Data processing agreement

Last updated: 26 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Jacob Ashby, trading as Oppt ("oppt", "Processor") and the Customer ("Controller"). It applies whenever oppt processes personal data on the Customer's behalf, and it meets the requirements of Article 28 of the UK GDPR.

If this DPA and the Terms conflict, this DPA takes priority on data protection matters.

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings in the UK GDPR. "Customer Personal Data" means personal data in content that the Customer or its users upload to or create in oppt.

2. Scope

The details of the processing are set out in Annex 1.

3. Oppt's obligations

oppt will:

1. Follow the Customer's instructions. Process Customer Personal Data only on the Customer's documented instructions, which are these Terms and the Customer's use of the service. The exception is where the law requires otherwise, in which case oppt will tell the Customer first unless the law prohibits it. oppt will tell the Customer if it believes an instruction breaks data protection law.
2. Ensure confidentiality. Make sure everyone authorised to process Customer Personal Data is bound by confidentiality.
3. Keep the data secure. Put in place the security measures in Annex 2, as Article 32 requires.
4. Control sub-processors. Use sub-processors only as set out in section 4.
5. Help with data subject requests. Give the Customer reasonable help to respond to requests from data subjects, and pass on promptly any request it receives directly.
6. Help with the Customer's other obligations. Give reasonable help with Articles 32 to 36: security, breach notification, data protection impact assessments and prior consultation.
7. Report breaches. Tell the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. oppt will give the information it has at that point and update it as more becomes available.
8. Delete the data when the contract ends. Delete Customer Personal Data within one month of the Customer's request, and in any case once the Customer has had no active subscription for 12 months, unless the law requires oppt to keep it. If the Customer asks before deletion, oppt will return a copy of the data first.
9. Support audits. Give the Customer the information needed to show compliance with this DPA, and allow audits on reasonable notice, no more than once a year, at the Customer's cost. The exception is audits after a breach.
10. Not train AI on the data. Not use Customer Personal Data to train AI models, and not combine it with other customers' data. The exception is features the Customer chooses to use.

4. Sub-processors

• General authorisation: the Customer gives oppt general authorisation to use the sub-processors listed in Annex 3.
• Changes: oppt will give at least 30 days' notice of any new or replacement sub-processor, by email or by updating Annex 3 with a notice in the product. The Customer may object on reasonable data protection grounds. If the parties can't resolve the objection, the Customer may terminate and receive a refund of any prepaid fees for the unused period.
• Obligations passed on: oppt will impose data protection terms on each sub-processor that are no less protective than this DPA, except where Annex 3 says otherwise. oppt stays liable for its sub-processors.

5. International transfers

• Where transfers happen: oppt may transfer Customer Personal Data outside the UK only as set out in Annex 3.
• Safeguards: transfers are protected by UK adequacy regulations (including the UK–US data bridge where the recipient is certified), the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, as set out in Annex 3.
• Exception: Lovable, which hosts the website, the database and authentication, offers a DPA with the UK Addendum to the EU SCCs only on its Business and Enterprise plans, which oppt doesn't currently use. Transfers to Lovable are instead made under Lovable's terms of service and privacy policy, as described in Annex 3.

6. The Customer's obligations

• Lawful processing: the Customer is responsible for having a lawful basis for the Customer Personal Data it uploads.
• Information for data subjects: the Customer must give data subjects any information the law requires, such as its own staff privacy notice covering CVs used in bids.
• Special category data: the Customer must not upload special category data or criminal offence data unless it's necessary and lawful to do so.

7. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where the law doesn't allow a limit.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption: data encrypted in transit (TLS) and at rest, on the providers' managed infrastructure.
• Access to Customer data: authenticated access to every API request; data is separated by user and team; team sharing only as the Customer configures it, with library sharing off by default.
• Access to production: limited to named personnel; admin credentials held in a secrets manager and rotated after any suspected exposure.
• Uploads: only extracted text is stored, not the original files; "session-only" uploads for tenders not held on oppt aren't stored.
• Abuse controls: rate limiting and per-user AI usage limits.
• Logs: retained for 30 days.
• Incidents: a documented response and notification process.

Annex 3: Sub-processors