Privacy policy

1. Scope, status, and relationship with other terms

1.1. Purpose

This DPA sets out the parties’ data protection rights and obligations for Customer Personal Data processed by Onefind in connection with the Service, including AI visibility analysis, brand interpretation, signal gap detection, prompt testing, sentiment and market intelligence, competitive intelligence, content intelligence, content optimisation, SEO and AI growth analysis, reporting, support, security, and related operational activities.

1.2. Online status

This DPA is an online legal schedule. The Customer accepts it by creating an Account, ticking or clicking an acceptance box, starting a Free Trial, purchasing or renewing a subscription, using the Service, accepting an Order Form, or otherwise accessing the Service on behalf of a business or organisation.

1.3. Parties

This DPA is entered into between ONEFIND LTD, a company incorporated in England and Wales with company number 14318542 and registered office at 124 City Road, London, England, EC1V 2NX (Onefind), and the Customer that accepts the Onefind Online Legal Terms or is identified in the relevant Order Form, Online Checkout, Account, invoice, or subscription record.

1.4. Roles

To the extent Onefind processes Customer Personal Data on behalf of the Customer, the Customer acts as controller and Onefind acts as processor. If the Customer is itself a processor acting on behalf of a third-party controller, then Onefind acts as subprocessor and the Customer must ensure that it has all controller authorisations required to appoint Onefind and to instruct the processing described in this DPA.

1.5. Independent controller processing

Onefind may act as an independent controller for personal data processed for account administration, billing administration, direct business communications, fraud prevention, legal compliance, internal analytics, security monitoring, product governance, and corporate administration. This DPA does not apply to such independent-controller processing.

1.6. Other Onefind documents

This DPA should be read with the Master Services Agreement, Sales Terms and Conditions, Service Level Agreement and Security Overview, Support Schedule, Privacy Policy, and any applicable Order Form. This DPA does not amend those documents except for data protection matters expressly governed by this DPA.

1.7. Priority

If there is a conflict between this DPA and another Onefind legal document, this DPA prevails only for the processing of Customer Personal Data and only to the extent of the conflict. The Master Services Agreement and Sales Terms continue to govern commercial terms, access, fees, suspension, warranties, indemnities, and general liability, except where mandatory data protection law requires otherwise.

1.8. Effective date and duration

This DPA becomes effective on the earliest date on which the Customer accepts the Onefind Online Legal Terms, creates an Account, starts a Free Trial, activates or renews a subscription, accepts an Order Form, or first uses the Service. It remains in force while Onefind processes Customer Personal Data for the Customer and for any retention, deletion, backup, audit, dispute, or legal-compliance period permitted by this DPA.

1.9. Business use only

The Service is supplied for business and professional use. The person accepting this DPA represents that they have authority to bind the Customer, including any agency client or end customer on whose behalf Customer Personal Data is submitted or processed.

2. Definitions and interpretation

2.1. MSA definitions

Capitalised terms used but not defined in this DPA have the meaning given to them in the Master Services Agreement, Sales Terms, applicable Order Form, or Online Checkout record.

2.2. Data protection terms

Controller, processor, subprocessor, data subject, personal data, processing, supervisory authority, personal data breach, special category data, and criminal offence data have the meanings given to them in Applicable Data Protection Laws.

2.3. Applicable Data Protection Laws means

to the extent applicable to the relevant processing, the UK Data Protection Laws, the EU Data Protection Laws, and any other data protection, privacy, ePrivacy, electronic communications, direct marketing, data breach notification, or cybersecurity law that applies to the processing of Customer Personal Data under this DPA

2.4. Customer Personal Data means

Personal Data contained in Customer Data and processed by Onefind as processor or subprocessor on behalf of the Customer in connection with the Service

2.5. EU Data Protection Laws means

Regulation (EU) 2016/679 (EU GDPR), the ePrivacy Directive and national implementing laws, and other data protection laws of the European Union or European Economic Area that apply to the processing of Customer Personal Data

2.6. UK Data Protection Laws means

the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003, and other United Kingdom data protection, privacy, electronic communications, data breach notification, and cybersecurity laws applicable to the processing of Customer Personal Data

2.7. UK GDPR has the meaning

given in section 3(10), as supplemented by section 205(4), of the Data Protection Act 2018

2.8. Restricted Transfer means

a transfer of Customer Personal Data to a country, territory, or recipient that requires an adequacy decision, adequacy regulation, recognised safeguard, approved contractual clauses, IDTA, UK Addendum, or other lawful transfer mechanism under Applicable Data Protection Laws

2.9. SCCs means

the European Commission standard contractual clauses for international transfers of personal data adopted under the EU GDPR, as amended, replaced, or superseded from time to time

2.10. UK Addendum means

the International Data Transfer Addendum to the EU Commission standard contractual clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as amended, replaced, or superseded from time to time

2.11. IDTA means

the International Data Transfer Agreement issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as amended, replaced, or superseded from time to time

2.12. Security Incident means

an event affecting the confidentiality, integrity, or availability of the Service or Customer Data. A Security Incident is a Personal Data Breach only where it meets the definition of personal data breach under Applicable Data Protection Laws.

2.13. Subprocessor means

a third party engaged by Onefind or another Subprocessor to process Customer Personal Data on behalf of the Customer for the purpose of providing, supporting, securing, maintaining, or improving the Service in accordance with this DPA

2.14. Interpretation

References to legislation include amendments, re-enactments, replacements, and subordinate legislation. The words include, including, and in particular are illustrative and do not limit the general wording.

3. Processing details, documented instructions, and scope

3.1. Processing schedule

The subject matter, duration, nature and purpose of processing, types of Customer Personal Data, categories of Data Subjects, and permitted processing activities are described in Annex 1. Annex 1 forms part of this DPA.

3.2. Documented instructions

The Customer instructs Onefind to process Customer Personal Data as reasonably necessary to provide, secure, maintain, support, troubleshoot, monitor, improve, and administer the Service, and as otherwise described in the Master Services Agreement, this DPA, the Order Form, Online Checkout, Customer Account settings, Customer support requests, Customer configuration choices, and lawful written instructions accepted by Onefind.

3.3. Processing only on instructions

Onefind shall process Customer Personal Data only on documented instructions from the Customer, including with respect to Restricted Transfers, unless Onefind is required to process Customer Personal Data by applicable law. If legally permitted, Onefind shall inform the Customer of that legal requirement before processing.

3.4. Scope of instructions

Customer instructions must be lawful, technically feasible, consistent with the Service, and within the scope of the subscription and Documentation. Onefind is not required to follow an instruction that would require Onefind to modify the Service, violate law, compromise security, expose another customer’s data, breach a third-party obligation, or materially increase risk or cost unless agreed in an Order Form.

3.5. Unlawful instructions

If Onefind reasonably believes an instruction infringes Applicable Data Protection Laws, Onefind shall inform the Customer unless prohibited by law. Onefind may suspend performance of the affected instruction while the issue is clarified.

3.6. Product operation and improvement

The Customer instructs Onefind to process Customer Personal Data to operate, maintain, debug, secure, monitor, and improve the functionality, reliability, performance, and safety of the Service for the Customer. Where Onefind uses telemetry, analytics, benchmarking, or aggregated insights for broader product improvement, Onefind shall use Customer Personal Data only in aggregated, anonymised, de-identified, or otherwise non-personal form unless another lawful role and notice applies.

3.7. AI providers and model training

The Customer acknowledges that the Service may require prompts, website content, URLs, business descriptions, public-source data, reports, or other Customer Data to be submitted to or processed through third-party AI Platforms, model providers, search providers, browser automation providers, or similar Subprocessors. Onefind will not use Customer Personal Data to train third-party foundation models or general-purpose AI models except where expressly agreed in an Order Form or where the Customer intentionally enables a feature or integration that requires such use. Where available, Onefind will use contractual or technical controls designed to restrict third-party provider use of Customer Personal Data to providing the relevant service.

3.8. Public and third-party source data

The Service may process publicly available website content, search results, public reviews, public social content, competitor references, and other externally available information. To the extent such information contains Personal Data and is processed on the Customer’s instructions, the Customer is responsible for ensuring that the collection, submission, monitoring, comparison, and analysis of that information has a lawful basis and complies with Applicable Data Protection Laws.

3.9. No sale of Customer Personal Data

Onefind shall not sell Customer Personal Data or disclose it for cross-context behavioural advertising except as expressly instructed by the Customer or as permitted by Applicable Data Protection Laws for a processor.

4. Customer obligations

4.1. Controller responsibility

The Customer is responsible for determining the purposes and means of processing Customer Personal Data, for the lawfulness of its instructions, and for compliance with Applicable Data Protection Laws in relation to Customer Personal Data.

4.2. Lawful basis, notices, and rights

The Customer shall ensure that it has all lawful bases, notices, transparency information, consents, authorisations, permissions, legitimate interest assessments, data protection impact assessments, and contractual rights needed for Onefind and its Subprocessors to process Customer Personal Data as described in this DPA.

4.3. Accuracy and minimisation

The Customer is responsible for the accuracy, quality, relevance, and legality of Customer Personal Data and must ensure that Customer Personal Data submitted to the Service is adequate, relevant, and limited to what is necessary for the Customer’s use of the Service.

4.4. Restricted data

The Service is not designed to process special category data, criminal offence data, children’s data, government identifiers, payment card data, bank account data, health data, biometric data, genetic data, precise location data, or other highly sensitive Personal Data unless an Order Form or written addendum expressly permits that processing and identifies any additional safeguards. The Customer must not submit such data to the Service without Onefind’s prior written agreement.

4.5. Prompts and content

The Customer must ensure that prompts, URLs, website content, brand materials, product information, competitor lists, business categories, reviews, uploaded files, support tickets, and other inputs do not contain unnecessary Personal Data or prohibited sensitive data.

4.6. Customer systems and access controls

The Customer is responsible for user administration, role assignments, authentication, device security, password management, endpoint security, secure configuration of integrations, and preventing unauthorised access through Customer systems or credentials.

4.7. Agency and multi-client use

If the Customer is an agency, consultant, reseller, or other multi-client operator, the Customer remains responsible for its clients, end customers, and users. The Customer must have authority to submit client domains, client content, client prompts, and client Personal Data to the Service, and must provide any required notices to those clients or their Data Subjects.

4.8. High-risk use

The Customer must not use the Service or Outputs to make or support legal, employment, credit, insurance, housing, education, health, criminal justice, biometric identification, migration, or other legally significant decisions about individuals unless expressly agreed in writing and supported by a separate compliance assessment.

4.9. Customer breach notification

The Customer shall promptly notify Onefind if the Customer becomes aware that Customer Personal Data submitted to the Service is unlawful, inaccurate in a material way, excessive, subject to a Data Subject objection or restriction that affects the Service, or otherwise should not be processed by Onefind.

5. Onefind processor obligations

5.1. Article 28 obligations

Onefind shall process Customer Personal Data in accordance with this DPA and shall comply with the processor obligations that apply to Onefind under Applicable Data Protection Laws.

5.2. Confidentiality

Onefind shall ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations, whether contractual, statutory, or professional.

5.3. Personnel access

Onefind shall take reasonable steps to limit access to Customer Personal Data to personnel, contractors, and Subprocessors who require access for the purposes described in this DPA and who are subject to appropriate confidentiality and security obligations.

5.4. Security

Onefind shall implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure, taking into account the state of the art, implementation costs, nature, scope, context, and purposes of processing, and the risk to Data Subjects.

5.5. Records

To the extent required by Applicable Data Protection Laws, Onefind shall maintain records of processing activities carried out on behalf of Customers and shall make relevant information available to the Customer as reasonably required to demonstrate compliance with this DPA.

5.6. Assistance

Onefind shall provide reasonable assistance to the Customer with the Customer’s obligations under Applicable Data Protection Laws, taking into account the nature of the processing and the information available to Onefind. Assistance outside standard product functionality may be subject to reasonable fees unless caused by Onefind’s breach of this DPA.

5.7. Legal requests

Unless prohibited by law, Onefind shall notify the Customer if Onefind receives a legally binding request from a public authority requiring disclosure of Customer Personal Data. Onefind shall disclose only the Customer Personal Data it is legally required to disclose.

5.8. Compliance with Customer instructions after termination

Following expiry or termination of the Customer subscription, Onefind shall process retained Customer Personal Data only as necessary for export, deletion, backup rotation, legal retention, dispute handling, security, audit, or compliance purposes, and otherwise as instructed by the Customer in accordance with this DPA.

6. Security measures

6.1. Technical and organisational measures

The technical and organisational measures in Annex 2 apply to the processing of Customer Personal Data. They are designed to provide a level of security appropriate to the risk of the processing described in Annex 1.

6.2. Relationship with Security Overview

The Service Level Agreement and Security Overview may describe broader operational, availability, and security commitments for the Service. This DPA governs security measures required for Customer Personal Data. If there is a conflict on personal-data security, this DPA prevails to the extent of the conflict.

6.3. Evolution of measures

Onefind may update or replace security measures from time to time, provided that such updates do not materially reduce the overall level of protection for Customer Personal Data during the active Subscription Term.

6.4. Customer security responsibilities

The Customer remains responsible for the security of its own systems, devices, users, credentials, integrations, networks, and configuration decisions. Security incidents caused by Customer systems, credentials, instructions, misconfiguration, or unauthorised users are not Onefind Personal Data Breaches unless caused by Onefind’s breach of this DPA.

6.5. Security testing

The Customer must not perform penetration testing, vulnerability scanning, load testing, scraping, automated stress testing, or similar testing against the Service without Onefind’s prior written approval and agreed testing conditions.

6.6. No certification warranty

Unless expressly stated in an Order Form, Onefind does not represent that the Service is certified under ISO 27001, SOC 2, Cyber Essentials, or any similar certification. If Onefind later obtains a certification, the certification applies only to the audited scope and period.

7. Subprocessors

7.1. General authorisation

The Customer gives Onefind general written authorisation to engage Subprocessors for the purposes described in this DPA.

7.2. Subprocessor categories

The categories of Subprocessors authorised as of the date of this DPA are described in Annex 3. Onefind may also publish, make available in the Account, or provide on request a list of specific Subprocessors and their processing locations where commercially practicable.

7.3. Flow-down terms

Onefind shall enter into written terms with each Subprocessor that impose data protection obligations materially equivalent to those imposed on Onefind under this DPA, to the extent applicable to the Subprocessor’s processing activities.

7.4. New or replacement Subprocessors

Onefind may add or replace Subprocessors by giving notice through the Account, website legal page, email, product notice, or other reasonable electronic method. Where required by Applicable Data Protection Laws, Onefind shall provide the Customer with a reasonable opportunity to object to the intended change.

7.5. Objection process

If the Customer reasonably objects to a new or replacement Subprocessor on data protection grounds, the Customer must notify Onefind within ten calendar days after notice of the change. Onefind may use reasonable efforts to address the objection, provide additional information, avoid use of the Subprocessor for the Customer where technically and commercially feasible, or allow the Customer to terminate the affected Service for a pro-rata refund of prepaid unused fees for the affected period. Termination is the Customer’s exclusive remedy where Onefind cannot reasonably accommodate the objection.

7.6. Emergency changes

Onefind may replace or add a Subprocessor without prior notice where reasonably necessary to address security, availability, legal, business-continuity, provider failure, or third-party platform issues. Onefind shall give notice as soon as reasonably practicable after the change if notice is required by Applicable Data Protection Laws.

7.7. Responsibility

Onefind remains responsible to the Customer for the performance of its Subprocessors’ obligations to the extent required by Applicable Data Protection Laws and subject to the liability terms in the Master Services Agreement.

7.8. AI Platform Subprocessors

The Customer acknowledges that third-party AI Platforms, model providers, search providers, browser automation providers, and related infrastructure providers may be required to provide prompt testing, AI visibility analysis, model comparison, citation analysis, content optimisation, and reporting features. Such providers are Subprocessors where they process Customer Personal Data on behalf of Onefind.

8. International transfers

8.1. Transfer authorisation

The Customer authorises Onefind and its Subprocessors to process Customer Personal Data in the United Kingdom, European Economic Area, and any other location reasonably necessary to provide, secure, maintain, support, and improve the Service, subject to this section 8 and Applicable Data Protection Laws.

8.2. Adequacy

Where a transfer is covered by an adequacy decision, adequacy regulation, data bridge, or equivalent recognised lawful transfer mechanism, the parties may rely on that mechanism for the transfer for as long as it remains valid.

8.3. EEA to UK transfers

Where Customer Personal Data is transferred from the EEA to the United Kingdom and a valid EU adequacy decision for the United Kingdom applies, no additional transfer safeguard is required for that transfer. If that adequacy decision ceases to apply or does not cover the transfer, the SCCs shall apply as described in Annex 4 unless the parties agree another lawful transfer mechanism.

8.4. UK restricted transfers

For Restricted Transfers from the United Kingdom to a country or recipient not covered by UK adequacy regulations or another permitted UK transfer mechanism, the UK Addendum together with the SCCs, or the IDTA where selected by Onefind, shall apply as described in Annex 4 unless the parties agree another lawful transfer mechanism.

8.5. Swiss transfers

Where Swiss data protection law applies and a Restricted Transfer from Switzerland requires safeguards, the SCCs shall apply with modifications required by the Swiss Federal Act on Data Protection and any competent Swiss authority guidance, unless another lawful mechanism applies.

8.6. Onward transfers

Onefind shall ensure that onward transfers by Onefind or its Subprocessors are made in accordance with Applicable Data Protection Laws and an applicable adequacy mechanism, SCCs, UK Addendum, IDTA, or other lawful transfer mechanism.

8.7. Supplementary measures and assessments

Where required by Applicable Data Protection Laws, Onefind shall implement reasonable supplementary measures and provide reasonable information available to Onefind to assist the Customer with transfer impact assessments. Onefind is not required to provide legally privileged, security-sensitive, or third-party confidential information.

8.8. Changes in transfer law

If a transfer mechanism is invalidated, amended, replaced, or becomes insufficient, Onefind may implement an alternative lawful transfer mechanism. If no lawful mechanism is reasonably available, Onefind may suspend the affected processing or terminate the affected Service to the extent necessary to comply with Applicable Data Protection Laws.

8.9. Conflict with transfer clauses

If there is a conflict between this DPA and the SCCs, UK Addendum, or IDTA as applicable, the relevant transfer clauses prevail for the Restricted Transfer to the extent of the conflict.

9. Assistance to the Customer

9.1. Data Subject Requests

Taking into account the nature of the processing and the information available to Onefind, Onefind shall provide reasonable assistance to the Customer in responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Laws.

9.2. Requests received by Onefind

If Onefind receives a Data Subject Request relating to Customer Personal Data, Onefind shall, where reasonably identifiable and legally permitted, notify the Customer or direct the Data Subject to contact the Customer. Onefind shall not respond substantively to the request except on the Customer’s documented instructions or where required by law.

9.3. Product functionality

Where the Service provides export, deletion, access control, correction, or configuration tools, the Customer should use those tools as the primary means of responding to Data Subject Requests.

9.4. DPIAs and consultation

Onefind shall provide reasonable information available to Onefind to assist the Customer with data protection impact assessments and prior consultation with a Supervisory Authority where required by Applicable Data Protection Laws and where the assistance relates to Onefind’s processing of Customer Personal Data.

9.5. Security and breach assistance

Onefind shall provide reasonable assistance to the Customer with the Customer’s obligations under Articles 32 to 36 of the UK GDPR or EU GDPR, as applicable, taking into account the nature of processing and information available to Onefind.

9.6. Costs

Assistance that is outside standard Service functionality, requires custom engineering, extensive manual review, legal analysis, onsite support, bespoke documentation, or support for matters not caused by Onefind may be subject to reasonable fees and conditions.

10. Personal Data Breach and Security Incident handling

10.1. Notification

Onefind shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and, where reasonably practicable, within 72 hours after confirming that a Personal Data Breach has occurred.

10.2. Awareness and investigation

Onefind is aware of a Personal Data Breach when Onefind has a reasonable degree of certainty that a security event has led to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data. Suspected events, unsuccessful attempts, routine alerts, spam, phishing attempts, and events that do not affect Customer Personal Data are not Personal Data Breaches for purposes of this DPA.

10.3. Content of notice

To the extent information is available to Onefind, the notice shall describe the nature of the Personal Data Breach, categories and approximate volume of affected Customer Personal Data and Data Subjects where known, likely consequences where known, measures taken or proposed to address the Personal Data Breach, and a contact point for follow-up.

10.4. Updates

Onefind may provide information in phases as the investigation progresses. The Customer acknowledges that early information may be incomplete or subject to change.

10.5. Mitigation

Onefind shall take reasonable steps to investigate, contain, mitigate, and remediate a Personal Data Breach affecting Customer Personal Data within Onefind’s control.

10.6. Customer notification duties

The Customer is responsible for determining whether to notify Data Subjects, Supervisory Authorities, customers, clients, regulators, or other third parties. Onefind shall not make such notifications on the Customer’s behalf unless required by law or agreed in writing.

10.7. No admission

A Personal Data Breach notification or communication by Onefind is not an acknowledgement of fault, liability, breach of contract, or breach of law.

10.8. Customer-caused events

Onefind is not responsible for Personal Data Breaches caused by Customer systems, Customer credentials, Customer instructions, unauthorised Customer users, compromised Customer devices, Customer misconfiguration, or Customer failure to comply with the Master Services Agreement, this DPA, Documentation, or reasonable security instructions.

11. Return, deletion, retention, and anonymisation

11.1. Export

During the Subscription Term and for a reasonable period after termination where commercially practicable, Onefind may make Customer Personal Data available for export through the Service or by another reasonable method selected by Onefind.

11.2. Deletion after termination

Following termination or expiry of the applicable subscription, Onefind shall delete, return, or anonymise Customer Personal Data in accordance with the Customer’s documented instructions, the Service functionality, and this DPA, unless retention is required or permitted by law.

11.3. Default deletion

Unless the Customer gives a different lawful instruction accepted by Onefind, Onefind may delete or anonymise Customer Personal Data from active production systems after expiry of any export period and within a commercially reasonable period after termination. Backup copies may remain until overwritten or deleted in the ordinary backup cycle, provided they remain protected and are not actively processed except for restoration, security, continuity, legal, or compliance purposes.

11.4. Retained records

Onefind may retain limited records containing Personal Data where required or permitted for legal compliance, accounting, tax, audit, dispute resolution, security, fraud prevention, enforcement of the Online Legal Terms, or legitimate business administration. Such retained records are generally processed by Onefind as independent controller and are subject to the Privacy Policy where applicable.

11.5. Aggregated and anonymised data

Nothing in this DPA restricts Onefind from retaining or using aggregated, anonymised, de-identified, statistical, or non-personal data, provided it does not identify the Customer as a source of Personal Data and cannot reasonably be used to identify a Data Subject.

11.6. Deletion certification

Upon reasonable written request, Onefind may provide written confirmation that deletion or anonymisation has been completed in accordance with this section, subject to backup cycles, legal retention, and technical limitations.

12. Audit, compliance information, and security review

12.1. Compliance information

Onefind shall make available information reasonably necessary to demonstrate compliance with this DPA, taking into account the nature of the processing, the information available to Onefind, confidentiality obligations, security restrictions, and the rights of other customers and third parties.

12.2. Standard materials

Onefind may satisfy audit and compliance requests by providing standard security summaries, data protection summaries, policy extracts, third-party audit reports, certification reports, subprocessor information, questionnaires, or written responses.

12.3. Customer audits

If the information in section 12.2 is insufficient to satisfy a mandatory audit right under Applicable Data Protection Laws, the Customer may request an audit no more than once in any twelve-month period, unless a confirmed Personal Data Breach affecting Customer Personal Data or a Supervisory Authority requirement justifies an additional audit.

12.4. Audit conditions

Audits must be conducted during normal business hours, on at least thirty days’ prior written notice, by an independent qualified auditor subject to confidentiality obligations, and in a manner that does not disrupt Onefind operations, compromise security, expose other customers’ data, or require disclosure of trade secrets, privileged information, highly sensitive security information, or third-party confidential information.

12.5. Onsite audits

Onsite audits are permitted only where required by Applicable Data Protection Laws and where remote documentation, questionnaires, reports, or virtual review are insufficient. Onefind may require reasonable scope, security, confidentiality, and cost terms before any onsite audit.

12.6. Costs

The Customer is responsible for its audit costs and for Onefind’s reasonable costs of supporting audits, questionnaires, bespoke assessments, or extensive documentation requests, unless the audit is required because of Onefind’s material breach of this DPA.

12.7. No unauthorised testing

The audit right does not permit penetration testing, vulnerability scanning, social engineering, physical access testing, scraping, load testing, access to source code, access to other customer environments, or access to Onefind internal systems except as expressly agreed in writing.

13. Online updates, notices, and version control

13.1. Updates

Onefind may update this DPA from time to time by posting a revised version on the Onefind website, in the Account, or through another electronic notice method. Updates may be made to reflect legal changes, regulatory guidance, new or changed features, Subprocessors, transfer mechanisms, security controls, operational changes, or corrections.

13.2. Material adverse changes

If an update materially reduces the data protection rights of the Customer during an active paid Subscription Term, Onefind will provide reasonable notice where required by Applicable Data Protection Laws. Unless required earlier for legal, security, third-party platform, or Service integrity reasons, material adverse changes will apply from renewal or continued use after notice.

13.3. Administrative changes

Clarifications, formatting changes, corrections, non-material updates, additional explanations, and changes that improve protection or reflect legal requirements may take effect when posted.

13.4. Notices

Notices under this DPA may be provided by email to the Account Owner or billing/contact email, in-app notice, Account dashboard notice, website legal page update, support channel communication, or any other notice method permitted by the Master Services Agreement.

13.5. Records of acceptance

Onefind may maintain records of the version of this DPA accepted by the Customer, acceptance timestamp, Account identifiers, user identifiers, IP address, subscription plan, Online Checkout record, and related logs as evidence of acceptance and administration of the Online Legal Terms.

14. Liability, precedence, and general terms

14.1. Liability

The liability of each party under this DPA is governed by the Master Services Agreement and applicable Order Form. Nothing in this DPA increases or removes any liability cap, exclusion, limitation, indemnity condition, or remedy limitation in the Master Services Agreement unless mandatory Applicable Data Protection Laws require otherwise.

14.2. No separate service commitment

This DPA does not create separate uptime, support, security certification, backup, disaster recovery, or service-credit commitments. Those matters are governed by the Service Level Agreement and Security Overview, Support Schedule, Order Form, and Master Services Agreement, subject to the personal-data security obligations in this DPA.

14.3. Precedence for data protection

This DPA prevails over conflicting provisions of the Master Services Agreement, Sales Terms, Support Schedule, Service Level Agreement and Security Overview, or Order Form only for the processing of Customer Personal Data and only to the extent of the conflict.

14.4. Severability

If any provision of this DPA is invalid, unlawful, or unenforceable, the remaining provisions remain in force, and the invalid provision shall be interpreted or replaced to achieve the closest lawful effect.

14.5. Survival

This DPA survives termination or expiry of the Customer’s subscription for as long as Onefind processes Customer Personal Data on behalf of the Customer or retains Customer Personal Data under this DPA.

14.6. Governing law and jurisdiction

This DPA is governed by the law and jurisdiction specified in the Master Services Agreement, except to the extent the SCCs, UK Addendum, IDTA, or mandatory Applicable Data Protection Laws require a different governing law, forum, or supervisory authority for a Restricted Transfer.

14.7. Data protection contact

Data protection enquiries relating to this DPA may be sent to [email protected] or any privacy contact made available by Onefind in the Privacy Policy, Account, or Onefind website.

Annex 1. Processing Schedule

This Annex 1 describes the processing of Customer Personal Data for the purposes of Article 28 of the UK GDPR and EU GDPR. The details below apply unless an Order Form or written addendum accepted by Onefind provides more specific details for the relevant Customer.

Annex 2. Technical and Organisational Measures

Onefind shall maintain technical and organisational measures appropriate to the risk of processing Customer Personal Data. The controls below describe the baseline categories of measures. Specific implementation details may evolve as the Service develops, provided the overall level of protection is not materially reduced during the active Subscription Term.

Annex 3. Authorised Subprocessor Categories

The Customer authorises Onefind to use Subprocessors in the categories below where reasonably necessary to provide, secure, maintain, support, or improve the Service. Specific Subprocessor names may be made available through the Account, Onefind website, legal page, support channel, or on reasonable request where commercially practicable.

Annex 4. International Transfer Terms

This Annex 4 applies where a Restricted Transfer requires SCCs, the UK Addendum, the IDTA, or another approved contractual transfer mechanism. If a valid adequacy decision, adequacy regulation, or equivalent lawful mechanism applies to a transfer, the parties may rely on that mechanism instead.