Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Carbon Giant Ltd, a company registered in England and Wales under company number 17243798 (“Carbon Giant”, the “Processor”), and the Customer (the “Controller”). It governs the processing of personal data that Carbon Giant carries out on the Customer's behalf when providing the Service. Where this DPA conflicts with the Terms of Service in relation to the processing of personal data, this DPA prevails.

1. Definitions

Terms such as controller, processor, personal data, processing, personal data breach, and special category data have the meanings given in the UK GDPR and the Data Protection Act 2018 (together, “Data Protection Law”). “Customer Personal Data” means personal data contained in Customer Data that Carbon Giant processes on the Customer's behalf under the Service.

2. Roles and scope

1. The Customer is the controller and Carbon Giant is the processor of Customer Personal Data. The subject matter, duration, nature, and purpose of the processing, the types of personal data, and the categories of data subjects are set out in Annex 1.
2. Carbon Giant processes Customer Personal Data only to provide and support the Service and only on the Customer's documented instructions, which include the Terms of Service, this DPA, and the Customer's use of the Service's features, unless required to act otherwise by law, in which case it will inform the Customer first unless the law prohibits it.
3. Carbon Giant will inform the Customer if, in its opinion, an instruction infringes Data Protection Law.

3. Confidentiality

Carbon Giant ensures that persons authorised to process Customer Personal Data are bound by an appropriate duty of confidentiality and are given access only on a need-to-know basis.

4. Security

Carbon Giant implements and maintains the technical and organisational measures set out in Annex 2, which are designed to ensure a level of security appropriate to the risk, taking into account the nature of the data and the fact that it includes financial information. These measures include multi-factor authentication for all accounts, encryption of data in transit and at rest, logical separation between customers, minimisation of data before it is sent for automated classification, role-based access control, audit logging, and documented backup and business continuity arrangements.

5. Special category data

The Service is not designed to process special category personal data within the meaning of Article 9 of the UK GDPR, and the Customer should not deliberately upload such data. The parties acknowledge, however, that because the Service ingests raw financial and transaction data, including through accounting integrations, special category personal data may on occasion appear incidentally within that data, for example a payment to a trade union, a medical provider, or a political organisation. Carbon Giant does not seek to identify or use such data. It applies the data minimisation described in Annex 2 to reduce its exposure, processes any such data solely to provide the Service on the Customer's instructions, and applies the same security measures to it. The Customer remains responsible, as controller, for the lawfulness of the data it provides to the Service.

6. Personal data breach

1. Carbon Giant will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Where full information is not available within that period, it will be provided in phases without further undue delay.
2. This timeframe is intended to give the Customer sufficient opportunity to meet its own obligation, where applicable, to notify the Information Commissioner's Office within 72 hours of becoming aware of the breach.
3. Carbon Giant will assist the Customer with its breach notification and communication obligations under Data Protection Law.

7. Sub-processors

1. The Customer gives general authorisation for Carbon Giant to engage the sub-processors listed in Annex 3. Each sub-processor is bound by data protection obligations no less protective than those in this DPA.
2. Carbon Giant will give the Customer at least 30 days' notice of any intended addition or replacement of a sub-processor, during which the Customer may object on reasonable data protection grounds. Carbon Giant remains liable for the acts and omissions of its sub-processors.

8. International transfers

Most processing takes place in the United Kingdom and the European Economic Area. Where Customer Personal Data is transferred to a country that has not been recognised as providing an adequate level of protection, in particular the transfer to the United States for automated classification, Carbon Giant ensures the transfer is covered by the Standard Contractual Clauses and the United Kingdom International Data Transfer Addendum in its agreement with the relevant provider, together with the data minimisation described in Annex 2.

9. Assistance to the Controller

1. Taking into account the nature of the processing, Carbon Giant will assist the Customer by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects exercising their rights.
2. Carbon Giant will assist the Customer in ensuring compliance with its obligations relating to security, breach notification, data protection impact assessments, and prior consultation, taking into account the information available to Carbon Giant.
3. Where Carbon Giant receives a request directly from a data subject in relation to Customer Personal Data, it will not respond to the request itself, except to acknowledge it, and will promptly forward it to the Customer.

10. Return and deletion of data

1. On termination or expiry of the Service, and at the Customer's choice, Carbon Giant will make Customer Personal Data available for export for a limited period, and will then delete it.
2. The Customer may instruct deletion of specific documents, or of all of its data, at any time. On such an instruction, or on closure of the account, Carbon Giant permanently deletes the affected Customer Personal Data promptly. Deletion cascades across file storage and the database, and error monitoring data expires within 30 days.
3. A deletion instruction takes effect notwithstanding any standard retention period that would otherwise apply. Carbon Giant will retain only the minimum data it is required by law to retain, and only for as long as, and for the purpose for which, that retention is required, after which it will delete that data as well.

11. Audit

Carbon Giant will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, on reasonable notice, no more than once a year unless required by a supervisory authority or following a personal data breach, and subject to reasonable confidentiality and security conditions.

12. Artificial intelligence, classification, and methodology

1. Where the Service uses a language model to assist in classifying line items into emission categories or emission factors, the model operates in an assisted capacity only. Classification suggestions are subject to the Customer's review and confirmation controls, and the Customer retains oversight of, and control over, which suggestions are accepted before emissions are calculated and published, including where it uses bulk-approval features.
2. To keep the methodology technically defensible and consistent with the GHG Protocol, Carbon Giant maintains version control over its classification and factor mapping logic and the model prompts it uses, records the basis of each classification so that it can be audited, and applies confidence thresholds below which a model suggestion is not applied and the item is left for human classification.
3. Before line items are sent to the model, Carbon Giant applies automated data minimisation tools designed to detect and strip personal identifiers, including individual names, financial account details, addresses, and non-essential free text. The model provider is configured so that prompts sent for classification are not logged or retained, and the provider does not use them to train models.
4. Automated invoice and spend classification primarily maps line items to Scope 3 Category 1 (Purchased Goods and Services) and Category 2 (Capital Goods) using spend-based calculation methods. These spend-based estimates are distinct from activity-based methods, which rely on primary activity data, such as fuel or utility consumption, and which underpin Scope 1 and Scope 2 calculations.

13. Liability

Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service, including the tiered liability cap that applies a higher limit to breaches of data protection and confidentiality obligations.

14. General

This DPA takes effect on the effective date and continues for as long as Carbon Giant processes Customer Personal Data. It is governed by the laws of England and Wales. If any provision is found to be unenforceable, the remaining provisions continue in effect.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

• Authentication. Multi-factor authentication is required for all user accounts.
• Encryption. Personal data is encrypted in transit using current protocols and at rest in both file storage and the database.
• Tenant isolation. Each organisation's data is logically separated so that one customer's data is not accessible to another customer, including during queries and during the construction of classification requests.
• Data minimisation before automated classification. Before a line item is sent to the language model, automated data minimisation tools designed to detect and strip personal identifiers are applied to individual names, financial account details, addresses, and non-essential free text.
• Model provider configuration. The classification model is configured so that request and response content is not logged or retained by the provider, and is not used to train models.
• Access control. Access within Carbon Giant follows least-privilege principles, and administrative actions are recorded in an audit log.
• Backups and business continuity. The database is protected by continuous point-in-time recovery, file storage is versioned, and a documented recovery process with defined recovery objectives allows the Service and its data to be restored after an incident.
• Monitoring retention. Error monitoring data is retained for no more than 30 days.

Annex 3: Approved sub-processors