Data Processing Agreement
Version 1.0 · Last updated 14 September 2026
This Data Processing Agreement (“this Agreement”) applies to the processing of personal data by MeetRobots Limited t/a Abracademy (“Abracademy”, the “Processor”) on behalf of the customer organisation that subscribes to or uses The Extraordinary Teams Accelerator (the “Customer” or the “Controller”).
It is incorporated by reference into, and forms part of, the agreement under which the Customer uses the Services (the “Principal Agreement”). Where the parties have entered into a signed agreement that addresses the processing of personal data, that signed agreement governs and this Agreement supplements it; otherwise this Agreement applies in full. To the extent of any conflict on the subject of data protection, this Agreement prevails unless the parties have expressly agreed otherwise in a signed agreement.
This Agreement takes effect when the Customer accepts the Principal Agreement or first uses the Services, and remains in effect for as long as the Processor processes personal data on the Customer’s behalf.
Processor: MeetRobots Limited t/a Abracademy, 506 Kingsbury Road, London NW9 9HE. A signed copy of this Agreement is available to enterprise customers on request.
1. Definitions
"UK GDPR" means the UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.
"Personal data", "processing", "data subject", "controller", and "processor" have the meanings given in UK GDPR.
"Services" means The Extraordinary Teams Accelerator as described in the Principal Agreement.
“Customer” (the “Controller”) means the organisation that uses the Services and determines the purposes and means of the processing of personal data under this Agreement.
2. Subject matter and duration
The Processor processes personal data on behalf of the Controller solely for the purpose of delivering the Services. This Agreement remains in effect for the duration of the Principal Agreement and terminates on its conclusion or earlier termination.
3. Nature and purpose of processing
The Processor processes personal data to:
- Provide the Controller’s users with platform access and team-development resources (the toolbox)
- Enable participants to complete team diagnostics via the platform
- Generate team-level diagnostic reports for the Controller’s use
4. Categories of data and data subjects
| Category | Detail |
|---|---|
| Data subjects | The Controller’s employees or team members who use the platform’s development resources (the toolbox) and take part in team diagnostics |
| Personal data processed | For the Controller’s platform users: name, work email address, team or department, login and session data, and communication preferences (held separately from diagnostic responses) |
| Special category data | None |
Individual diagnostic responses are stored without any identifier and cannot be linked to a data subject. Once an assessment closes, the Processor retains only aggregate scores and a de-identified dataset containing no personal data.
Personal data is deleted or returned on termination of the Services at the Controller’s choice, and is in any event deleted within 30 days of the end of the Controller’s access term. Platform-user account data is retained for the duration of the agreement and deleted on the same 30-day basis. A de-identified, aggregated benchmark dataset, which is not personal data, may be retained thereafter.
5. Obligations of the Processor
The Processor shall:
5.1 Process personal data only on documented instructions from the Controller, unless required to do so by applicable law.
5.2 Ensure that persons authorised to process the data are subject to appropriate confidentiality obligations.
5.3 Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including: encryption of personal data in transit (TLS 1.2 or higher) and at rest; ongoing confidentiality, integrity, availability, and resilience of processing systems; the ability to restore access to personal data in a timely manner in the event of an incident; and a process for regularly testing and evaluating the effectiveness of security measures.
5.4 Not engage sub-processors without prior written authorisation from the Controller (general authorisation is granted for the sub-processors listed in Schedule 1).
5.5 Assist the Controller in responding to data subject rights requests (access, rectification, erasure, portability, restriction) within a timeframe that allows the Controller to meet its legal obligations.
5.6 Notify the Controller without undue delay, and in any event within 48 hours, upon becoming aware of a personal data breach, so that the Controller can meet its own notification obligations under UK GDPR.
5.7 Provide the Controller with all information necessary to demonstrate compliance with this Agreement.
5.8 At the choice of the Controller, delete or return all personal data upon termination of the Services, and delete existing copies unless applicable law requires retention.
5.9 Maintain a record of processing activities carried out on behalf of the Controller, available to the Controller and the ICO on request.
6. Obligations of the Controller
The Controller shall:
6.1 Ensure there is a lawful basis for processing before instructing the Processor.
6.2 Ensure that data subjects have been informed of the processing in accordance with UK GDPR Articles 13 and 14.
6.3 Notify the Processor promptly of any data subject rights request received that relates to data processed under this Agreement.
7. Sub-processors
The Controller grants general written authorisation for the Processor to engage the sub-processors listed in Schedule 1. The Processor shall inform the Controller of any intended changes to sub-processors, giving the Controller sufficient time to object before the change takes effect. The current list of authorised sub-processors is published at https://accelerator.abracademy.com/legal/sub-processors.
8. International transfers
Core assessment data is processed and stored in the EU (Frankfurt). Authentication (Clerk) processes limited personal data in the US under the UK Extension to the EU–US Data Privacy Framework and/or Standard Contractual Clauses. AI features (Claude models via AWS Bedrock, with Google Cloud Vertex AI as a backup) are region-pinned to the EU. See Schedule 1 for details.
The Controller acknowledges that AI-powered features (report generation and in-app search) are provided using Claude models hosted on AWS Bedrock, with Google Cloud Vertex AI as a backup, in both cases with the processing region pinned to the EU. Data sent for this purpose consists of anonymised aggregate assessment data. It is not retained after processing and is not used for model training.
9. Audit rights
The Controller may, with reasonable notice, request information demonstrating the Processor's compliance with this Agreement. The Processor shall make available all information necessary and, at the Controller's reasonable request and cost, permit and contribute to audits.
10. Liability and indemnity
Each party's liability under this Agreement is subject to the limitations set out in the main service agreement. Each party shall indemnify the other against fines, penalties, or claims arising from its own failure to comply with applicable data protection law.
11. Governing law
This Agreement is governed by the laws of England and Wales. Any disputes are subject to the exclusive jurisdiction of the courts of England and Wales.
12. Changes to this Agreement
The Processor may update this Agreement from time to time. The current version and its effective date are published on the Processor’s website. Where a change materially affects the Customer’s rights or the Processor’s obligations, the Processor will give the Customer reasonable prior notice.
Schedule 1: Authorised sub-processors
| Sub-processor | Location | Purpose | Data processed | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare Inc. | Global edge; EU (backups) | DNS, CDN, security; global and China static content delivery; encrypted off-site database backups | IP addresses (transient), request metadata; encrypted database backups held in the EU and deleted after 30 days | Standard Contractual Clauses |
| Vercel Inc. | EU (Frankfurt) | Application hosting, build pipeline and edge delivery | IP addresses (transient), request logs | N/A — processed in the EU |
| Neon (a Databricks company) | EU (Frankfurt) | Database storage | Aggregate assessment data, admin and user account data | N/A — processed in the EU |
| Clerk Inc. | USA | Authentication and identity management | User names, email addresses, session data | UK Extension to the EU–US Data Privacy Framework + Standard Contractual Clauses |
| Cloudinary Ltd | USA | Media storage and delivery | Static media assets (no personal data) | Standard Contractual Clauses |
| PostHog Inc. | EU (Germany) | Product analytics | Anonymised usage data | N/A — processed in the EU |
| Sentry (Functional Software Inc.) | EU (Germany) | Error monitoring and logging | Diagnostic error data (may include limited personal data) | N/A — processed in the EU |
| AWS Bedrock | EU (region pinned) | AI report generation and in-app search (Claude models) | Aggregate assessment data and search queries (not retained post-processing, not used for model training) | N/A — processed in the EU |
| Google Cloud (Vertex AI) | EU (region pinned) | AI report generation and in-app search (Claude models) — backup to AWS Bedrock | Aggregate assessment data and search queries (not retained post-processing, not used for model training) | N/A — processed in the EU |
| Mailjet | EU | Transactional email (account and notification emails) | Name, email address, email content and metadata | N/A — processed in the EU |