Legal

Data Processing Addendum

Last updated: 29 June 2026

This Data Processing Addendum ("DPA") forms part of, and is governed by, the Terms and Conditions between you ("Customer", "Controller") and David 2 Goliath Ltd ("D2G", "Processor", "we", "us") for your use of Prime Position. It applies automatically whenever we process personal data on your behalf as a processor. You do not need to sign or request it separately; by accepting our Terms and uploading personal data into Prime Position you agree to this DPA.

It is made under Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Words defined in our Terms or in UK data protection law have the same meaning here. Where this DPA conflicts with the rest of the Terms in relation to processing of Customer personal data, this DPA prevails.

1. Roles of the Parties

For personal data you upload into Prime Position about other individuals (for example prospect, vendor, landlord or customer data), you are the Controller and we are the Processor. We process that data only to provide the service and only on your documented instructions. For your own account, billing, analytics and marketing data we act as an independent controller, as described in our Privacy Policy, and that processing is governed by the Privacy Policy rather than this DPA.

2. Details of the Processing

Item	Detail
Subject matter	Provision of the Prime Position platform and related services to you
Duration	For the term of your subscription, and until deletion or return of the data as set out below
Nature and purpose	Storage, hosting, processing and generation of content using your inputs, so we can provide the service
Categories of personal data	Any personal data you choose to enter, which may include the names, contact details and related information of prospects, customers, vendors, landlords or other contacts
Categories of data subjects	Your prospects, customers, vendors, landlords, tenants and other individuals whose data you choose to enter

Prime Position is a marketing-content tool. It is not intended for special category data or sensitive personal data, and you should not upload such data (see clause 4).

3. Our Obligations as Processor

We will:

-Process Customer personal data only on your documented instructions, including as set out in the Terms and this DPA, unless required to do otherwise by law (in which case we will inform you, unless the law prohibits this).

-Ensure that people authorised to process the data are under an appropriate duty of confidentiality.

-Implement appropriate technical and organisational security measures (see clause 5).

-Engage sub-processors only in line with clause 6.

-Taking into account the nature of processing, assist you by appropriate measures to respond to data subject rights requests.

-Assist you with security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to us.

-Delete or return Customer personal data at the end of the service, as set out in clause 8.

-Make available the information reasonably necessary to demonstrate compliance with Article 28, and allow for and contribute to audits as described in clause 9.

4. Your Obligations as Controller

You confirm that you have a lawful basis, and have provided any notices and obtained any permissions, required to upload personal data into Prime Position and to instruct us to process it. You must not upload special category data, sensitive personal data, confidential client information, health, financial or criminal-offence data, or any data you are not permitted to share. Your instructions to us must comply with UK data protection law.

5. Security Measures

We implement appropriate technical and organisational measures to protect Customer personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These include access controls and authentication, encryption of data in transit, row-level security so that accounts are isolated from one another, hosting with reputable infrastructure providers, and restricting access to those who need it. We review our measures and may update them, provided the level of protection is not reduced.

6. Sub-processors

You give general authorisation for us to engage the sub-processors listed below to help deliver the service. Each is bound by contractual obligations that are materially equivalent to those in this DPA, and we remain responsible for their processing.

Provider	Role	Purpose
Supabase	Database and cloud infrastructure	Stores account, profile and generated content
Anthropic	AI and large language models	Processes inputs to generate content outputs
Stripe	Payment processing	Handles subscription billing and card details
Resend	Email delivery	Sends account, billing and service emails
PostHog	Product analytics	Measures platform usage to improve the service
Vercel	Hosting and deployment	Serves the website and application

We will give you reasonable notice of any intended addition or replacement of a sub-processor, giving you the opportunity to object on reasonable data protection grounds. If you object and we cannot offer a reasonable alternative, you may terminate the affected part of the service.

7. International Transfers

Some sub-processors are based outside the UK, including in the United States and the European Economic Area. Where Customer personal data is transferred outside the UK, we rely on an appropriate safeguard recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, so the data continues to receive an equivalent level of protection.

8. Breach Notification, Deletion and Return

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer personal data, and provide the information reasonably available to help you meet your own notification duties.

On termination or expiry of the service, or on your earlier written request, we will delete or return Customer personal data and delete existing copies, unless we are required by law to retain it. Account content is usually deleted or anonymised within 30 days of cancellation, in line with the retention periods in our Privacy Policy. You should export any content you wish to keep before cancelling.

9. Audit and Assistance

We will make available, on reasonable written request and no more than once a year unless required by a supervisory authority, the information reasonably necessary to demonstrate our compliance with Article 28. We may satisfy audit obligations by providing relevant documentation, certifications or summaries from us or our sub-processors, where this reasonably demonstrates compliance.

10. Liability and General

The liability provisions in our Terms and Conditions apply to this DPA. This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, as set out in the Terms. If any part of this DPA is found invalid, the rest continues in force.

11. Contact

For any data protection matter, including this DPA, contact us at support@primeposition.ai, or see our contact page.