Simana Data Processing Addendum

Last modified 28 October 2026

This Addendum sets out how See Data Limited processes personal data for its organisational customers when providing Simana.

1 Parties and application

1.1 Parties. This Data Processing Addendum (DPA) is between See Data Limited, trading as Simana (Simana), and the customer identified in the applicable order form or other written agreement for the Service (Customer). Simana’s contact address is 1 Emperor Way, Exeter Business Park, Exeter, Devon, EX1 3QS, United Kingdom. Its data protection contact is privacy@simana.com.

1.2 Incorporation. This DPA, including its Schedules, forms part of the agreement governing Customer’s use of Simana (Agreement) when incorporated by that Agreement or separately agreed in writing. It applies from that agreed effective date for as long as Simana or a Subprocessor holds Customer Personal Data.

1.3 Scope and priority. This DPA applies to Customer Personal Data, including personal data in AI inputs and outputs. For that processing, it prevails over conflicting Customer Terms, User Terms, AI Terms, privacy statements and other Agreement provisions. Mandatory terms of an applicable executed international transfer instrument prevail over this DPA. A separately negotiated DPA replaces this standard DPA only where the parties expressly agree that result in writing.

2 Definitions

2.1 Data Protection Laws means the UK GDPR and Data Protection Act 2018, each as amended, together with other applicable UK data protection law and, to the extent applicable to the relevant processing, the EU GDPR and applicable EU or Member State data protection law. UK GDPR has the meaning given in section 3 of the Data Protection Act 2018. EU GDPR means Regulation (EU) 2016/679, as amended.

2.2 Customer Personal Data means personal data Simana processes on Customer’s behalf in delivering the Service, as described in Schedule 1. Service means the Simana workplace improvement platform and associated support and agreed services under the Agreement. Subprocessor means a third party engaged by Simana to process Customer Personal Data on Customer’s behalf.

2.3 Personal Data Breach means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data. Restricted Transfer means a transfer for which applicable Data Protection Laws require a Chapter V transfer safeguard because no applicable adequacy decision or regulation covers it. Controller, processor, data subject and processing have the meanings in applicable Data Protection Laws. Business Day means a day other than a Saturday, Sunday or public holiday in England.

3 Roles and customer responsibilities

3.1 Roles. Customer is the controller and Simana its processor. Where Customer processes data on behalf of another controller, Simana acts as Customer’s subprocessor; Customer must have authority to give the instructions and authorisations in this DPA and communicate relevant upstream requirements before processing begins. The processing description is in Schedule 1.

3.2 Customer responsibilities. Customer determines its purposes and lawful basis, gives required privacy information, ensures that data and instructions are lawful, and obtains any permissions required for its use of the Service. Customer manages its users, permissions, sharing settings, integrations and data minimisation. These responsibilities do not reduce Simana’s obligations under this DPA or Data Protection Laws.

3.3 Separate controller activities. This DPA does not apply where Simana determines its own purposes and means for processing business relationship data, such as invoicing contacts, statutory accounting records and marketing contacts collected separately from Customer’s workspace. Such processing must have its own lawful basis and transparency information. Workspace content, AI inputs and outputs, and operational records processed on Customer’s behalf do not become Simana controller data merely because they pass through a support system.

4 Instructions and permitted use

4.1 Documented instructions. Simana will process Customer Personal Data only on Customer’s documented instructions, including instructions about international transfers. These comprise this DPA, the Agreement, Customer’s authorised configuration and use of the Service, and further lawful written instructions from Customer’s authorised representatives. Simana will inform Customer immediately if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the affected processing while the parties resolve the issue.

4.2 Required processing. Simana may process otherwise than instructed only where required by UK law or, for processing subject to EU GDPR, applicable EU or Member State law. Simana will inform Customer of that legal requirement before processing unless the relevant law prohibits notice on important grounds of public interest. Requests under other foreign laws must be assessed under clause 9 and applicable Data Protection Laws.

4.3 Purpose limits. Simana will not sell Customer Personal Data, use it for unrelated marketing, or use it to train generative AI models, and will not permit its AI Subprocessors to train such models using that data. AI processing is limited to delivering the agreed features, including necessary security and abuse prevention within the documented processing scope and lawful instructions.

4.4 Additional instructions. If a lawful instruction requires a material change beyond the agreed Service, Simana will promptly explain the impact and agree delivery and any reasonable charges before undertaking that change. This does not permit Simana to charge for or refuse its existing legal or contractual obligations. If a lawful solution is unavailable, the parties may end the affected Service and apply clause 11.

5 Personnel and security

5.1 Simana will ensure that everyone it authorises to process Customer Personal Data is bound by confidentiality obligations or an appropriate statutory duty, receives suitable data protection and security training, and accesses data only as necessary for authorised work. Access will be removed when no longer needed.

5.2 Simana will implement and maintain technical and organisational measures appropriate to the risk and meeting Article 32 of applicable UK/EU GDPR. Schedule 2 describes the contractual baseline. Simana will regularly assess the effectiveness of those measures, taking account of the state of the art, implementation costs, processing context and risks to individuals.

5.3 Simana may update how its measures are implemented provided the update does not materially reduce protection or fall below applicable legal requirements or an expressly agreed control. A material reduction requires Customer’s written agreement and must remain lawful. Security information may be supplied confidentially where necessary to protect the Service and other customers.

6 Subprocessors

6.1 Authorisation. Customer gives general written authorisation to the Subprocessors in the online register incorporated through Schedule 3 when this DPA takes effect, and to additions or replacements made under this clause. Authorisation is limited to each provider’s stated function and data scope. It does not waive clause 9 or authorise independent uses of Customer Personal Data.

6.2 Due diligence and contracts. Before processing starts, Simana will assess each Subprocessor’s ability to protect the data and enter into a written contract imposing the same relevant data protection obligations as this DPA, with an equivalent level of protection. Simana remains fully liable to Customer for the Subprocessor’s performance of those obligations.

6.3 Changes. Simana will give Customer direct written notice at least 30 calendar days before a new or replacement Subprocessor first processes Customer Personal Data. Notice will identify the provider, service, data scope, countries and applicable transfer arrangements. Simana will also maintain its online register. Updating that register alone is not notice.

6.4 Objections. Customer may object on reasonable data protection grounds within 14 calendar days after notice. The parties will discuss the objection in good faith and seek a commercially reasonable resolution. If it remains unresolved before the proposed processing starts, Simana will either refrain from using that Subprocessor for Customer’s data or give Customer the right to suspend or terminate the affected Service by written notice before that processing starts. Simana will not disclose the affected Customer Personal Data to that Subprocessor while the objection remains unresolved or the affected Service is suspended. If the affected Service cannot reasonably be separated, Customer may terminate the affected subscription. This right overrides any minimum term or termination notice requirement in the Agreement. Fees accrued before suspension or termination remain payable; prepaid unused fees are dealt with under the Agreement. Exercising this right does not itself create a termination penalty or damages claim, but accrued rights, claims for breach and liabilities that cannot lawfully be excluded remain unaffected. Clause 11 applies on termination.

6.5 Urgent changes. The notice period may be shortened only with Customer’s prior specific written authorisation for the affected data, or where required by applicable law. An urgent operational need does not itself remove the requirement for authorisation and a lawful transfer mechanism.

7 Assistance and individual rights

7.1 Taking account of the nature of processing, Simana will assist Customer through appropriate technical and organisational measures, insofar as possible, to answer requests under Chapter III of UK/EU GDPR, including access, correction, deletion, restriction, portability and objection.

7.2 Simana will forward requests relating to Customer Personal Data without undue delay and in any event within three Business Days of receipt. It will not answer substantively without Customer’s instruction unless legally required. It will supply relevant information and assistance promptly enough for Customer to meet the applicable deadline. Customer remains responsible for deciding the response.

7.3 Taking account of the nature of processing and information available to it, Simana will assist Customer with security, breach assessment and notification, DPIAs and prior consultation with a supervisory authority under Articles 32–36. Routine assistance is included in the Service fees. Exceptional work outside existing obligations may be charged only as agreed in advance; a fee discussion must not delay mandatory assistance.

8 Personal data breaches

8.1 Notification. Simana will notify Customer without undue delay after becoming aware of a Personal Data Breach and in any event within 24 hours of that awareness. This is an outside limit, not permission to delay. An initial notice may be incomplete and will be supplemented without undue delay as information becomes available. Simana will not wait for a completed investigation.

8.2 Information. Notices will describe, so far as known, the nature of the breach; affected data and categories and approximate numbers of individuals and records; likely consequences; containment and remedial measures taken or proposed; and a contact for further information. Simana will explain material information gaps and provide progress updates.

8.3 Response. Simana will promptly investigate, contain and mitigate the breach, preserve relevant evidence, document its response and cooperate with Customer. It will help Customer assess risk and make required notifications. Simana will not notify individuals or a regulator on Customer’s behalf without instruction unless legally required; this does not prevent Simana meeting its own legal duties.

8.4 Contacts. Notice will be sent to Customer’s nominated security/privacy contact. If none is provided or reachable, Simana will use the account administrator and senior customer contact recorded for the Agreement. Customer must keep those details current. Simana’s contact is privacy@simana.com. Notification is not, of itself, an admission of liability.

9 Locations and international transfers

9.1 The standard application hosting, backup and recovery locations are described in Schedule 1. Other Subprocessor processing locations are identified in the online register incorporated through Schedule 3. Simana will not move the agreed core hosting or backup location to another country without Customer’s prior written agreement. Changes to Subprocessors follow clause 6.

9.2 Simana will make a Restricted Transfer only under Customer’s documented instructions and with a valid safeguard required by applicable Data Protection Laws in place before transfer. This includes legally relevant remote access and onward transfers. Simana will identify the parties, countries, data and processing covered, complete any required transfer assessment or data protection test, and implement necessary supplementary measures.

9.3 Where appropriate, safeguards may include a properly completed UK IDTA or EU transfer standard contractual clauses with the UK International Data Transfer Addendum for UK data, and applicable EU transfer clauses for EU data. Where relying on adequacy, Simana will verify that the recipient and processing are actually covered and keep that reliance under review. This DPA alone does not execute any such instrument or establish that a provider is covered by adequacy.

9.4 Simana will maintain evidence of its transfer arrangements and provide information reasonably necessary for Customer to assess compliance. If a safeguard ceases to be valid or effective, Simana will promptly inform Customer and suspend the affected transfer unless and until a lawful alternative is implemented. The parties will address any necessary return, deletion or Service termination under clause 11.

10 Evidence and audits

10.1 Information. Simana will make available all information necessary to demonstrate compliance with Article 28 and this DPA, maintain legally required processor records, and allow and contribute to audits and inspections by Customer or its appointed auditor.

10.2 Proportionate process. The parties will use current policies, questionnaires, independent assurance and appropriately redacted reports first where these adequately answer Customer’s compliance questions. Where they do not, Simana will support further examination, including an inspection. Simana will not use confidentiality or the absence of a particular certification to prevent effective verification.

10.3 Arrangements. Ordinarily Customer will give at least 20 Business Days’ notice, with one routine audit in a 12-month period. Those limits do not apply where more frequent or urgent access is reasonably needed following a breach, credible evidence of non-compliance, a regulator’s request or a legal requirement. The parties will agree reasonable security, confidentiality and scheduling arrangements without frustrating the audit right. Customer may appoint a suitably qualified independent auditor; Simana may object only on reasonable confidentiality or security grounds and must promptly help resolve the issue.

10.4 Protection and costs. Audits must protect other customers’ data and avoid unnecessary disruption. Security testing requires an agreed safe scope, but this does not exclude necessary inspections. Customer bears its auditor’s costs; Simana bears its own reasonable costs of providing routine evidence and required cooperation. Exceptional additional costs require prior agreement and must not prevent mandatory cooperation. Simana will promptly remedy identified non-compliance.

11 Return, deletion and survival

11.1 Customer’s choice. At the end of the relevant Service, Customer may choose return of its Customer Personal Data through the self-service export process in clause 11.2 or secure deletion. Customer may communicate its choice before the Service ends or within 30 calendar days afterwards. During that window Simana will keep the data protected and available for export, processing it only for return, deletion, security or legal compliance. If Customer gives no instruction and does not initiate an export, this DPA instructs Simana to begin deletion after that window. Customer may request earlier deletion, subject to agreement on implementation.

11.2 Self-service return. Simana will fulfil a return election by making Customer Personal Data available to Customer’s authorised administrators through self-service export tools in a commonly used, machine-readable format. Simana will maintain export access throughout the 30-day period in clause 11.1, including after the Service ends. Customer is responsible for initiating the export, downloading the files and storing them securely. Simana will provide instructions and technical assistance reasonably necessary to complete the export; the return option does not include bespoke formats, migration to another service or other professional services. A completed return is followed by deletion of Simana’s remaining copies under clauses 11.3–11.5.

11.3 Active systems. Simana will securely delete Customer Personal Data from active systems as soon as reasonably practicable following Customer’s deletion instruction, completion of the return process or expiry of the 30-day period in clause 11.1 where no return is elected or initiated. Active copies will in any event be deleted no later than 90 calendar days after the relevant Service ends, except to the limited extent that clause 11.2 requires affected data to be preserved to complete a timely requested return, or clause 11.5 requires retention by law. Simana will ensure that Subprocessors meet the same deletion requirements.

11.4 Backups. Where immediate selective deletion from backups is not technically feasible, the data will be put beyond ordinary use, remain protected and be deleted through the normal overwrite cycle no later than 120 calendar days after the Service ends. Any disaster-recovery restoration will reapply the deletion instruction before the data returns to ordinary use. On request, Simana will confirm completion in writing, identifying any permitted retention and the final backup deletion date.

11.5 Required retention. Data may be retained beyond these periods only to the extent required by UK law or, for processing subject to EU GDPR, applicable EU or Member State law. Simana will identify the requirement and expected period to Customer unless prohibited, isolate the retained data, limit processing to that purpose, and delete it when retention is no longer required. This DPA continues to protect all retained copies.

11.6 Separate controller records. The return and deletion requirements in this clause 11 apply to Customer Personal Data processed on Customer’s behalf. They do not require deletion of business relationship records that Simana lawfully processes as an independent controller under clause 3.3, including relevant business contact details, contractual correspondence, invoicing and accounting records. Simana may retain those records after the Service ends only for specified lawful purposes, including managing continuing business relationships, meeting legal obligations and establishing, exercising or defending legal claims. Simana will apply documented retention periods, review continued necessity, provide applicable privacy information and respect individuals’ rights under Data Protection Laws. This provision does not authorise retention or repurposing of Customer Personal Data merely because it has been copied into a CRM, accounting or support system.

12 General provisions

12.1 Liability. The Agreement’s liability provisions apply to this DPA, including its specific data protection liability cap where applicable. They do not restrict rights of individuals or regulators, liability that cannot lawfully be limited, or mandatory terms of an applicable transfer instrument. No provision relieves either party of its own direct obligations under Data Protection Laws.

12.2 Changes. Simana may update this DPA to reflect changes in applicable law, regulatory guidance or the Service, provided the update does not materially reduce the protection of Customer Personal Data, expand the agreed processing purposes or scope, or materially increase Customer’s obligations. Simana will give Customer direct written notice of the revised wording, the reasons for the update and its effective date at least 30 calendar days before it takes effect. If a shorter period is legally required, Simana will give as much notice as reasonably practicable and explain the reason. Updates meeting these conditions take effect through this agreed notice process without a further signature. All other changes require agreement in writing, including electronic agreement. Subprocessor changes are governed by clause 6 and updates to security measures by clause 5; neither process authorises a broader change to this DPA or overrides a mandatory transfer instrument.

12.3 Other terms. The Agreement’s governing law, dispute resolution and notice provisions apply except where this DPA specifies a different operational notice route or a mandatory transfer instrument requires otherwise. All provisions necessary to protect retained Customer Personal Data survive expiry or termination.

Schedule 1 Processing description

Subject matter nature and purpose

Provision, administration, hosting, maintenance and support of Customer’s Simana workplace improvement environment. Processing includes collecting, recording, organising, storing, retrieving, displaying, transmitting, exporting, restricting and deleting data; managing accounts and permissions; maintaining service security and audit history; backups and restoration; troubleshooting; and delivering Customer-authorised integrations and AI features.

Duration and frequency

Processing continues throughout the relevant Service period, with continuous storage and processing triggered by user activity and operational needs. Retention after the Service ends is limited by clause 11. Customer can give lawful deletion instructions during the Service, subject to applicable retention requirements and agreed technical implementation.

Individuals and personal data

Individuals: Customer’s employees, contractors, authorised collaborators and other individuals whose ordinary business information Customer lawfully includes in the workspace. Account and profile data: names, work email addresses, job roles, organisation/team affiliations, profile details and optional photographs. Workspace content: personal data in cards, spaces, projects, comments, tasks, documents, attachments, messages, charts and integrations. Service records: account identifiers, IP addresses, authentication/access events, timestamps, activity records and relevant support correspondence. AI data: prompts, messages, selected contextual content and generated outputs containing personal data, only for enabled features.

Sensitive data and special use cases

The standard Service is not authorised for patient-identifiable information, special-category data, criminal-conviction/offence data or personal data of children under 16. Such processing requires a prior written variation specifying the data, individuals, purpose, lawful conditions, safeguards, locations and retention. Accidental submission does not remove Simana’s protection, confidentiality, assistance or deletion obligations under this DPA; Simana will notify Customer when discovered and follow lawful instructions to contain and remove it.

Locations and instructions

Default core hosting is AWS London, United Kingdom, with resilience across separate availability zones in that region and backup copies retained in the UK. Any non-standard deployment must be specified in the order form with its hosting, backup and recovery locations. Other processing is limited to the online register incorporated through Schedule 3 and clause 9. Customer’s rights and responsibilities are set out in clauses 3, 4, 7, 8, 10 and 11.

Schedule 2 Security measures

These measures form the minimum contractual baseline for Customer Personal Data. They apply alongside clause 5; controls operated by Subprocessors must provide equivalent protection for their processing. Customer-specific enhancements must be agreed in writing.

Governance and staff

Maintain documented security responsibilities, risk assessment, incident response and access-management procedures. Train staff on joining and at least annually in security and data protection. Limit access to authorised personnel by role and need, require approval for elevated permissions, review permissions regularly and remove obsolete access. Require MFA for internal business systems; manage devices used for internal access with encryption, password controls, anti-malware and supported software.

Customer isolation and authentication

Use logical organisation boundaries, server-enforced permissions and tenant-scoped controls on shared infrastructure. Provide individual user authentication and SAML-based SSO where enabled for the Customer. Protect privileged and remote administrative access and log relevant administrative activity. Customer configures its own user permissions and identity-provider settings; Simana remains responsible for enforcing platform controls.

Encryption and key access

Encrypt Customer Personal Data in transit using TLS 1.2 or later and at rest using AES-256 or an equivalent modern standard, including stored backups containing that data. Store passwords using one-way password hashing. Restrict access to keys and secrets, manage their lifecycle and avoid exposing them in application code, logs or customer-visible responses.

Monitoring testing and changes

Record successful and failed authentication, access denials and relevant security and administrative events. Protect logs from unauthorised access and alteration and review security alerts. Run vulnerability detection continuously, formally review findings at least weekly, obtain independent penetration testing regularly, and prioritise remediation by severity and exposure. Control production changes and validate changes before release.

Resilience deletion and suppliers

Maintain protected backups and a documented restoration process using the UK locations in Schedule 1. Test restoration regularly and maintain incident and continuity procedures. Maintain a documented data lifecycle and secure deletion process covering active stores, backups and Subprocessors. Assess suppliers before access, restrict support information to what is necessary and review supplier safeguards periodically. Use cloud facilities with appropriate physical access, environmental and infrastructure protections.

Schedule 3 Subprocessors and processing locations

The authorised Subprocessors, their functions and processing locations are identified solely in the register at https://trust.simana.com/subprocessors-and-supplier-safeguards, which is incorporated into this DPA. The register applicable when this DPA takes effect, as subsequently changed in accordance with clause 6, is the operative list. Authorisation is limited to each provider’s stated function and data scope. Optional features do not authorise unrelated processing. Updating the page does not replace the notice and objection process in clause 6 or the transfer requirements in clause 9.