Data Processing Agreement

This Data Processing Agreement forms part of the written WAIA agreement between Nineteen Point Two and the Customer when incorporated by a Customer Order Form signed by both parties. The versions of this DPA at legal.nineteenpointtwo.com/data-processing-agreement/ and the WAIA Terms of Service at waia.co.uk/terms/ published on the date both parties sign apply. Nineteen Point Two retains archival copies with the signed Customer Order Form and makes them available on request. Later website updates do not amend the agreed versions; later amendments must be validly agreed by the parties.

It applies where Nineteen Point Two processes Customer Personal Data on behalf of the Customer in connection with WAIA.

1. Definitions

Controller, processor, data subject, personal data, processing, personal data breach and special category data have the meanings given in applicable data protection laws.

Customer Personal Data means personal data processed by Nineteen Point Two on behalf of the Customer through WAIA.

Data Protection Laws means all applicable data protection and privacy laws, including the UK GDPR, Data Protection Act 2018 and, where applicable, the EU GDPR.

Subprocessor means a third party appointed by Nineteen Point Two to process Customer Personal Data on behalf of Nineteen Point Two.

2. Roles of the parties

For Customer Personal Data processed through WAIA:

• the Customer is controller
• Nineteen Point Two is processor

The Customer determines the purposes and lawful basis for processing Customer Personal Data.

Nineteen Point Two processes Customer Personal Data only to provide, secure, support and maintain WAIA, and in accordance with the Customer’s documented instructions.

3. Processing details

The details of processing are set out in Schedule 1.

4. Customer instructions

The Customer instructs Nineteen Point Two to process Customer Personal Data as necessary to:

• provide WAIA
• create and manage user accounts
• invite learners
• assign learning
• display organisation guidance
• record progress and completion
• record guidance acknowledgements
• provide administrator reporting
• provide support
• maintain platform security and reliability
• comply with agreed contractual obligations

These instructions, the signed Customer Order Form and any further written instructions from the Customer are the documented instructions for this processing, including any international transfer. Further instructions must be consistent with the agreement and applicable law.

Nineteen Point Two will inform the Customer if it believes an instruction breaches Data Protection Laws, unless prohibited by law.

If UK or EU law to which Nineteen Point Two is subject requires it to process Customer Personal Data other than on the Customer’s instructions, it will inform the Customer before doing so unless that law prohibits notice on important grounds of public interest.

5. Customer responsibilities

The Customer is responsible for:

• complying with Data Protection Laws
• having a lawful basis for processing Customer Personal Data
• providing privacy information to learners and administrators where required
• ensuring the accuracy of Customer Personal Data
• ensuring only appropriate users are invited
• managing administrator permissions
• avoiding unnecessary special category data
• selecting and permitting workplace AI tools and deciding how WAIA records and resulting decisions are used internally
• responding to data subject requests where the Customer is controller

These responsibilities do not reduce Nineteen Point Two’s obligations as processor under this DPA or Data Protection Laws.

6. Nineteen Point Two responsibilities

Nineteen Point Two will:

• process Customer Personal Data only on documented instructions
• ensure authorised personnel are subject to confidentiality obligations
• implement technical and organisational measures appropriate under Article 32 of the applicable Data Protection Laws
• assist the Customer with data subject requests where reasonably required
• assist with security, breach notification and DPIA obligations where reasonably required
• use subprocessors only in line with this DPA
• delete or return Customer Personal Data at the Customer’s choice at the end of the service, subject to section 14
• make information available and allow audits and inspections in accordance with section 15

7. Confidentiality

Nineteen Point Two will ensure that people authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.

8. Security measures

Nineteen Point Two will implement technical and organisational measures appropriate to the risk as required by Article 32, taking account of the state of the art, implementation costs, and the nature, scope, context and purposes of the processing. The measures will address, as appropriate, confidentiality, integrity, availability and resilience; restoration of access to personal data following an incident; and regular assessment of their effectiveness.

These may include:

• role-based access controls
• authentication controls
• administrator permission controls
• supplier security controls
• database and infrastructure security measures provided by hosting and backend providers
• encryption or pseudonymisation where appropriate
• logging and monitoring
• secure development and deployment practices
• recovery arrangements appropriate to the processing risk
• operational access limitation
• incident response procedures

A more detailed security summary may be provided on request.

9. Subprocessors

The Customer gives Nineteen Point Two general written authorisation to appoint subprocessors to provide, host, maintain, secure, monitor and support WAIA.

Nineteen Point Two will:

• maintain a subprocessor list
• impose written data protection obligations on each subprocessor that provide at least the same level of protection for Customer Personal Data as this DPA, including appropriate security measures
• remain responsible to the Customer for each subprocessor’s performance of those data protection obligations
• give the Customer advance notice of intended additions or replacements through email or another agreed written method, so the Customer has a genuine opportunity to object before the change

The Customer may object before the intended appointment on reasonable data protection grounds. The parties will work in good faith to resolve the objection. If it cannot reasonably be resolved, the Customer may terminate the affected service before the new subprocessor processes its Customer Personal Data. Any refund or other commercial consequence is governed by the Customer Order Form and Terms.

10. International transfers

Nineteen Point Two and its subprocessors may process Customer Personal Data outside the UK or EEA where needed to provide WAIA.

Nineteen Point Two will make restricted transfers only on the Customer’s documented instructions and using a valid basis under applicable Data Protection Laws. Where required, this includes an adequacy decision or appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses or applicable EU standard contractual clauses, together with any required transfer assessment and supplementary measures.

11. Data subject requests

If Nineteen Point Two receives a request from a data subject relating to Customer Personal Data, it will either:

• refer the request to the Customer, where appropriate
• notify the Customer, where lawful and practical
• assist the Customer to respond, taking into account the nature of the processing

Nineteen Point Two will not respond directly to the substance of a request unless instructed by the Customer or required by law.

12. Personal data breaches

Nineteen Point Two will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.

The notice will include available information reasonably required by the Customer to assess the breach, meet notification obligations and reduce harm. Further information will be provided as it becomes available.

Nineteen Point Two’s notification of a breach is not an admission of fault or liability.

13. Assistance with DPIAs and compliance

Nineteen Point Two will provide reasonable assistance to the Customer with data protection impact assessments, prior consultation, security obligations and breach obligations where required by Data Protection Laws and where the information is available to Nineteen Point Two.

If assistance requires substantial additional work, Nineteen Point Two may charge reasonable fees unless prohibited by law or agreed otherwise.

14. Return and deletion

At the end of the service, Nineteen Point Two will, at the Customer’s choice, return or delete all Customer Personal Data and delete existing copies, unless applicable law requires storage. The Customer should give its choice and any export requirements in writing. Export and complete organisation deletion are carried out manually and validated for each request; no self-service export or automatic deletion is promised. Nineteen Point Two will tell the Customer of any legally required retention unless prohibited by law, protect retained data and limit its processing to that requirement.

Copies in backups will remain protected and unavailable for routine use until they are overwritten or deleted through normal backup retention cycles, subject to any applicable legal obligation. If a backup is restored before deletion, the Customer’s return or deletion instruction will be applied to the restored data.

15. Audit and information rights

Nineteen Point Two will make available all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, by the Customer or an auditor it appoints.

The parties will first use available reports, policies, written responses and relevant third-party assurance where these adequately demonstrate compliance. This does not prevent an audit or inspection required to exercise the Customer’s Article 28 rights.

Audits will be coordinated on reasonable notice, with appropriate confidentiality and security safeguards, and in a way that protects other customers’ data and limits avoidable service disruption. Urgent circumstances may require shorter notice. These practical arrangements do not restrict mandatory audit and inspection rights.

16. Order of precedence

If there is a conflict between this DPA and the WAIA Terms of Service or Customer Order Form about processing Customer Personal Data, this DPA takes priority, except where the parties validly agree a later amendment that expressly changes the relevant DPA provision. The Customer Order Form controls the agreed commercial particulars, including term, price, start date and optional implementation scope.

Schedule 1: Processing Details

Subject matter

Provision of WAIA, including organisational AI baselines, workplace AI learning, learner access and application evidence, management review, progress records, guidance acknowledgement, administrator reporting and customer support.

Duration

For the term of the customer agreement and any agreed retention, export, deletion, backup or legal retention period.

Nature of processing

Collection, recording, storage, hosting, organisation, structuring, retrieval, display, transmission, analysis, reporting, support, deletion and related processing required to provide WAIA.

Purpose of processing

To provide WAIA to the Customer, including:

• user authentication
• learner invitation and access
• course assignment
• learning delivery
• progress tracking
• knowledge check or assessment capture
• organisational baseline capture and review
• learner application and workflow evidence capture
• management review and validation of submitted evidence
• guidance acknowledgement
• certificate or completion evidence
• organisation administration
• support
• security
• troubleshooting
• service operation

Categories of data subjects

• Customer employees
• Customer workers
• Customer contractors
• Customer administrators
• Customer invited learners
• Customer contacts
• Support users

Categories of personal data

• name
• work email address
• organisation
• job role or access role, where provided
• user ID
• account status
• invitation status
• course assignment
• learning progress
• lesson completion data
• knowledge check or assessment responses
• organisational baseline responses and context
• application and workflow evidence, grouping, management review records and validation/context snapshots where relevant
• guidance acknowledgement records
• certificate or completion status
• administrator actions
• support messages
• technical logs
• IP address and device information where captured for security or service operation

Special category data

WAIA is not intended to process special category data. Customers must not upload special category data unless expressly agreed in writing.

Processing frequency

As needed during the term of the service, including user submissions, workflow and management review activity. This does not describe continuous monitoring of people.

Subprocessors

Current subprocessors are listed at /subprocessors/.