Data Processing Agreement

Data Processing Agreement (DPA) — DRAFT

Version: 1.0-DRAFT · Owner: Pocket PMO Ltd · Approval status: Draft — subject to legal review

Important. This document is a working draft. It has not yet been reviewed by external legal counsel and must not be relied upon as a signed contractual agreement. To request an executable DPA, contact admin@pocketpmo.co.uk.

Parties

(1) The Customer, the legal entity signing up for or using the Pocket PMO service.

(2) Pocket PMO Ltd, a company registered in England and Wales under company number 16982857, whose registered office is at 6 Salesbury Drive, Billericay, United Kingdom, CM11 2JG ("Pocket PMO").

1. Background

• 1.1 The parties have entered into an agreement for the provision by Pocket PMO of a project and portfolio management service (the "Service").
• 1.2 In the course of providing the Service, Pocket PMO will Process Personal Data on behalf of the Customer.
• 1.3 This Data Processing Agreement ("DPA") governs that Processing and forms part of the Service agreement.

2. Definitions

Capitalised terms have the meaning given in the UK GDPR and the Data Protection Act 2018. "Processing", "Personal Data", "Data Subject", "Controller", "Processor" and "Sub-processor" have the meanings given in those regulations.

3. Roles

• 3.1 The Customer is the Controller and Pocket PMO is the Processor for Personal Data placed inside the Customer's workspace(s).
• 3.2 For account-level Personal Data (billing contacts, admin users, subscription metadata) collected directly by Pocket PMO from the Customer, Pocket PMO is the Controller.

4. Scope of processing

• 4.1 Subject-matter: provision of the Service.
• 4.2 Duration: for the term of the Service agreement, plus any post-termination retention period set out in section 10.
• 4.3 Nature and purpose: hosting, storage, transmission, computation, and AI-assisted analysis of Customer data to deliver the Service.
• 4.4 Types of Personal Data and Data Subjects: see Schedule 1.

5. Pocket PMO obligations

Pocket PMO shall:

• (a) Process Personal Data only on documented instructions from the Customer, including with regard to transfers to third countries (unless required to do so by UK or EU law, in which case Pocket PMO shall inform the Customer before Processing).
• (b) Ensure that persons authorised to Process Personal Data are bound by confidentiality obligations.
• (c) Implement the technical and organisational measures set out in Schedule 2, being appropriate to the risks of the Processing.
• (d) Assist the Customer, taking into account the nature of the Processing, in fulfilling its obligation to respond to Data Subject requests and to comply with Articles 32–36 UK GDPR.
• (e) Notify the Customer without undue delay, and in any case within 72 hours of confirmation, of any Personal Data Breach affecting the Customer's Personal Data. Notification will include the information required by Article 33(3) UK GDPR to the extent then available.
• (f) At the choice of the Customer, delete or return all Personal Data at the end of the Service (see section 10), subject to legal retention requirements.
• (g) Make available to the Customer information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits under section 9.

6. Sub-processors

• 6.1 The Customer consents to the engagement of the sub-processors listed in the Sub-Processor Register at the effective date of this DPA.
• 6.2 Pocket PMO will publish material changes to the sub-processor list on the Trust Centre and give at least 30 days' notice before onboarding new sub-processors that materially change the risk profile.
• 6.3 Pocket PMO remains fully liable for the acts and omissions of its sub-processors.

7. International transfers

• 7.1 Where the provision of the Service requires transfer of Personal Data outside the UK / EEA, Pocket PMO will implement either the UK International Data Transfer Addendum (IDTA) or the EU Standard Contractual Clauses (SCCs) with the receiving sub-processor.
• 7.2 The transfer mechanism in force for each sub-processor is available on request.

8. Data subject requests

Pocket PMO will provide the technical means (self-serve tools, APIs, and administrative support) to enable the Customer to fulfil Data Subject rights. Where a request is received by Pocket PMO directly, it will be forwarded to the Customer without undue delay.

9. Audit rights

• 9.1 Once every 12 months, the Customer may request evidence of compliance with this DPA. Pocket PMO will provide reasonable documentation, including (where available) independent certifications, penetration test summaries, and this DPA.
• 9.2 On-site audits will be considered only where mandated by the Customer's regulator and will be scoped to minimise disruption; costs are borne by the requesting Customer unless a material non-compliance is identified.

10. Return or deletion

• 10.1 On termination of the Service, Pocket PMO will, at the Customer's option, delete or return the Customer's Personal Data within 30 days.
• 10.2 A copy may remain in backups managed by the hosting provider for the provider's backup retention period, after which it will be irretrievably deleted.

11. Liability

Liability under this DPA is subject to the limitation provisions of the underlying Service agreement.

12. Governing law

This DPA is governed by the laws of England and Wales . The parties submit to the exclusive jurisdiction of the English courts.

13. Contacts

For requests under this DPA: admin@pocketpmo.co.uk.

Schedule 1 — Details of Processing

Schedule 2 — Technical and organisational measures

• Row Level Security on every business table; policies evaluated by a SECURITY DEFINER role helper.
• AES-256 at rest, TLS 1.3 in transit.
• MFA (TOTP) available on all user accounts.
• Session inactivity timeout (30 minutes) and forced sign-out on expiry.
• Rate limiting on authentication, forms and AI endpoints.
• Audit logging in audit_logs and per-domain change tables.
• Approval-first AI: no automated data change or external communication without explicit user confirmation.
• Sentry error monitoring (where enabled).
• Backups by the managed platform provider (H-03).

Schedule 3 — Sub-processors

The current list is maintained at pocketpmo.co.uk/trust/subprocessors and available on request. This includes both direct sub-processors engaged by Pocket PMO Ltd and upstream sub-processors engaged by Lovable Cloud, whose authoritative list is published at https://trust.lovable.dev/. Pocket PMO's engagement of Lovable Cloud as a hosting sub-processor is governed by the Lovable Data Processing Agreement (available at https://lovable.dev/data-processing-agreement).

Document history