Data Processing Agreement

1. Parties, order of precedence

This DPA supplements the Terms of Service. In case of conflict the DPA prevails for matters of personal-data processing. "Personal Data", "Processing", "Controller", "Processor", "Sub-processor", and "Data Subject" have the meanings in GDPR Art. 4.

2. Subject matter, duration, nature, purpose

• Subject matter: providing the SONAR KYB / CI service to Controller.
• Duration: the term of the Terms of Service, plus the retention periods in section 5 of the Privacy Policy.
• Nature: automated collection, aggregation, and structured reporting on the subjects Controller submits.
• Purpose: enabling Controller to satisfy its own KYB / AML / due-diligence obligations.

3. Categories of data and data subjects

Data subjects: directors, officers, shareholders, Ultimate Beneficial Owners (UBOs), and — where publicly listed — Politically Exposed Persons and sanctioned individuals connected to the companies Controller submits.

Personal data: name; where returned by the public registry or list — role, nationality, birth month and year (SONAR does not request full dates of birth where the registry withholds them for GDPR reasons — e.g. UK Companies House; sanctions and PEP lists may publish full dates of birth), registered address, sanctions or PEP status, director disqualifications, matches in public leak databases, and news or enforcement items that mention the person (adverse media).

4. Processor obligations (GDPR Art. 28(3))

• Process Personal Data only on documented instructions from Controller (these Terms, the DPA itself, and written requests via legal@getsonar.report).
• Ensure all personnel with access to Personal Data are under a contractual or statutory duty of confidentiality.
• Implement appropriate technical and organizational security measures (Annex II).
• Engage Sub-processors only under Section 5 of this DPA.
• Assist Controller with Data Subject rights requests, Data Protection Impact Assessments, and consultations with supervisory authorities.
• Notify Controller of personal-data breaches without undue delay and at most 72 hours after becoming aware (Section 7).
• Return or delete Personal Data at the end of processing, at Controller's choice (Section 8).
• Make available all information necessary to demonstrate compliance, and allow audits as per Section 9.

5. Sub-processors

Controller authorizes SONAR to engage the Sub-processors listed at /legal/subprocessors. SONAR will give Controller at least 30 days' advance notice of any intended addition or replacement (by email or a website update). Controller may object on reasonable data-protection grounds and, if the parties cannot find a solution, terminate the affected service without penalty.

6. International transfers

SONAR is established in the United Kingdom and benefits from the European Commission's UK adequacy decision (28 June 2021), so transfers from EEA Controllers to SONAR (UK) require no further safeguard. Where SONAR transfers Personal Data onward from the UK to a country without UK adequacy, it does so under the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses (the "UK Addendum", in force 21 March 2022) — Module 3 (processor-to-processor). For EEA-origin data transferred onward to a non-adequate country, the SCCs themselves apply (Decision 2021/914, Module 2 for controller-to-processor and Module 3 for processor-to-processor). Both the SCCs and the UK Addendum are incorporated into this DPA by reference.

7. Personal-data breach notification

SONAR notifies Controller without undue delay and at most 72 hours after becoming aware of a breach affecting Controller's Personal Data. The notice includes — to the extent known — the nature of the breach, categories and approximate number of affected Data Subjects, likely consequences, and measures taken or proposed.

8. Return or deletion

On termination Controller chooses, in writing, whether SONAR returns the Personal Data (reports as PDF and JSON) or deletes it. Controller can also delete reports, workspaces or its whole account itself at any time, with immediate effect in SONAR's live database. On a written instruction SONAR deletes within 30 days. Deleted data remains in encrypted backups until they expire (7 days for the database provider's daily backups, 12 weeks for SONAR's weekly backups). Where UK or EU law requires longer retention, SONAR isolates and protects that data until the legal retention period expires.

9. Audits

Once per year, or more often if required by a supervisory authority, Controller may audit SONAR's compliance with this DPA through (a) SONAR's annual third-party security assessment report (SOC 2 when available), or (b) a written questionnaire. On-site audits require 60 days' notice and may be carried out by Controller or a qualified independent auditor under confidentiality, at Controller's cost.

10. Liability

Each party's liability under this DPA is subject to the limitation in the Terms of Service. Allocation of fines between Controller and Processor under GDPR Art. 83 follows the rule in Art. 82(5).

11. Governing law

This DPA is governed by the laws of England and Wales, except that claims by EEA Data Subjects may be brought under the law of their EU habitual residence as required by the SCCs, and claims by UK Data Subjects may be brought under English law as required by the UK Addendum.