Data Processing Agreement

1. Definitions

"Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Supervisory Authority", and "Special Category Data" have the meanings given in UK GDPR. "Services" means the MetricOra platform and related services described in the Terms of Service. "Sub-processor" means any third party engaged by MetricOra to process Personal Data on the Controller's behalf.

2. Scope and Role of the Parties

The Controller determines the purposes and means of Processing Personal Data. MetricOra acts as Processor and Processes Personal Data solely on the Controller's documented instructions, including those set out in this DPA and the Terms of Service, except where required to do so by UK law, in which case MetricOra will inform the Controller before Processing unless prohibited by law.

3. Details of Processing

• Subject matter: Provision of the MetricOra GHG emissions tracking platform.
• Duration: For the term of the subscription and as required for legal compliance thereafter.
• Nature and purpose: Hosting, storing, and processing environmental and business data submitted by the Controller to generate calculations, reports, and analytics.
• Types of Personal Data: Names, email addresses, job titles, device identifiers, IP addresses, and any Personal Data contained in documents uploaded by the Controller.
• Categories of Data Subjects: The Controller's employees, contractors, field workers, and authorised users of the Service.

4. Processor Obligations

MetricOra will:

• Process Personal Data only on the Controller's documented instructions.
• Ensure that persons authorised to process Personal Data are bound by confidentiality obligations.
• Implement appropriate technical and organisational measures as described in clause 5.
• Assist the Controller in fulfilling its obligations to respond to Data Subject requests.
• Assist the Controller with Data Protection Impact Assessments where required.
• Delete or return all Personal Data to the Controller upon termination of the Services, at the Controller's choice, unless retention is required by applicable law.
• Make available all information necessary to demonstrate compliance with this DPA and allow for audits by the Controller or a mandated auditor, subject to reasonable notice and confidentiality obligations.

5. Security Measures

MetricOra implements and maintains appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include, at minimum:

• Encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256).
• Pseudonymisation where appropriate.
• Regular testing and evaluation of the effectiveness of security measures.
• Role-based access controls limiting access to Personal Data to authorised personnel only.
• Audit logging of access to and modifications of Personal Data.

6. Sub-processors

The Controller grants MetricOra general written authorisation to engage Sub-processors. MetricOra will: (a) impose equivalent data protection obligations on each Sub-processor; (b) notify the Controller of any intended changes to Sub-processors, giving the Controller an opportunity to object. Current Sub-processors include:

• Supabase Inc. (PostgreSQL database hosting and file storage) - USA/EU
• Resend, Inc. (transactional email delivery) - USA
• Google LLC (Firebase Cloud Messaging for push notifications) - USA
• Vercel, Inc. (application hosting) - USA
• Functional Software, Inc. (Sentry) (error monitoring) - EU
• Stripe Payments Europe, Ltd. (subscription billing) - EU/USA
• Groq, Inc. (AI-assisted wording, only when the Controller turns AI assistance on) - USA
• Mistral AI SAS (AI-assisted wording, fallback, only when AI assistance is on) - EU

Where Sub-processors are located outside the UK, MetricOra ensures appropriate safeguards are in place, including reliance on the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses.

7. Data Subject Rights

MetricOra will, to the extent legally permitted, promptly notify the Controller of any Data Subject request received directly and will not respond to such requests without the Controller's prior written consent, except to confirm that such request relates to the Controller. MetricOra will provide reasonable assistance to the Controller to fulfil its obligations in relation to Data Subject rights.

8. Personal Data Breach

MetricOra will notify the Controller without undue delay, and no later than 72 hours, after becoming aware of a Personal Data Breach affecting the Controller's data. The notification will include, where possible, the categories and approximate number of Data Subjects concerned, a description of the likely consequences, and measures taken or proposed to address the breach.

9. Deletion and Return of Data

Upon termination or expiry of the Services, MetricOra will, at the Controller's choice, delete or return all Personal Data and delete existing copies, unless UK law requires storage. The Controller may request deletion at any time during the subscription term via the account settings or by contacting privacy@metricora.co.uk.

10. Governing Law

This DPA is governed by the laws of England and Wales. Any disputes arising out of or in connection with this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

11. Contact

MetricOra Ltd is the data controller for its own business operations and data processor for Customer data. For data protection enquiries, contact our Data Protection Officer at privacy@metricora.co.uk. Registered office: England and Wales.