Fluid - Your all-in-one Paraplanning case management system

Data Processing Agreement

1. Purpose and Scope

1.1 This Data Processing Agreement ("DPA") forms part of the agreement between Fluid and the Customer governing access to and use of the Fluid platform and associated AI tools (the "Services").

1.2 This DPA applies where Fluid processes Personal Data on behalf of the Customer in connection with the provision of the Services.

1.3 The purpose of this DPA is to set out the terms on which Fluid processes Personal Data as a Processor in accordance with:

(a) the UK General Data Protection Regulation ("UK GDPR");
(b) the Data Protection Act 2018; and
(c) any other applicable data protection legislation in force in the United Kingdom.

1.4 This DPA applies to all Personal Data processed by Fluid on behalf of the Customer under or in connection with the Services.

1.5 In the event of any conflict between this DPA and the main Services agreement, this DPA shall prevail in respect of matters relating to the processing of Personal Data.

1.6 This DPA does not apply where Fluid acts as a Controller in its own right, including in respect of:

(a) its own employee, contractor or supplier data;
(b) business contact data processed for account management, billing or marketing purposes; or
(c) any processing carried out independently of the Customer's instructions.

2. Roles of the Parties

2.1 For the purposes of the UK GDPR and this DPA:

(a) The Customer acts as the Controller of the Personal Data processed under the Agreement.
(b) Fluid acts as the Processor of such Personal Data.

2.2 The Customer determines the purposes and means of the processing of Personal Data carried out through the Services.

2.3 Fluid shall process Personal Data only:

(a) on documented instructions from the Customer, including as set out in the Agreement and this DPA; and
(b) for the purpose of providing and supporting the Services.

2.4 The parties acknowledge that:

(a) The Services are tools made available to support the Customer's internal business activities.
(b) The Customer remains solely responsible for determining the appropriateness of the Services for its regulatory and business requirements.
(c) Fluid does not determine the purposes for which Personal Data is processed and does not assume any regulatory responsibility for advice, recommendations or communications generated or issued by the Customer using the Services.

2.5 The Customer warrants that:

(a) it has a lawful basis for processing Personal Data and for instructing Fluid to process Personal Data on its behalf;
(b) it has provided all necessary privacy notices to data subjects; and
(c) it will comply with all applicable data protection legislation in its use of the Services.

3. Subject Matter and Duration of Processing

3.1 Subject Matter

The subject matter of the processing under this DPA is the provision of the Services by Fluid to the Customer under the Agreement.

The Services include access to the Fluid platform and any AI tools, modules or applets made available within that platform.

3.2 Nature and Purpose of Processing

Fluid processes Personal Data solely for the purpose of:

(a) hosting, storing and transmitting Customer Data within the platform;
(b) enabling the Customer to input, generate, retrieve and manage outputs through the Services;
(c) providing technical support, maintenance and security monitoring;
(d) complying with legal or regulatory obligations applicable to Fluid; and
(e) any other processing strictly necessary to provide the Services in accordance with the Agreement.

Processing activities may include collection, storage, organisation, structuring, retrieval, use, transmission, alignment, restriction and deletion of Personal Data.

3.3 Duration

Fluid shall process Personal Data for the duration of:

(a) the Agreement; and
(b) any applicable data retention period set out in the Agreement, this DPA or Fluid's documented retention policy.

Upon termination or expiry of the Agreement, Personal Data shall be deleted or returned in accordance with Section 8 of this DPA and the Agreement.

4. Categories of Personal Data and Data Subjects

4.1 Categories of Data Subjects

Personal Data processed under this DPA may relate to:

(a) the Customer's employees, directors, officers, contractors and authorised users;
(b) the Customer's clients and prospective clients;
(c) beneficiaries, trustees, dependants or other individuals connected to the Customer's clients;
(d) professional advisers, intermediaries or counterparties connected to the Customer's activities; and
(e) any other individuals whose Personal Data is submitted to the Services by or on behalf of the Customer.

4.2 Categories of Personal Data

The categories of Personal Data processed may include, depending on how the Customer uses the Services:

(a) Identity and Contact Information
Name, title, date of birth, contact details and similar identifiers.

(b) User Account and Authentication Information
Login credentials, user IDs, account settings and system access records.

(c) Employment and Professional Information
Job title, employer details, regulatory reference numbers and professional history.

(d) Financial Information
Income, expenditure, assets, liabilities, investment holdings, pension details and related financial data.

(e) Tax and National Insurance Information
Tax status, tax identification numbers and related compliance information.

(f) Beneficiary and Relationship Information
Family structure, dependants, trustees and related parties.

(g) Communications and Correspondence
Messages, uploaded documents, meeting notes and case-related records.

(h) Technical and Usage Data
IP addresses, device information, system logs and interaction data generated through use of the Services.

4.3 Special Category and Article 10 Data

Where the Customer inputs such data into the Services, processing may include:

(a) Health Information;
(b) Disability Information;
(c) Ethnicity or racial origin;
(d) Criminal conviction or offence data.

Fluid does not require or request Special Category Data but will process such data where it is uploaded by the Customer and where necessary to provide the Services under the Agreement.

4.4 Customer Responsibility for Data Scope

The Customer determines the categories of Personal Data uploaded into the Services and is responsible for ensuring that:

(a) it has a lawful basis for processing such Personal Data;
(b) it is entitled to instruct Fluid to process such data; and
(c) the scope of data uploaded is proportionate and appropriate to its regulatory and legal obligations.

5. Fluid's Obligations as Processor

5.1 Processing on Documented Instructions

Fluid shall:

(a) process Personal Data only on documented instructions from the Customer, including as set out in the Agreement and this DPA;
(b) not process Personal Data for its own purposes; and
(c) immediately inform the Customer if, in Fluid's opinion, an instruction infringes applicable Data Protection Law.

5.2 Confidentiality

Fluid shall ensure that all personnel authorised to process Personal Data:

(a) are subject to appropriate confidentiality obligations; and
(b) receive appropriate data protection and information security training.

5.3 Security Measures

Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to individuals, Fluid shall implement and maintain appropriate technical and organisational measures designed to protect Personal Data against:

(a) accidental or unlawful destruction, loss or alteration;
(b) unauthorised disclosure of, or access to, Personal Data; and
(c) other unlawful forms of processing.

Such measures include, without limitation:

(i) role-based access controls and authentication safeguards;
(ii) encryption in transit and at rest where appropriate;
(iii) secure hosting within the United Kingdom or European Union;
(iv) logging and monitoring of system access;
(v) vulnerability management and patching processes;
(vi) incident response procedures; and
(vii) regular review of security controls.

5.4 No Model Training

Fluid shall not use Customer Personal Data to train, fine-tune or improve any general-purpose artificial intelligence models.

Where third-party model providers are used to generate outputs, Personal Data is processed solely for the purpose of providing the Services and in accordance with this DPA.

5.5 Segregation and Access Controls

Fluid shall maintain logical separation between Customer data and data belonging to other customers and shall restrict access to Personal Data strictly to authorised personnel who require access to perform the Services.

6. Sub-Processors

6.1 Authorisation

The Customer provides general written authorisation for Fluid to engage third-party sub-processors to process Personal Data for the purpose of providing the Services.

6.2 Current Sub-Processors

Fluid shall maintain an up-to-date list of authorised sub-processors via its Trust Centre or equivalent publicly available register.

The register shall identify:

(a) the name of the sub-processor;
(b) the general description of the processing activity performed; and
(c) the country in which the processing takes place.

6.3 Engagement of New Sub-Processors

Fluid may appoint additional sub-processors provided that:

(a) the sub-processor is engaged only for the purposes of delivering the Services;
(b) Fluid undertakes appropriate due diligence prior to appointment;
(c) the sub-processor is subject to written contractual obligations that are no less protective than those set out in this DPA; and
(d) where required by law, Fluid provides advance notice of the appointment through its Trust Centre or equivalent notification mechanism.

6.4 Objection Right

Where required under applicable Data Protection Law, the Customer may object to the appointment of a new sub-processor on reasonable data protection grounds.

If the parties cannot resolve the objection within a reasonable period, either party may terminate the affected Services in accordance with the Agreement.

6.5 International Transfers

Personal Data is hosted in the United Kingdom and/or the European Union.

Where a sub-processor processes Personal Data outside the United Kingdom or European Economic Area, Fluid shall ensure that appropriate safeguards are in place in accordance with applicable Data Protection Law, which may include:

(a) adequacy regulations;
(b) International Data Transfer Agreements;
(c) International Data Transfer Addendums to EU Standard Contractual Clauses; or
(d) other lawful transfer mechanisms.

6.6 Liability

Fluid shall remain responsible for the acts and omissions of its sub-processors to the same extent as if the processing were performed by Fluid directly.

7. Assistance to the Customer

7.1 Data Subject Rights

Taking into account the nature of the processing, Fluid shall provide reasonable assistance to the Customer, through appropriate technical and organisational measures, to enable the Customer to respond to requests from Data Subjects exercising their rights under applicable Data Protection Law.

Fluid shall:

(a) promptly notify the Customer if it receives a Data Subject request relating to Personal Data processed on behalf of the Customer;
(b) not respond directly to such request unless expressly authorised by the Customer or required by law; and
(c) provide reasonable cooperation to enable the Customer to fulfil its obligations.

7.2 Data Protection Impact Assessments

Taking into account the nature of the processing and the information available to Fluid, Fluid shall provide reasonable assistance to the Customer in connection with:

(a) data protection impact assessments; and
(b) prior consultation with supervisory authorities,

where such assistance is required under applicable Data Protection Law and relates specifically to processing carried out by Fluid on behalf of the Customer.

7.3 Regulatory Cooperation

Fluid shall provide reasonable cooperation and information to the Customer where required to demonstrate compliance with applicable Data Protection Law in relation to the Services.

7.4 Security Incidents and Personal Data Breaches

Fluid shall:

(a) notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Customer;
(b) provide sufficient information to enable the Customer to meet any reporting or notification obligations under applicable Data Protection Law; and
(c) take appropriate steps to investigate, contain and remediate the breach.

Notification shall include, to the extent known at the time:

(i) the nature of the breach;
(ii) the categories and approximate number of affected Data Subjects;
(iii) the categories and approximate volume of Personal Data affected;
(iv) the likely consequences; and
(v) measures taken or proposed to address the breach.

7.5 Distinction from Security Incidents

For the avoidance of doubt, not all security incidents constitute a Personal Data Breach. Fluid shall assess incidents in accordance with its internal incident response procedures and applicable law.

8. Deletion and Return of Personal Data

8.1 Return or Deletion on Termination

Upon termination or expiry of the Agreement, and at the Customer's written request, Fluid shall:

(a) return a copy of the Customer Personal Data in a commonly used electronic format; or
(b) securely delete the Customer Personal Data,

unless applicable law requires continued storage.

8.2 Retention Period

Unless otherwise agreed in writing:

(a) Customer Personal Data shall remain accessible to the Customer for a limited period following termination, as set out in the Agreement;
(b) after that period expires, Fluid shall securely delete or irreversibly anonymise the Personal Data in accordance with its documented retention procedures.

8.3 Backup Systems

Customer acknowledges that Personal Data may remain in secure backup systems for a limited period following deletion from active systems.

Such data shall:

(a) remain protected by appropriate technical and organisational measures;
(b) not be restored except where required for disaster recovery or legal compliance; and
(c) be permanently deleted in accordance with Fluid's standard backup retention cycle.

8.4 Certification

Upon reasonable written request, Fluid shall confirm in writing that deletion has been completed in accordance with this Section.

9. Audit and Information Rights

9.1 Demonstration of Compliance

Fluid shall make available to the Customer such information as is reasonably necessary to demonstrate compliance with this DPA and applicable Data Protection Law in relation to the processing of Personal Data under the Agreement.

Such information may include:

(a) relevant policy documentation;
(b) summaries of technical and organisational measures;
(c) details of sub-processors; and
(d) responses to reasonable written compliance questionnaires.

9.2 Audit Rights

Where required by applicable Data Protection Law, the Customer may request an audit of Fluid's compliance with this DPA, subject to the following conditions:

(a) audits shall be limited to matters directly relevant to the processing of the Customer's Personal Data;
(b) audits shall occur no more than once in any 12-month period, unless required by law or following a confirmed Personal Data Breach;
(c) audits shall be conducted during normal business hours and in a manner that does not unreasonably disrupt Fluid's operations;
(d) the Customer shall provide reasonable advance notice;
(e) audits shall be subject to appropriate confidentiality obligations; and
(f) where possible, audits shall be satisfied through the provision of independent third-party certifications, reports or summaries in place of on-site inspections.

9.3 Costs

Unless otherwise required by law:

(a) the Customer shall bear its own costs of any audit; and
(b) where an on-site audit is requested and cannot reasonably be satisfied through documentation review, Fluid may charge the Customer reasonable costs associated with facilitating the audit.

9.4 Confidential Information Protection

Nothing in this Section requires Fluid to disclose:

(a) information relating to other customers;
(b) proprietary security architecture that could compromise platform security; or
(c) information that Fluid is legally prohibited from disclosing.

10. General Provisions

10.1 Precedence

In the event of any conflict between this DPA and the Agreement, this DPA shall prevail solely in respect of matters relating to the processing of Personal Data.

In all other respects, the Agreement shall prevail.

10.2 Liability

The liability of each party arising under or in connection with this DPA shall be subject to the exclusions and limitations of liability set out in the Agreement.

Nothing in this DPA limits or excludes liability where such limitation or exclusion is not permitted under applicable law.

10.3 Governing Law and Jurisdiction

This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions set out in the Agreement.

10.4 Severability

If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

10.5 Amendments

This DPA may only be amended in writing and signed by both parties, unless amended automatically to reflect changes required by applicable Data Protection Law.

10.6 Survival

The obligations contained in this DPA shall survive termination of the Agreement for so long as Fluid processes Personal Data on behalf of the Customer.

Schedule 1 — Details of Processing

This Schedule forms part of the Data Processing Agreement between the Customer (Controller) and Fluid (Processor).

1. Subject Matter of the Processing

Provision of the Fluid platform and associated AI tools, modules and applets, including:

Hosting and storage of Customer Data
Processing of Personal Data in response to user prompts and inputs
Generation of outputs for use by the Customer
Technical support, maintenance and security monitoring

Processing is carried out solely for the purpose of delivering the Services under the Agreement.

2. Duration of the Processing

Processing shall continue for:

The duration of the Agreement; and
Any applicable post-termination retention period set out in the Agreement and DPA.

Backup data may be retained in secure systems for a limited period in accordance with Fluid's documented retention procedures.

3. Nature and Purpose of the Processing

The nature of the processing may include: collection, recording, organisation, structuring, storage, retrieval, consultation, use, transmission, restriction and deletion.

The purpose of the processing is to:

Enable the Customer to use the Fluid platform and AI tools
Generate draft documentation, reports or outputs based on Customer inputs
Store and retrieve Customer Data
Maintain platform security and service integrity
Provide support services

Fluid does not process Personal Data for its own commercial purposes. Fluid does not use Customer Personal Data to train or fine-tune general-purpose AI models.

4. Categories of Data Subjects

Depending on how the Customer uses the Services, Data Subjects may include:

The Customer's employees, officers and contractors
The Customer's clients or prospective clients
Beneficiaries, trustees or related parties
Professional contacts
Website users (where applicable)

5. Categories of Personal Data

Personal Data processed may include, depending on Customer usage:

Personal Data (Non-Special Category)

Identity and Contact Information
User Account and Authentication Information
Employment Information
References
Family and Relationship Details
Financial Information
Beneficiary and Trustee Information
Banking and Payment Information
Performance and Remuneration Information
Qualifications and Professional Information
Tax and National Insurance Information
Lifestyle and Personal Circumstances Information
Communications and Correspondence
Technical and Usage Data
Behavioural and Interaction Data

Special Category and Article 10 Data (if uploaded by Customer)

Health Information
Disability Information
Ethnicity and Racial Origin
Criminal Conviction and Offence Data

Fluid processes Special Category or Article 10 data only where such data is uploaded or input by the Customer and solely in accordance with the Customer's instructions.

6. Processing Locations

Personal Data is hosted and stored within:

The United Kingdom; and/or
The European Union.

Where third-party service providers are used, processing locations are identified in Fluid's Trust Centre sub-processor register.

7. International Transfers

Where Personal Data is transferred outside the United Kingdom or European Economic Area, such transfers shall be carried out in accordance with applicable Data Protection Law and appropriate safeguards.

Schedule 2 — Technical and Organisational Measures

Fluid implements and maintains appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, in accordance with applicable Data Protection Law.

The measures include, but are not limited to, the following:

1. Governance and Information Security Framework

1.1 Fluid maintains documented information security and data protection policies applicable to personnel and contractors.
1.2 Responsibility for information security and data protection is assigned to designated roles within the organisation.
1.3 Policies and controls are reviewed periodically and updated as necessary.
1.4 Risk assessments are undertaken in relation to information security and data protection.

2. Access Control

2.1 Access to systems containing Personal Data is restricted to authorised personnel on a need-to-know basis.
2.2 Role-based access controls are implemented.
2.3 Strong authentication mechanisms are enforced, including password standards and, where applicable, multi-factor authentication.
2.4 User access rights are reviewed periodically and revoked promptly upon termination or role change.
2.5 Administrative access is limited and monitored.

3. Encryption and Data Protection Controls

3.1 Data is encrypted in transit using industry-standard encryption protocols.
3.2 Data is encrypted at rest where appropriate to the risk profile of the processing.
3.3 Cryptographic keys are managed securely.

4. Infrastructure and Hosting Security

4.1 Hosting environments are located within the United Kingdom and/or European Union.
4.2 Hosting providers implement physical and environmental security controls.
4.3 Network security measures include firewalls and traffic filtering controls.
4.4 Logical segregation mechanisms are implemented to separate Customer data from other customers.

5. Application Security

5.1 Secure development practices are applied to software development activities.
5.2 Code changes are subject to review and testing before deployment.
5.3 Vulnerability management processes are in place, including monitoring for security advisories and applying security patches in a timely manner.
5.4 Penetration testing and/or security testing is conducted periodically by qualified personnel or independent third parties.

6. Monitoring and Logging

6.1 System access and administrative activities are logged.
6.2 Logs are monitored for suspicious or unauthorised activity.
6.3 Security events are escalated through documented incident response procedures.

7. Incident Management

7.1 Fluid maintains a documented incident response process.
7.2 Security incidents are assessed to determine whether they constitute a Personal Data Breach.
7.3 Personal Data Breaches are notified to Customers without undue delay in accordance with the DPA.
7.4 Remediation actions are documented and tracked.

8. Business Continuity and Backup

8.1 Regular backups of Customer data are performed.
8.2 Backup data is protected using appropriate security measures.
8.3 Disaster recovery procedures are in place to support restoration of services.
8.4 Backup retention and deletion follow documented procedures.

9. Personnel Security

9.1 Personnel with access to Personal Data are subject to confidentiality obligations.
9.2 Background screening may be conducted where appropriate to the role and permitted by law.
9.3 Personnel receive periodic security and data protection awareness training.

10. Sub-Processor Oversight

10.1 Sub-processors are subject to due diligence prior to engagement.
10.2 Written agreements are in place requiring sub-processors to implement appropriate technical and organisational measures.
10.3 Sub-processor performance and compliance are reviewed periodically.

11. AI and Model Governance Controls

11.1 Customer Personal Data is processed solely for the purpose of delivering the Services.
11.2 Customer Personal Data is not used to train or fine-tune general-purpose AI models.
11.3 Where third-party model providers are used, processing occurs under contractual safeguards consistent with applicable Data Protection Law.
11.4 AI tool deployments are subject to documented risk and security assessments.