DATA PROCESSING AGREEMENT

Version 3.0 | Last Updated 9th April 2026

Supplier (Processor)

RIVER AI & DIGITAL LIMITED, with company number: 16673730, registered address: 71-75 Shelton Street, London, WC2H 9JQ, contactable by email: notices@riverai.co.uk

Customer (Controller)

As named in the Order Form.

Each of the parties shall be referred to as a Party or together, the Parties.

Processing details are set out in Schedule 1.

Background

The Supplier provides Services to the Customer and may be required to process Customer Personal Data to fulfil the Purpose.

This Agreement sets out the terms on which the Supplier will process Customer Personal Data in accordance with Data Protection Laws.

1. Definitions and Interpretation

In this Agreement, unless the context otherwise requires, the following expressions have the following meanings:

Terms such as controller, processor, data subject, personal data, processing, and appropriate technical and organisational measures have the meanings given in Data Protection Laws.

Headings do not affect interpretation. References to legislation include amendments and replacements. “Including” shall not be limiting.

In the case of conflict or ambiguity between:

2. Data Protection Roles and Relationship

3. Data Processing Obligations

3.1 Controller instructions. The Supplier shall process Customer Personal Data only on the documented instructions of the Customer, including as necessary to provide the Services and fulfil the Purpose, unless required by applicable law. Where processing is required by law, the Supplier shall (where legally permitted) inform the Customer before processing.

3.2 Notification of unlawful instructions. The Supplier shall notify the Customer if, in its reasonable opinion, an instruction infringes Data Protection Laws.

3.3 Compliance with Customer instructions. The Supplier shall promptly comply with any reasonable written instruction from the Customer requiring the Supplier to amend, transfer, delete or otherwise process Customer Personal Data, or to stop, mitigate or remedy any unauthorised processing.

3.4 Security measures. The Supplier shall implement appropriate technical and organisational measures to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction or damage. Such measures shall include, as appropriate:

3.5 Confidentiality and personnel. The Supplier shall ensure that persons authorised to process Customer Personal Data:

3.6 Data subject requests. The Supplier shall, to the extent permitted by law:

3.7 Assistance. Taking into account the nature of the processing and information available to the Supplier, the Supplier shall provide reasonable assistance to the Customer to support compliance with Data Protection Laws in relation to:

Where assistance materially exceeds the scope of the Services, the Supplier may charge at its reasonable standard rates unless the assistance is required due to the Supplier’s breach.

4. Personal Data Breach

4.1 The Supplier shall notify the Customer without undue delay and, where feasible, within forty-eight (48) hours after becoming aware of a Personal Data Breach affecting Customer Personal Data.

4.2 Such notification shall include, to the extent available at the time of notification and supplemented as further information becomes available:

4.3 Immediately following any Personal Data Breach, the Parties shall co-ordinate with each other to investigate the matter. The Supplier shall reasonably co-operate with the Customer in the Customer’s handling of the matter.

4.4 The Supplier agrees, subject to any obligation under applicable law, that the Customer shall have the sole right to determine:

5. Sub-Processors

5.1 General authorisation. The Customer gives prior general authorisation for the Supplier to appoint Sub-Processors.

5.2 Flow-down terms. The Supplier shall ensure that Sub-Processors are engaged under written terms that impose data protection obligations materially similar to those set out in this Agreement and required by Data Protection Laws.

5.3 Responsibility. The Supplier shall remain responsible for the acts and omissions of its Sub-Processors as if they were its own.

5.4 Changes and objections. The Supplier shall inform the Customer of any intended changes concerning the addition or replacement of Sub-Processors. The Customer may object on reasonable grounds relating to data protection or security within fifteen (15) days of notice. The Parties shall work in good faith to resolve the objection.

5.5 Approved Sub-Processors. The Supplier’s Sub-Processors are set out in Schedule 2 and may be updated in accordance with clause 5.4.

6. International Transfers

the UK International Data Transfer Agreement (IDTA) and/or UK Addendum to the EU SCCs;

EU Standard Contractual Clauses (SCCs); and/or

an adequacy decision/regulation, together with supplementary measures where required.

7. Liability

7.1 Neither Party excludes or limits liability for:

7.2 Subject to clause 7.1, the Parties’ total aggregate liability arising under or in connection with this Agreement and/or Data Protection Laws shall be limited to £500,000, unless the Contract Details set a higher cap (in which case the higher cap applies).

8. Audit

8.1 The Supplier shall maintain appropriate records of processing activities carried out on behalf of the Customer as required by Data Protection Laws.

8.2 Upon written request, the Supplier shall make available to the Customer information reasonably necessary to demonstrate compliance with this Agreement.

8.3 Audit right. The Customer (or its appointed independent auditor) may conduct an audit of the Supplier’s compliance with this Agreement no more than once per year, on at least thirty (30) days’ prior written notice, during normal business hours, and in a manner that minimises disruption and does not compromise security or other customers’ confidentiality.

8.4 Breach exception. In the event of an actual or reasonably suspected Personal Data Breach affecting Customer Personal Data, the Customer may request an additional audit limited to matters relevant to that breach.

8.5 Audit method and costs. The Supplier may satisfy audit requests by providing reasonable evidence such as security attestations (e.g., Cyber Essentials), policies, questionnaires, and/or remote review before any on-site inspection. The Customer bears its audit costs. The Supplier may charge reasonable time/cost for supporting audits beyond the standard evidence package, except where the audit is required due to the Supplier’s breach.

9. Termination and Effect of Termination

9.1 This Agreement remains in effect for the Duration of Processing.

9.2 Upon termination or expiry of the Services, and at the Customer’s written direction, the Supplier shall delete (so far as technically possible) or return Customer Personal Data and any copies within sixty (60) days of termination, unless:

9.3 Customer Personal Data shall be considered deleted when it can no longer be used by the Supplier for any processing purposes and is not reasonably retrievable from live systems (excluding routine backups retained for disaster recovery, which will be overwritten in accordance with backup retention schedules).

9.4 Any provision of this Agreement that expressly or by implication should come into or continue in force on or after termination in order to protect Customer Personal Data shall remain in full force and effect.

10. Indemnity

10.1 The Supplier shall indemnify the Customer for losses, claims, damages, liabilities, fines, penalties, costs and expenses arising out of or in connection with a breach by the Supplier of its obligations under this Agreement.

10.2 For the avoidance of doubt, the liability cap in clause 7.2 applies to the indemnity in this clause 10 (to the extent permitted by law).

11. General

11.1 Costs. Each Party is responsible for its own legal and other costs in relation to the preparation and performance of this Agreement.

11.2 Survival. The Parties intend clauses 1, 6, 7, 8, 9, 10 and 11 and any clauses required for their interpretation to survive termination.

11.3 Relationship. The Parties are independent contractors and nothing creates a partnership, agency, or employment relationship.

11.4 Third Party Rights. No third party has rights under the Contracts (Rights of Third Parties) Act 1999 to enforce this Agreement.

11.5 Assignment. No Party may assign or transfer this Agreement without the other Party’s prior written consent, except as expressly permitted in the Contract Details.

11.6 Entire Agreement. This Agreement and documents referred to in it contain the whole agreement between the Parties regarding its subject matter and supersede prior understandings. Nothing limits liability for fraud.

11.7 Variation. No variation is valid unless in writing and signed by authorised signatories of both Parties.

11.8 Severability. If any provision is invalid or unenforceable, it will be modified to the minimum extent necessary to make it enforceable, and the remainder continues in effect.

11.9 Waiver. A failure or delay to exercise a right is not a waiver.

11.10 Notices. Notices must be in writing and sent to the address/email in the Contract Details. UK letters are deemed delivered three (3) business days after posting. Emails are deemed delivered the same day (or next business day if sent after 5pm or on a non-business day at the recipient’s location).

11.11 Counterparts. This Agreement may be signed in counterparts and by electronic signature.

11.12 Governing Law and Jurisdiction. This Agreement is governed by the laws of England and Wales and subject to the exclusive jurisdiction of the courts of England and Wales.

Agreement Acceptance

By signing the Order Form, the Parties agree to the terms of this Agreement with effect from the date the Order Form is signed by both Parties.

Schedule 1 — Processing Details

Schedule 2 — Approved Sub-Processors

Service Delivery Sub-Processors

Internal Business Systems

The following systems are primarily used for Supplier business administration. Where these systems process Customer business contact details (e.g., named contacts for account management, invoicing, or contractual administration), such processing is limited to what is necessary for those purposes and does not involve processing Customer content/data sets unless explicitly agreed.