Data Processing Agreement

1. How this agreement works

This Data Processing Agreement (DPA) sets out how HumanGraph Ltd (HumanGraph, we) processes personal data on behalf of an iGaming operator (you) when we provide our services. It forms part of the agreement under which we provide them, such as an Evidence Pack request, a pilot agreement or an order form (the Services Agreement).

We sign it with you before any data is shared or any integration starts. The signed copy adds the details of your deployment in Annex 1 and the Sub-processors that apply to it in Annex 3.

It is written for the UK GDPR, the Data Protection Act 2018 and the EU GDPR (together, Data Protection Law). If another law applies to you, we agree any further terms that law requires.

If documents conflict, they apply in this order: any Standard Contractual Clauses or UK transfer terms that form part of this DPA, then this DPA, then the Services Agreement.

2. Definitions

Controller, processor, personal data, personal data breach, processing, data subject and supervisory authority have the meanings given in Data Protection Law. In addition:

• Operator Data: personal data you provide to us, or that we process for you, under the Services Agreement.
• Pseudonymised Data: data that can no longer be linked to a specific person without additional information that you keep separately. Pseudonymised Data is still personal data, and this DPA treats it as such.
• Sub-processor: a third party we engage that may process Operator Data.
• Services: the reads, predictions, measurement and related support we provide under the Services Agreement.

3. Roles, scope and purpose

You are the controller of Operator Data and we are your processor. Annex 1 describes the processing: its subject matter, duration, nature and purpose, the types of personal data and the categories of data subjects.

We work from pseudonymised player activity: a pseudonymous player ID, dates, bets, turnover, deposits, currency and, where you have them, acquisition source tags. The Services are not designed for special category data or for data about children.

In an on-premise deployment, Operator Data stays in your own environment. Our obligations then apply to the access you give us and to the software and guidance we provide.

4. Your responsibilities

• You have a lawful basis for the processing, and you give players the information Data Protection Law requires.
• You pseudonymise the data before it reaches us, and you keep the key that links a pseudonymous ID to a player. We never receive it.
• You do not send names, contact details, payment details, government identifiers, special category data or data about children. If any arrive by mistake, we tell you and delete them.

5. Your instructions

We process Operator Data only on your documented instructions. This DPA and the Services Agreement are your instructions at signature, and you can give further instructions in writing. If the law requires us to process Operator Data in another way, we tell you first unless that law forbids it.

We tell you promptly if we believe an instruction breaks Data Protection Law, and we may pause that processing until you confirm or change the instruction.

6. Your data stays yours

• We use Operator Data only to provide the Services to you.
• We keep Operator Data separate from other customers' data. What your players teach us is never pooled: it trains your model alone.
• We do not try to identify any player, and we do not combine Operator Data with other data to do so.
• We do not sell Operator Data, and we do not disclose it to anyone except the Sub-processors in Annex 3 or where the law requires it.
• If you leave, your data and the model trained on it are deleted, as set out in section 14.

7. Our people

Only people who need access to provide the Services can reach Operator Data. Each of them is bound by a duty of confidentiality, and is trained in handling personal data.

8. Security

We apply technical and organisational measures appropriate to the risk, as required by Article 32 of the UK GDPR and the EU GDPR. Annex 2 sets out the measures. We may update them over time, provided the overall level of protection does not fall.

9. Sub-processors

• You authorise us to use the Sub-processors listed in Annex 3 of your signed DPA.
• We give you at least 30 days' written notice before we add or replace a Sub-processor. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may end the affected Services without penalty.
• Each Sub-processor is bound by a written contract with data protection obligations no less protective than this DPA. We remain responsible to you for its performance.
• In an on-premise deployment, no Sub-processor has access to Operator Data.

10. Helping you meet your obligations

• Data subject requests: if a player contacts us directly, we pass the request to you without undue delay and do not answer it ourselves unless you instruct us to. We help you respond, taking into account that we hold only Pseudonymised Data.
• We give you the information you reasonably need for data protection impact assessments and for any prior consultation with a supervisory authority.
• We keep a record of the processing we carry out for you, as Article 30(2) requires, and make it available to a supervisory authority on request.

11. Personal data breaches

We notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Operator Data. Our notice describes, as far as we know at the time:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned
• the likely consequences
• the measures we have taken or propose to take to deal with it and to limit its effects
• the name and contact details of the person you can talk to

We send further information as we learn it, and we help you meet your own notification duties. A notice from us is not an admission of fault.

12. International transfers

HumanGraph is established in the United Kingdom. Personal data sent to us from the European Economic Area relies on the European Commission's adequacy decision for the United Kingdom. Annex 1 of your signed DPA states where Operator Data is processed: in HumanGraph's cloud, in the region named there, or on-premise in your own environment.

We do not transfer Operator Data to any other country without your written agreement. Where a transfer goes to a country without an adequacy decision, we put in place the safeguards Data Protection Law requires: the European Commission's Standard Contractual Clauses for EU data, and the UK International Data Transfer Agreement or the UK Addendum for UK data, together with any supplementary measures a transfer risk assessment calls for.

If you are licensed outside the United Kingdom and the European Economic Area, we agree with you any transfer terms your own law requires.

13. Requests from public authorities

If a public authority asks us for Operator Data, we refer it to you and tell you about the request, unless the law forbids us to. We disclose only what the law requires, and we challenge any request we consider unlawful.

14. Return and deletion

• Raw files you send are deleted automatically 30 days after they arrive.
• Validated facts, prediction snapshots and the record of which players were acted on are kept, in your own encrypted workspace, only for the measurement horizon plus the reconciliation period agreed with you.
• You can ask us to delete Operator Data at any time, during a pilot or after it.
• When the Services end, or when you ask, we delete all Operator Data, and the model trained on it, within 30 days, and confirm the deletion in writing. Copies held in backups are deleted as those backups expire, and are kept secure and unused until then.
• We keep Operator Data longer only where the law requires it, and then only for as long as it requires.

15. Information and audits

We answer your security and data protection questions and give you the documents you reasonably need to show that we comply with this DPA. If that is not enough, you, or an independent auditor you appoint who is bound by confidentiality, may audit our compliance once a year on at least 30 days' written notice, during business hours and in a way that does not disrupt our other customers or put their data at risk. You may also audit after a personal data breach or where a supervisory authority requires it. Each party bears its own costs unless the audit finds a material breach by us.

16. Liability

Each party's liability under this DPA is subject to the limits in the Services Agreement. Nothing in this DPA limits any liability that cannot be limited under the law, or any right a data subject has directly under Data Protection Law.

17. Term and changes

This DPA applies for as long as we process Operator Data, and the obligations on deletion and confidentiality continue until that data has been deleted.

We may update this standard version from time to time and will date each version. A DPA you have signed changes only by written agreement between us, or where a change in Data Protection Law requires it, in which case we agree the change with you in good faith.

18. Governing law

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, except where Standard Contractual Clauses or the UK International Data Transfer Agreement require another law or forum for the matters they cover.

Annex 1. Description of the processing

Subject matter

Predictive reads for the operator's teams: player value, VIP potential and churn onset, measured against a held-back group of the operator's own players.

Duration

For the term of the Services Agreement, and until deletion under section 14.

Nature of processing

Receiving pseudonymised player activity by file or connection, validating it, training a model for the operator alone, producing predictions and measurement, and returning them to the operator.

Purpose

To tell the operator's CRM, VIP and acquisition teams which players to act on, and when, and to measure the result against a held-back group.

Data subjects

Players registered with the operator, identified only by a pseudonymous ID.

Personal data

Pseudonymous player ID, dates, number of bets, turnover, number of deposits, total deposited, currency and, where provided, acquisition source tags. No names, contact details, payment details or government identifiers.

Special category data

None.

Where it is processed

In HumanGraph's cloud, in the region stated in the signed copy, or on-premise in the operator's own environment.

Retention

As set out in section 14.

Annex 2. Technical and organisational measures

Annex 3. Sub-processors

The Sub-processors that apply to your deployment are listed in your signed DPA, and we send the current list on request. In an on-premise deployment there are none.