Data Processing Agreement
Alluvial | Effective date: 10 October 2026
This Data Processing Agreement (DPA) forms part of the Terms and Conditions (the Terms) between Aptitude Solutions Ltd, a company registered in England and Wales (company number 17476747), whose registered office is at 167 - 169 Great Portland Street, 5th Floor, London, England, W1W 5PF (the Processor, "we"), and the Customer (the Controller, "you"). It applies where we process personal data on your behalf when you use Alluvial. If it conflicts with the Terms on a data protection matter, this DPA prevails.
1. Definitions
Terms such as controller, processor, data subject, personal data and processing have the meanings given in the UK GDPR.
Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any other UK data protection legislation in force, each as amended.
Customer Personal Data means personal data in Input and Output, and any other personal data we process on your behalf under the Terms.
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
Restricted Transfer means a transfer of Customer Personal Data outside the UK that is subject to the transfer restrictions in the UK GDPR.
Sub-processor means a third party we engage to process Customer Personal Data.
Other capitalised terms have the meanings given in the Terms.
2. Roles and scope
For Customer Personal Data you are the controller and we are the processor. Annex A sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject.
We are an independent controller of the data described in our Privacy Policy as processed for our own purposes (account, billing, usage and support data, and scan history, metadata and feedback). This DPA does not apply to that processing.
You must comply with Data Protection Law. In particular you must have a lawful basis for submitting Customer Personal Data, give data subjects the notices required, and ensure your instructions are lawful.
3. Our obligations as processor
We will:
(a) process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and your use of the Services, unless the law requires otherwise, in which case we will tell you before processing unless the law prohibits that;
(b) tell you promptly if we think an instruction infringes Data Protection Law;
(c) ensure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality;
(d) implement the technical and organisational measures in Annex B, which we may update provided they do not materially reduce the level of protection;
(e) not use the text of Input to train artificial intelligence or machine-learning models, and not sell Customer Personal Data or use it for advertising;
(f) taking into account the nature of the processing, help you respond to requests from data subjects exercising their rights, and pass on to you promptly any request we receive about Customer Personal Data without responding to it ourselves unless you ask us to;
(g) help you meet your obligations on security, personal data breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the information available to us; and
(h) make available information reasonably necessary to show our compliance with this DPA, and allow for and contribute to audits as set out in section 7.
4. Sub-processors
You give us general authorisation to engage the Sub-processors listed in Annex C. We will:
(a) give you at least 30 days' notice (by email or in the product) before adding or replacing a Sub-processor;
(b) allow you to object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may terminate the affected Services and receive a pro-rata refund of prepaid fees for the unused period;
(c) impose on each Sub-processor written terms that offer materially the same protection as this DPA; and
(d) remain responsible to you for each Sub-processor's performance of its data protection obligations.
5. International transfers
We will not make a Restricted Transfer unless a lawful transfer mechanism applies, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and any required transfer risk assessment has been carried out. Annex C states where each Sub-processor processes data. You authorise the transfers described there.
6. Personal Data Breaches
We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. Our notice will describe, as far as we know, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will update you as we learn more and will take reasonable steps to contain and remedy the breach. You are responsible for deciding whether to notify the ICO or data subjects.
7. Audit
We will, on reasonable written request no more than once a year (or sooner after a Personal Data Breach), provide documentation reasonably necessary to show our compliance with this DPA, such as security summaries or third-party audit reports. If that does not satisfy a legal requirement, you may carry out an audit, using an independent auditor bound by confidentiality, on at least 30 days' notice, during business hours and in a way that does not disrupt our operations or compromise the security of other customers' data. You bear the costs of the audit.
8. Return and deletion
On termination or expiry of the Services, or on your written request, we will delete or return Customer Personal Data in accordance with Annex A. You may export Output through the product before then. After the retention period we will delete Customer Personal Data, including copies held by Sub-processors, unless the law requires us to keep it, in which case we will keep it confidential and process it only for that purpose.
9. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in section 15 of the Terms, which apply to this DPA as if set out in full. Nothing in this DPA limits liability that cannot lawfully be limited, including a data subject's rights against either party.
10. Term, changes and governing law
This DPA applies for as long as we process Customer Personal Data on your behalf. If Data Protection Law changes, or the ICO issues guidance or a mandatory clause that requires this DPA to change, we may update it on reasonable notice, and the parties will cooperate in good faith to agree any necessary amendments.
This DPA is governed by the law of England and Wales, and section 17 of the Terms applies to disputes.
Annex A: Details of processing
| Item | Detail |
|---|---|
| Subject matter | Provision of Alluvial: screening of submitted text for low-quality and low-effort indicators, with related reporting and account features |
| Duration | The term of the Terms, plus the retention period below |
| Nature of processing | Receiving, storing, analysing, generating results from, displaying, exporting and deleting Customer Personal Data |
| Purpose | Providing the Services to you as described in the Terms |
| Types of personal data | Content of manuscripts and other Input, which may include names and any other personal data they contain; Output linked to that Input; identifiers of users who submit it (name, email, institutional ID or pseudonymous ID) |
| Special category data | None intended. Customers must not submit it unless necessary and lawful |
| Data subjects | Authors and subjects of submitted content (such as students, researchers, employees and writers) and your authorised users |
| Retention | Temporary source uploads are removed within 24 hours. Screening records and derived results are retained for up to seven years from creation, unless deleted earlier on the Customer's documented instruction or where required by law. At termination we delete or return Customer Personal Data subject to that schedule and applicable legal obligations |
Annex B: Security measures
We maintain measures appropriate to the risk, including:
- encryption of Customer Personal Data in transit using TLS and at rest using AWS Key Management Service encryption;
- role-based access controls, least-privilege access for staff, and multi-factor authentication for cloud administrative access;
- confidentiality undertakings for all personnel with access;
- logical separation of customer data and logging of access to production systems;
- vulnerability management and timely security patching;
- encrypted backups and a documented recovery process;
- an incident response procedure for detecting, escalating and reporting security incidents; and
- due diligence and contractual security requirements for Sub-processors.
Annex C: Authorised Sub-processors
| Sub-processor | Service | Location of processing | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services, Inc. and relevant AWS contracting entities | Cloud hosting, encrypted storage, transactional email, and screening infrastructure | United Kingdom (AWS eu-west-2); any further processing is governed by the AWS Data Processing Addendum and its current sub-processor list | UK processing; any restricted transfer is governed by the applicable UK transfer mechanism and AWS terms |
PostHog processes limited controller-purpose analytics under our Privacy Policy and is not authorised to receive Customer Personal Data or Input/Output under this DPA. Stripe processes payment information for its payment services and is not authorised to receive Input/Output. These providers and their current locations and terms are described on our Sub-processors page.