Data Processing Agreement

This Data Processing Agreement ("DPA") is between Wellence Ltd, a company registered in England and Wales (company number 15287383), 167-169 Great Portland Street, 5th Floor, London W1W 5PF ("Wellence", the processor), and the customer that uses the Wellence service ("Customer", the controller).

It forms part of the agreement under which the Customer uses Wellence (the "Agreement"), including our Terms of Use, and applies whenever Wellence processes Customer Personal Data. Where this DPA and the Agreement conflict on the protection of personal data, this DPA wins.

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation 2016/679) where it applies, and the Privacy and Electronic Communications Regulations. "Customer Personal Data" means personal data the Customer, its users or its agents put into Wellence, or that Wellence processes for the Customer in providing the service. "Controller", "processor", "data subject", "personal data breach" and "processing" have the meanings in Data Protection Law. "Subprocessor" means a third party Wellence engages to process Customer Personal Data.

The Customer is the controller and Wellence is the processor of Customer Personal Data. Wellence processes it only on the Customer's documented instructions, which are the Agreement, this DPA and the Customer's use and configuration of the service (including the agents, tools and access it sets up). Wellence will tell the Customer if it believes an instruction breaks Data Protection Law, unless the law prevents it.

The Customer is responsible for having a lawful basis for the processing, for the notices it gives its people, and for the accuracy of the data and instructions it gives.

The subject matter, nature, purpose and duration of the processing are set out in Annex 1.

Wellence ensures everyone it authorises to process Customer Personal Data is bound by confidentiality, and limits access to those who need it to provide, support or secure the service. Wellence's team doesn't browse Customer Personal Data; it looks only to fix a problem the Customer has asked for help with, or where the law requires.

Wellence implements appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the costs, and the nature, scope, context and purposes of the processing (UK GDPR Article 32). The measures are described in Annex 2. Wellence may update them, as long as the overall level of protection is not reduced.

The Customer gives general authorisation for Wellence to engage subprocessors. The current subprocessors are listed in Annex 3 and on our GDPR page.

Wellence will tell the Customer at least 30 days before adding or replacing a subprocessor, by updating that list and emailing the Customer's admins. The Customer may object on reasonable data protection grounds within that period; the parties will discuss the objection in good faith, and if it can't be resolved, the Customer may end the affected part of the service and receive a refund of any prepaid fees for it.

Wellence puts a written contract in place with each subprocessor with data protection obligations no less protective than this DPA, and remains responsible to the Customer for each subprocessor's performance.

Taking into account the nature of the processing, Wellence will help the Customer, by appropriate technical and organisational measures, to respond to requests from data subjects exercising their rights. The service lets the Customer's admins download all Customer Personal Data and delete it. If Wellence receives a request directly from a Customer's data subject, it will pass it to the Customer without undue delay and won't respond itself except on the Customer's instructions.

Wellence will give the Customer reasonable help with data protection impact assessments, prior consultations with a supervisory authority, and its security obligations, using the information available to Wellence.

Wellence will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Wellence will take reasonable steps to contain and remedy the breach and will keep the Customer updated.

The Customer can download and delete its data at any time from Settings. When the Agreement ends, Wellence deletes Customer Personal Data within 30 days, unless the law requires it to keep it. Data in backups is deleted as the backups roll off on the provider's schedule and is not restored in the meantime except to recover the service.

Wellence will make available the information reasonably needed to show it meets this DPA, including answers to the Customer's security questionnaire. Where that isn't enough, or where a supervisory authority requires it, the Customer may carry out an audit, at most once a year, on 30 days' written notice, during business hours, at its own cost, subject to confidentiality, and without access to other customers' data.

Where Customer Personal Data is transferred outside the UK or the EEA to a country without an adequacy decision, the transfer is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses and, for EU data, the EU Standard Contractual Clauses (Module 2 or 3 as appropriate), which are incorporated into this DPA by reference, or under the EU-US Data Privacy Framework and its UK Extension where the recipient is certified.

Each party's liability under this DPA is subject to the limits in the Agreement, except where Data Protection Law doesn't allow them. This DPA lasts as long as Wellence processes Customer Personal Data. It is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where the Standard Contractual Clauses require otherwise.

• Subject matter and purpose: providing the Wellence service, where the Customer's people and AI agents plan and do work, with goals, budgets, approvals and reporting; supporting the Customer; and keeping the service secure.
• Nature of processing: collection, storage, organisation, retrieval, analysis by AI models, transmission to the Customer's users and connected tools on its instructions, and deletion.
• Data subjects: the Customer's employees, contractors and other people it adds to Wellence (including guests on a task), and people mentioned in the work it puts in.
• Categories of data: names, work email addresses, roles, teams and job levels; goals, tasks, messages, files and workflows; agent outputs, ratings and feedback; usage, cost and audit records; answers to the AI diagnostic; help conversations.
• Special category data: the service isn't designed for it. Where the Customer chooses to process it (for example in some HR work), the Customer is responsible for having a lawful condition for it, and the measures in Annex 2 apply.
• Duration: the term of the Agreement and up to 30 days after, as in clause 9.

• Each customer's data is kept logically separate, and every request is checked against the signed-in person's company.
• Access inside a customer follows its teams: people see their own team and what's shared with them; admins see everything.
• Sign-in by single-use, expiring links sent to a work email, with no passwords; sessions in secure, HTTP-only cookies.
• Encryption in transit (TLS) and at rest by our hosting providers; a customer's own Anthropic key is encrypted with AES-GCM and never shown again.
• Files are stored privately and opened only through short-lived signed links.
• Agents ask a named person before anything is sent, posted or changed; changes to agents are recorded in an audit trail.
• Data sent to Anthropic's API isn't used to train its models.
• Access by Wellence staff is limited to those who need it, and only to fix a problem the customer has asked about.
• Regular review of subprocessors and of the service's security.