Data Processing Agreement.

1. Acceptance and incorporation
2. 1. Definitions and roles
3. 2. Instructions and purpose
4. 3. Customer obligations
5. 4. Confidentiality and security
6. 5. Subprocessors
7. 6. International transfers
8. 7. Data subject requests and compliance assistance
9. 8. Personal data breaches
10. 9. Return, deletion and retention
11. 10. Audit and information rights
12. 11. Term and priority
13. Schedule 1 — Processing details

DRAFT FOR REVIEW | Version 1.0 | Effective date: 06/11/2026

This Data Processing Agreement forms part of the Site-Hub Customer Terms and Conditions (the “Terms”) between Site-Hub Software Limited (company number 17426488), 97 High Road, Broxbourne, Hertfordshire, EN10 7BN (“Site-Hub”, “Processor”) and the business customer identified in the applicable order or account (“Customer”, “Controller”). It applies where Site-Hub processes personal data on behalf of the Customer in providing the Service. If there is a conflict concerning processing of Customer Personal Data, this DPA takes precedence over the Terms.

Acceptance and incorporation

This Data Processing Agreement forms part of the Site-Hub Customer Terms and Conditions and applies to business customers where Site-Hub processes personal data on their behalf. By validly accepting the Site-Hub Customer Terms and Conditions, the Customer also agrees to this Data Processing Agreement. No separate handwritten or physical signature is required where the agreement has been validly accepted electronically. The person accepting on behalf of the Customer confirms that they have authority to bind the Customer. Site-Hub may retain electronic records of acceptance, including the date, time, account details and applicable document versions.

1. Definitions and roles

“Applicable Data Protection Law” means the UK GDPR, Data Protection Act 2018 and other applicable UK data protection legislation. “Customer Personal Data” means personal data processed by Site-Hub on the Customer’s behalf under the Terms. “Subprocessor” means a third party engaged by Site-Hub to process Customer Personal Data. Terms such as personal data, controller, processor and personal data breach have their meanings in Applicable Data Protection Law. The Customer determines the purposes and means of processing Customer Personal Data and is the controller (or acts on the instructions of another controller). Site-Hub acts as processor. Site-Hub is an independent controller for its own billing, commercial account management and other processing described in its privacy notice.

2. Instructions and purpose

Site-Hub will process Customer Personal Data only on documented instructions from the Customer, including the Terms, this DPA, configured features and lawful instructions communicated through the Service or support, unless law requires otherwise. If legally permitted, Site-Hub will notify the Customer before legally required processing. Processing is limited to providing, securing, supporting, maintaining and troubleshooting the Service and performing the activities described in Schedule 1. Site-Hub will promptly inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

3. Customer obligations

The Customer is responsible for lawful collection and use of Customer Personal Data; giving appropriate privacy information to staff and other data subjects; identifying a lawful basis; setting access permissions; and deciding which information to upload, including photographs, voice recordings, location records and staff certificates. The Customer will not instruct Site-Hub to process personal data unlawfully and will provide reasonable information and cooperation needed for Site-Hub to comply with this DPA.

4. Confidentiality and security

Site-Hub will ensure persons authorised to process Customer Personal Data are bound by confidentiality obligations and will implement appropriate technical and organisational measures having regard to the nature of the processing and the risks to individuals.

Measures will include, as applicable and as actually implemented: access controls and role-based permissions, customer-data segregation, secure transmission, credential management, backup and recovery procedures, logging, vulnerability management and access restriction for support personnel. Specific controls must be verified and documented in Schedule 2 before publication. Site-Hub will review security measures periodically and may update them without materially reducing overall protection.

5. Subprocessors

The Customer gives general authorisation for Site-Hub to use subprocessors for hosting, communications, AI-assisted processing, transcription and other Service functions. Site-Hub will maintain an accurate list of subprocessors and their relevant services, made available to customers on request or through a published list. Site-Hub will give advance notice of intended material additions or replacements, allowing the Customer a reasonable opportunity to object on legitimate data-protection grounds. If the parties cannot resolve an objection, the Customer may discontinue the affected Service under the Terms. Site-Hub will impose written data protection obligations on subprocessors providing protections substantially equivalent to this DPA and remains responsible to the Customer for subprocessors’ performance of their data protection obligations.

6. International transfers

Site-Hub has confirmed that customer data hosted by Createanet is hosted in the United Kingdom. This does not, by itself, establish that all subprocessors or AI/transcription services process data only in the UK. Site-Hub will not make a restricted transfer of Customer Personal Data outside the UK without an applicable lawful transfer mechanism and required safeguards, such as the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses, where appropriate. Any applicable transfer arrangements and destinations must be documented before this DPA is finalised.

7. Data subject requests and compliance assistance

Taking into account the nature of processing and information available, Site-Hub will provide reasonable assistance to enable the Customer to respond to requests to exercise data protection rights, including access, correction, erasure and portability. Site-Hub will not respond substantively to such requests relating to Customer Personal Data unless instructed or legally required. Site-Hub will provide reasonable assistance with security obligations, personal data breach notifications, data protection impact assessments and prior consultation with the ICO, taking account of the nature of processing and information available. Any additional assistance fees must be agreed in advance and must not prevent compliance with mandatory law.

8. Personal data breaches

Site-Hub will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, using the Customer’s registered administrative contact where practicable. The notification will provide available information on the incident, likely consequences and remedial steps; further information may follow as it becomes available. The Customer remains responsible for determining whether notification to the ICO or affected individuals is required, with Site-Hub providing reasonable cooperation.

9. Return, deletion and retention

Following expiry or termination of the paid subscription, Customer Personal Data will be retained for 90 days from the subscription end date, consistent with Section 12.7 of the Terms, unless applicable law requires otherwise. Subject to available export functionality, the Customer may request an export during this period by emailing info@site-hub.info. After that period, Site-Hub will delete Customer Personal Data from active systems unless retention is required by law or for legitimate legal purposes. Backup copies may remain for a limited additional period under the hosting provider’s standard backup rotation and will not be restored to active use except for necessary recovery or legal reasons; if restored, applicable deletion rules will be reapplied. The precise backup schedule, account deletion behaviour and treatment of company records when an individual deletes a standalone-app account must be verified before publication. Statutory accounting records processed by Site-Hub as an independent controller are outside these processor-deletion instructions.

10. Audit and information rights

Site-Hub will make available information reasonably necessary to demonstrate compliance with Article 28 UK GDPR and will allow and contribute to reasonable audits or inspections by the Customer or an auditor mandated by the Customer, subject to reasonable notice, confidentiality, security protections and measures to avoid exposing other customers’ information. The parties will first seek to satisfy requests through existing reports, policies and documentation where sufficient. Nothing in this clause limits mandatory rights under Applicable Data Protection Law.

11. Term and priority

This DPA begins when Site-Hub first processes Customer Personal Data on behalf of the Customer and continues until that processing ends, including any post-termination retention and deletion. The Terms govern fees, liability and general commercial matters, subject to mandatory data protection law. Nothing in this DPA excludes or restricts liability to the extent prohibited by law.

Schedule 1 — Processing details

Execution

This DPA is incorporated into the Terms when accepted by the Customer. If separate signatures are required, the parties may sign below.

For Site-Hub Software Limited: ____________________ Date: __________

For Customer: _________________________________ Date: __________