Data Processing Agreement

1. Purpose and structure

This Data Processing Agreement ("DPA") applies when Field Logic Ltd ("Field Logic") processes personal data on behalf of a customer ("Customer") as part of providing grith Pro or Enterprise cloud features. Field Logic is the Processor where the Customer is a Controller and the Sub-processor where the Customer is itself a Processor. The corresponding terms are read accordingly throughout this DPA.

Field Logic Ltd is a company registered in England and Wales under company number 15380264, with its registered office at 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE. This DPA supplements the Terms of Service and forms part of the agreement between Field Logic and the Customer. Where a Customer requires a counter-signed copy on Field Logic letterhead, email legal@grith.ai with your company details. For most customers, agreement to the Terms and an active paid subscription incorporates this DPA by reference.

2. Definitions

Capitalised terms not defined here have the meaning given to them in the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, including "personal data", "processing", "data subject", "controller", "processor", and "personal data breach".

Where EU GDPR (Regulation (EU) 2016/679) applies, references to UK GDPR are read as including the corresponding EU GDPR requirements.

3. Scope of processing

Field Logic processes personal data only as necessary to provide the Service to the Customer and on the Customer's documented instructions, which include the Terms, this DPA, the Customer's use and configuration of the Service, and other written instructions agreed by the parties. Field Logic will immediately inform the Customer if, in its opinion, an instruction infringes applicable data-protection law.

The Annex below describes the nature, purpose, duration, categories of personal data, and categories of data subjects.

4. Field Logic's obligations

Field Logic will:

• process personal data only on the Customer's documented instructions, including with regard to transfers outside the UK / EEA, unless applicable law requires otherwise; where legally permitted, Field Logic will tell the Customer of that requirement before processing;
• ensure that personnel authorised to process personal data are bound by appropriate confidentiality obligations;
• implement and maintain appropriate technical and organisational measures (see section 8);
• assist the Controller, taking into account the nature of processing, in fulfilling its obligations to respond to data-subject requests and, taking account of the information available to Field Logic, to ensure security, notify breaches, conduct data-protection impact assessments, and consult the supervisory authority where required;
• at the Customer's choice, delete or return all personal data after the end of the Service, subject to legal retention requirements (see section 10);
• make available to the Customer the information necessary to demonstrate compliance with this DPA and contribute to audits as described in section 11.

5. Sub-processors

The Customer gives general written authorisation for Field Logic to engage the sub-processors listed in the Annex for the processing described in the Annex. The current list is published in section 4 of the Privacy Policy.

Field Logic will notify the Customer (by email to the primary billing contact and by updating the Privacy Policy) at least 30 days before engaging a new sub-processor that materially changes how personal data is handled. The Customer may object on reasonable data-protection grounds within that 30-day window; if the objection cannot be resolved, the Customer may terminate the affected portion of the Service for cause.

Field Logic remains responsible for its sub-processors' performance of their data-protection obligations and imposes the same material obligations on each by written contract.

6. International transfers

Where Field Logic transfers personal data outside the UK / EEA in the course of providing the Service (for example to GitHub's US infrastructure for OAuth, or to Polar's US sub-processors), the transfer will be covered by an applicable adequacy decision or other lawful safeguard. Where required, the parties will enter into the 2021 EU Standard Contractual Clauses using Module 2 (Controller to Processor) or Module 3 (Processor to Processor), as applicable, together with the UK International Data Transfer Addendum for restricted UK transfers. The parties will complete the applicable transfer risk assessment and adopt required supplementary measures.

7. Data-subject requests

If Field Logic receives a request from a data subject relating to personal data processed on the Customer's behalf, Field Logic will:

• not respond to the request directly except to acknowledge receipt and to redirect the data subject to the Customer;
• notify the Customer within five business days;
• where the Customer requires assistance, provide reasonable cooperation including the supply of relevant data exports.

8. Security

Field Logic maintains technical and organisational measures appropriate to the risk, including:

• TLS in transit for all public endpoints;
• encryption at rest for stored secret material (provider keys, signing keys, password vault entries);
• logical access controls; least-privilege role-based access on production systems;
• audit logging on production database access;
• regular dependency scanning (Dependabot, gitleaks, cargo-audit / cargo-deny) and remediation;
• secure development lifecycle including code review, static analysis, and security testing prior to release;
• incident-response procedures and tested backups.

Field Logic reviews these measures at least annually and updates them as risks evolve.

9. Personal-data breach notification

Field Logic will notify the Customer's primary contact without undue delay after becoming aware of a personal-data breach affecting personal data processed on the Customer's behalf. The notification will include, to the extent then known, the nature of the breach, categories and approximate numbers of data subjects and records concerned, likely consequences, and measures taken or proposed.

10. Return and deletion

On termination of the Service, the Customer may within 30 days request export of all personal data processed on its behalf in a structured, commonly-used, machine-readable format. After that 30-day window (or sooner if the Customer instructs), Field Logic will delete personal data from production systems and instruct sub-processors to do the same, save where retention is required by law. Residual copies in disaster-recovery backups remain protected under this DPA and are deleted on the ordinary backup-expiry cycle rather than restored to production except for recovery purposes.

11. Audits

Field Logic will, on the Customer's reasonable written request and no more than once per calendar year (except where required by a supervisory authority), make available to the Customer information necessary to demonstrate compliance with this DPA and allow for and contribute to reasonable audits or inspections by the Customer or its independent auditor. Field Logic may satisfy this obligation by providing relevant SOC 2 / ISO 27001 reports or equivalent third-party assurance once such audits are in place; until then, Field Logic will respond to reasonable written questionnaires.

12. Term and termination

This DPA takes effect when the Customer accepts the Terms of Service or starts using the Service, whichever is earlier, and continues for as long as Field Logic processes personal data on the Customer's behalf. Sections 7 (data-subject rights), 9 (breach), 10 (return / deletion), and 11 (audits) survive termination for as long as is necessary to complete the relevant obligations.

13. Liability and order of precedence

The liability provisions in the Terms of Service apply to this DPA. In the event of a conflict between this DPA and the Terms of Service in relation to personal-data processing, this DPA prevails.

Annex - Description of processing

A.1 Subject-matter and duration

The subject-matter is the provision of the grith Service to the Customer. The duration is the term of the Customer's subscription, plus the export / deletion period described in section 10.

A.2 Nature and purpose

Hosting, transmission, storage, audit-pipeline aggregation, and team-level reporting of personal data submitted by the Customer or the Customer's users in the course of using the grith Service.

Processing occurs when Customer users authenticate, manage teams or provider keys, validate a licence, or enable cloud audit sync, and when Field Logic hosts, secures, supports, or deletes that data.

A.3 Categories of personal data

• account-holder identifiers (email, name, GitHub username, avatar URL);
• authentication tokens and session metadata;
• LLM provider API keys, encrypted at rest under a Field Logic-managed key and decrypted only to return them to the storing team's authorised administrators;
• condensed audit-pipeline records (tool-call types, decisions, scores, timestamps - not the underlying payloads);
• billing identifiers (Polar subscription ID, status, billing email);
• support-correspondence content when initiated by the Customer or its users.

The Service is not intended for special-category data or criminal-offence data. The Customer must not submit either unless the parties first agree suitable written instructions and safeguards.

A.4 Categories of data subjects

• the Customer's personnel who hold grith accounts;
• the Customer's end users who interact with AI agents supervised by grith on the Customer's systems.

A.5 Sub-processors

The current list, including processing region and purpose, is published at grith.ai/privacy#sub-processors and forms part of this Annex.

A.6 Customer rights and obligations

The Customer determines the purposes and means of processing, gives lawful instructions, ensures that it has a lawful basis and has provided required notices, configures and uses the Service appropriately, and may exercise all Controller rights described in this DPA, including rights to information, assistance, return or deletion, objection to new sub-processors, and audit.

Contact

For DPA enquiries, counter-signed copies, or supervisory-authority correspondence, email legal@grith.ai.