Version 1.1

Effective date: 06/08/2026

1. Parties & Incorporation

This Data Processing Agreement ("DPA") forms part of the Client Terms of Service ("Terms") between:

• USERSOUND LTD (Company No. 16703811), whose registered office is at 76 Elm Grove, Southsea, Portsmouth, England, PO5 1LN ("UserSound", "Processor", "we", "us", "our"); and
• the Client organisation or individual that creates an account or otherwise uses the Platform under the Terms ("Client", "Controller", "you").

By creating an account or using the Platform, you agree to this DPA. This DPA applies automatically and does not require a separate signature.

If there is a conflict between this DPA and the Terms on a data protection matter, this DPA prevails. Capitalised terms not defined here have the meaning given in the Terms.

2. Definitions

• Client Personal Data: Personal Data contained in Content (including audio recordings, transcripts, summaries, survey responses, and participant first names) that UserSound processes on behalf of the Client to provide the Platform.
• Content: Audio recordings, transcripts, summaries, responses, and other data generated through surveys, as defined in the Terms.
• Data Protection Laws: the UK GDPR, the Data Protection Act 2018, and (where applicable to the Client) the EU GDPR.
• Data Subject: an identified or identifiable natural person.
• Personal Data, Processing, Controller, Processor, and Supervisory Authority have the meanings given in Data Protection Laws.
• Platform: the UserSound website, applications, and services.
• Sub-processor: a third party engaged by UserSound to Process Client Personal Data on UserSound's behalf.
• UK GDPR: the United Kingdom General Data Protection Regulation as tailored by the Data Protection Act 2018.

3. Roles & Scope

For Client Personal Data:

• the Client acts as Controller; and
• UserSound acts as Processor.

This DPA does not apply to personal data for which UserSound is an independent Controller (for example Client account, billing, marketing, and product analytics about Client users). That processing is described in our Privacy Policy.

4. Subject Matter, Duration, Nature & Purpose

UserSound Processes Client Personal Data to provide the Platform, including:

• hosting and storing survey Content;
• voice capture, transcription, and conversational AI;
• analysis, summaries, and insights for the Client; and
• related support, security, and Platform operation.

Processing continues for the term of the Client's account under the Terms, and thereafter until Client Personal Data is deleted or returned in accordance with this DPA and the retention periods in Annex A.

5. Types of Personal Data & Data Subjects

Categories of Data Subjects typically include Participants invited by the Client, and (where present in Content) Client users.

Types of Client Personal Data typically include: participant first name; voice/audio recordings; transcripts; survey answers; and related technical metadata required to deliver the survey.

The Platform is not intended for special category data. The Client must not design surveys to collect special category data unless the Client has a lawful basis and has configured the survey accordingly. The Client remains responsible for survey content and Participant consents.

6. Client Instructions

UserSound shall Process Client Personal Data only on documented instructions from the Client, which comprise:

• the Terms and this DPA;
• the Client's configuration and use of the Platform; and
• other written instructions agreed by the parties.

The Client warrants that it has a lawful basis for Processing (including obtaining Participant consent for voice recording where required) and that its instructions comply with Data Protection Laws.

If UserSound believes an instruction infringes Data Protection Laws, it will inform the Client and may refuse to follow that instruction.

7. Confidentiality

UserSound ensures that persons authorised to Process Client Personal Data are subject to appropriate confidentiality obligations and are granted access only as needed to perform their role (least privilege).

8. Security

Taking into account the state of the art, costs of implementation, and the nature, scope, context, and purposes of Processing, UserSound shall implement appropriate technical and organisational measures to protect Client Personal Data, as summarised in Annex C.

9. Sub-processors

The Client provides general written authorisation for UserSound to engage Sub-processors. The current Sub-processors are listed in Annex B.

UserSound will give the Client at least 30 days' advance notice of any intended addition or replacement of a Sub-processor (via email and/or a notice on the Platform or website), except where a shorter period is required for security or service continuity.

The Client may object on reasonable data-protection grounds within 14 days of notice. If the parties cannot resolve the objection, the Client may terminate the affected Platform services as its sole remedy.

Where UserSound engages a Sub-processor, it shall do so under a written contract that imposes on that Sub-processor data-protection obligations equivalent to those set out in this DPA (including the relevant obligations required by Article 28 of the UK GDPR).

UserSound remains responsible for the performance of its Sub-processors as if their acts and omissions were those of UserSound.

10. International Transfers

Client Personal Data is hosted in the United Kingdom as described in Annex B. Certain Sub-processors (including OpenAI and ElevenLabs) Process Client Personal Data in the United States, which involves an international transfer.

Where Client Personal Data is transferred outside the UK/EEA, UserSound will ensure that appropriate safeguards are in place under Data Protection Laws, such as the UK International Data Transfer Agreement and/or the EU Standard Contractual Clauses (including where those safeguards are implemented through UserSound's written contracts with the relevant Sub-processors). UserSound will update Annex B and provide notice under Section 9 where a new Sub-processor or transfer location is involved.

11. No Secondary Use / No Model Training

UserSound shall not sell Client Personal Data, use it for advertising, or use it to train UserSound or third-party machine learning models. Client Personal Data is Processed solely to provide the Platform and related support, security, and legal compliance.

12. Assistance

Taking into account the nature of Processing, UserSound shall assist the Client by appropriate technical and organisational measures, insofar as possible, with:

• responding to Data Subject requests under Data Protection Laws;
• security of Processing;
• personal data breach notification; and
• data protection impact assessments and prior consultation with a Supervisory Authority, where required.

UserSound shall notify the Client without undue delay, and where feasible within 72 hours of becoming aware of a personal data breach affecting Client Personal Data, and shall provide information reasonably required for the Client to meet its obligations.

13. Deletion & Return

Upon termination of the Client's account, or upon written request, UserSound shall (at the Client's choice, where technically feasible) delete or return Client Personal Data, and delete existing copies, within 30 days, except where retention is required by applicable law.

Backup copies may persist for a limited period consistent with UserSound's backup cycles and will be deleted in the ordinary course. The Client may also delete projects and individual conversations from the Platform dashboard during the subscription term.

14. Audits & Information

UserSound shall make available to the Client information reasonably necessary to demonstrate compliance with this DPA. Audits, if required, shall be limited to once in any 12-month period (unless required by a Supervisory Authority or following a personal data breach), on reasonable written notice, during business hours, subject to confidentiality, and preferably satisfied first by documentation, questionnaires, and remote review.

15. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except to the extent such limitations are prohibited by Data Protection Laws.

16. Term & Changes

This DPA takes effect on the Effective Date above (or the date the Client first accepts the Terms incorporating this DPA, if later) and continues for as long as UserSound Processes Client Personal Data.

UserSound may update this DPA from time to time. Material changes will be published with a new version number and effective date, with at least 30 days' notice where practicable (via email and/or Platform/website notice). Continued use of the Platform after the effective date constitutes acceptance of the updated DPA.

17. Governing Law & Contact

This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, subject to any mandatory rights of the Client under Data Protection Laws.

Privacy / data protection contact:

• [email protected] (Data Protection Officer)
• [email protected]

Annex A — Processing Details

Annex B — Sub-processors

The following Sub-processors Process Client Personal Data:

• DigitalOcean – Hosting, managed PostgreSQL, and object storage for audio, transcripts, summaries, and related Content. Location: London, UK (LON1).
• OpenAI – AI transcription and language model services. Client Personal Data may be transferred internationally. UserSound implements appropriate safeguards for such transfers in accordance with Section 10 of this DPA.
• ElevenLabs – Text-to-speech services for the AI agent voice. Client Personal Data may be transferred internationally. UserSound implements appropriate safeguards for such transfers in accordance with Section 10 of this DPA.

GitHub (source code), PostHog (product analytics without Client Personal Data), and Sentry (application error monitoring) are not Sub-processors of Client Personal Data under this DPA when configured not to receive survey Content.

Annex C — Technical & Organisational Measures

• Encryption in transit (TLS/HTTPS) for Platform and third-party API connections
• Encryption at rest (AES-256) for database, object storage, and managed backups
• Multi-tenant isolation and role-based access controls at the application layer
• Least-privilege access to production systems; elevated access authorised and logged
• Secrets and credentials managed via environment configuration (not committed to source control)
• Automated encrypted database backups with limited retention
• Application error monitoring and documented incident response procedures
• Peer review of code changes before merge to production

This DPA is provided for Clients of USERSOUND LTD. It is not legal advice. For enterprise negotiations, contact [email protected].