1. Roles and definitions

“Customer Personal Data” means personal data that the Customer controls and Morrow processes on its behalf to administer the Customer's workspace, memberships and learner reporting. For that processing, the Customer is controller and Morrow is processor. “Data Protection Law” means the UK GDPR, Data Protection Act 2018 and applicable amendments.

Morrow is not always a processor. Morrow acts as an independent controller for processing where it determines the purposes and essential means, including creating and securing individual Morrow accounts, applying age-appropriate platform access, maintaining platform integrity and legal records, handling support and privacy requests, preventing abuse, and administering Morrow's own billing and contractual obligations. That processing is governed by Morrow's Privacy Notice.

2. Processing details

3. Customer instructions

Morrow will process Customer Personal Data only on documented instructions from the Customer, including the agreement and actions taken by authorised managers through workspace controls, unless UK law requires other processing. If legally permitted, Morrow will inform the Customer before processing required by law. Morrow will promptly tell the Customer if it considers an instruction to infringe Data Protection Law and may pause that instruction while the parties address it.

The Customer is responsible for the lawfulness, fairness and accuracy of its instructions; its authority to provide personal data; its privacy notices and lawful basis; responding as controller to data subjects; and not instructing Morrow to process special-category or criminal-offence data unless expressly agreed in writing with appropriate safeguards.

4. Confidentiality and personnel

Morrow will ensure that people authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality, receive access only where needed for their responsibilities and process it only under the Customer's documented instructions except where law requires otherwise.

5. Security

Taking account of the nature of the processing, available technology, implementation costs and relevant risks, Morrow will maintain appropriate technical and organisational measures. Current measures include encrypted network connections; Supabase authentication and row-level database access rules; server-side service credentials kept out of browser code; role-based organisation management; restricted administrative access; hashed invitation codes; separation of organisation reports from Money-tool information; and service logging and monitoring used to operate and protect the platform.

These measures may evolve as technology and risk change. They describe the present architecture and are not a certification, warranty of absolute security or service-level guarantee.

6. Subprocessors

The Customer gives general written authorisation for Morrow to use the subprocessors below where they process Customer Personal Data. Morrow remains responsible for imposing data-protection obligations appropriate to the processing. Morrow will provide reasonable advance notice of a new or replacement subprocessor where practicable, normally by email or an update to this DPA, so the Customer can raise a reasonable data-protection objection.

Stripe processes organisation billing information where Stripe billing is used. It is not used to provide learner-progress reports and may act as an independent controller for parts of its payment, fraud-prevention and legal processing.

The legal role of an AI provider depends on the applicable account configuration and contractual terms. Morrow will confirm the relevant role and safeguards before enabling AI feedback for a Customer programme and will not describe a provider as a subprocessor where it instead acts as an independent controller. Morrow's request is configured not to store retrievable Responses API application state. OpenAI's published documentation nevertheless describes default abuse-monitoring retention of up to 30 days and separately approved Modified Abuse Monitoring and Zero Data Retention controls. This DPA does not promise zero provider retention or a particular data location unless the Customer's accepted agreement and Morrow's verified provider configuration expressly support that promise.

7. Data-subject requests

Taking account of the nature of the processing, Morrow will provide reasonable technical and organisational assistance to help the Customer respond to requests under Chapter III of the UK GDPR. If Morrow receives a request relating principally to Customer Personal Data, it will notify the Customer without undue delay and will not respond on the Customer's behalf unless instructed or legally required. Morrow may respond separately for information it controls independently.

8. Breaches, DPIAs and regulatory assistance

Morrow will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data and will provide information reasonably available to help the Customer meet its notification obligations. Notice is not an admission of fault or liability.

Taking account of the processing and information available to Morrow, Morrow will provide reasonable assistance with the Customer's security obligations, breach assessment, data-protection impact assessments and prior consultation obligations under Articles 32–36 of the UK GDPR. The Customer remains responsible for decisions and filings that belong to it as controller.

9. Return and deletion

At the end of the organisation agreement, and at the Customer's choice, Morrow will delete or provide an available export of Customer Personal Data, then delete remaining copies, unless UK law requires retention. The Customer must request return before deletion is completed. Data in isolated backups may remain until the applicable provider backup cycle expires and will not be returned to ordinary use except for recovery, security or legal necessity.

This clause does not require deletion of information that Morrow lawfully retains as an independent controller, including an individual's continuing personal account or records required for security, disputes, tax or legal compliance.

10. Compliance information and audits

Morrow will make available information reasonably necessary to demonstrate compliance with Article 28 and will contribute to reasonable audits or inspections by the Customer or its independent auditor. Audits must be requested on reasonable written notice, occur during normal business hours, avoid unnecessary disruption, protect other customers' information and be subject to confidentiality. The parties should use existing documentation and remote evidence first. The Customer bears its audit costs unless an audit identifies material non-compliance by Morrow.

11. International transfers

Morrow will not make a restricted transfer of Customer Personal Data unless it is covered by UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to qualifying EU Standard Contractual Clauses, or another lawful mechanism. Morrow will complete any transfer-risk assessment and apply supplementary measures required for the transfer. The same standard will be reflected in relevant subprocessor arrangements.

12. General terms and contact

If this DPA conflicts with the Organisation Terms on processing governed by this DPA, this DPA prevails. Liability arising under this DPA is subject to the agreement's lawful liability provisions. Changes required by Data Protection Law may be made by written agreement or an updated DPA notified to the Customer. Privacy and DPA enquiries should be sent to privacy@morrowfinance.co.uk.