Data Processing Agreement

1. Status of This Document

This page describes the intended structure of a formal Data Processing Agreement between Audit-IQ and its customers. It is provided for transparency and to support early-stage procurement discussions.

• This is not a binding agreement.
• This page does not constitute legal advice.
• All sections marked [Placeholder] require legal drafting and review before they can form part of any binding instrument.
• Audit-IQ does not currently offer a signed DPA as a standard product feature. Enterprise customers may request a negotiated DPA by contacting legal@audit-iq.com.

2. Parties and Roles

In a formal DPA, the parties and their roles would be defined as follows:

Note: Audit-IQ also acts as a controller for account and billing data collected directly through the platform. See our Privacy Policy for details.

3. Subject Matter and Nature of Processing

Audit-IQ processes personal data to deliver the compliance operations platform, including:

• Storing and retrieving compliance documents and evidence uploaded by the Customer
• Extracting regulatory obligations using AI-assisted document analysis
• Providing workspace, project management, and audit period features
• Delivering platform notifications and account communications
• Operating monitoring, logging, and security functions

Processing is performed only to the extent necessary to provide the Service as described in the Terms of Service.

4. Data Categories Processed

The following categories of personal data may be processed by Audit-IQ on behalf of the Customer:

The Customer is responsible for ensuring they have the appropriate legal basis to upload and process any personal data provided to the Service.

5. Data Subject Categories

Personal data processed through the platform may relate to:

• Customer personnel:Employees, contractors, and authorised users of the Customer's Audit-IQ workspace
• Client contacts:Representatives of the Customer's own clients or regulated entities, where the Customer uses Audit-IQ to manage compliance engagements on their behalf
• Third parties named in uploaded documents: Individuals or entities referenced in compliance policies, audit reports, or evidence files uploaded by the Customer

6. Subprocessors

Audit-IQ engages third-party subprocessors to assist in delivering the Service. A current list of subprocessors, including their purpose and primary processing location, is available on the Subprocessors page.

In a binding DPA, the Customer would be notified of material subprocessor changes in advance, with a right to object subject to agreed terms.

[Placeholder: Subprocessor change notification period, objection rights, and authorisation mechanism to be defined in binding instrument — requires legal review.]

7. Security Measures

Audit-IQ implements technical and organisational measures to protect personal data. An overview of current security controls is available on our Security Overview page, including:

• AES-256 encryption at rest; TLS 1.2+ in transit
• Role-based access control and organisation-level data isolation
• Production access restricted to authorised personnel
• Continuous monitoring and incident response procedures

[Placeholder: Specific technical and organisational security measures (TOMs) to be documented in binding instrument as Annex II — requires legal review.]

8. Cross-Border Data Transfers

Some data processing occurs outside the Customer's primary jurisdiction due to the nature of our infrastructure providers. Details are available on the Data Residency page.

[Placeholder: Transfer mechanisms, adequacy decisions, contractual safeguards, and jurisdiction-specific clauses (e.g., Standard Contractual Clauses for applicable jurisdictions) to be defined in binding instrument — requires legal review. Do not assert specific regulatory compliance (GDPR, APPs) without legal sign-off.]

9. Retention and Deletion

Audit-IQ retains customer data for the duration of the subscription and as required by operational, legal, or security obligations. Customers may request deletion of workspace data subject to the terms described in our Privacy Policy.

[Placeholder: Specific retention periods, post-termination deletion timelines, return-of-data procedures, and backup purge schedules to be defined in binding instrument — requires legal review.]

10. Incident Notification

In the event of a confirmed security incident affecting Customer personal data, Audit-IQ will notify the affected Customer in accordance with applicable legal requirements and contractual obligations. Incident reports should be directed to security@audit-iq.com.

[Placeholder: Binding notification timelines, content requirements, escalation contacts, and post-incident reporting obligations to be defined in binding instrument — requires legal review. Specific regulatory timelines (e.g., 72-hour notification) must be confirmed against applicable law by legal counsel.]

11. Audit Rights

Enterprise customers may request information to support their own compliance assessments and vendor due diligence processes. Requests should be directed to legal@audit-iq.com.

[Placeholder: Scope of audit rights, notice periods, access restrictions, third-party auditor requirements, and cost allocation to be defined in binding instrument — requires legal review.]

12. Contact

For DPA enquiries, to request a reviewed draft, or to discuss data processing arrangements for enterprise procurement:

• Legal and DPA enquiries: legal@audit-iq.com
• Privacy and data subject rights: privacy@audit-iq.com
• Security incidents and vulnerability reports: security@audit-iq.com