-serve export tool.
After 30 days, personal data is permanently deleted from production systems.
Encrypted backups are retained for a further 30 days before deletion, unless longer retention is required by law.

11. Audit rights

Provider will respond to reasonable written requests by Customer for information needed to demonstrate compliance, within 30 days. For enterprise customers with specific regulatory obligations, on-site or remote audits may be arranged subject to reasonable notice, confidentiality undertakings, and coverage of reasonable costs.

12. Governing law and jurisdiction

This DPA is governed by the laws of England and Wales. Disputes are subject to the exclusive jurisdiction of the courts of England and Wales.

13. Contact

For data-protection matters, contact [email protected]. For urgent breach-related matters, use the same address and mark the email "URGENT — DATA PROTECTION".

FunzEventz Limited (trading as Prism Discovery) Company No. 14903733 | ICO Registration: ZB870952 Registered address: 17a Beckenham Grove, Bromley, BR2 0JN, United Kingdom Email: [email protected]