Charle Data Processing Agreement

Between: Charle London Limited (company number 11863407) ("Charle", the Processor) and the client named in the main agreement (the Client, the Controller) Version: 1.0 Last updated: 2 October 2026

1. What this agreement is

This Data Processing Agreement ("DPA") sets out the terms on which Charle processes personal data on the Client's behalf. It meets the requirements of Article 28 of the UK GDPR and forms part of the main agreement between Charle and the Client (the "Agreement"). If this DPA and the Agreement conflict on data protection, this DPA wins.

It applies whenever Charle acts as the Client's processor, which includes:

• CSignal Convert, where the CSignal pixel or Shopify app collects data about visitors to the Client's store; and
• Delivery work, where our team accesses or handles personal data held in the Client's own systems (for example customer records in Shopify or an email platform) to carry out the services.

It does not cover personal data Charle handles as a controller in its own right, such as the business contact details of the Client's team. That is covered by the Charle Privacy Notice and the CSignal Platform Privacy Policies.

2. Roles

• The Client is the controller. It decides why and how its customers' and visitors' personal data is processed.
• Charle is the processor. It processes that data only to provide the services and only on the Client's documented instructions.
• The Agreement, this DPA, and the Client's use and configuration of CSignal are the Client's documented instructions.

3. Charle's obligations

Charle will:

1. Follow instructions. Process the Client's personal data only on the Client's documented instructions, unless the law requires otherwise, in which case Charle will tell the Client first unless the law prevents it. Charle will tell the Client if it believes an instruction breaks data protection law.
2. Keep it confidential. Make sure everyone who processes the data is bound by confidentiality.
3. Keep it secure. Apply the technical and organisational measures in Annex 2.
4. Use approved sub-processors only. Follow section 5.
5. Help with requests. Help the Client respond to requests from individuals exercising their rights, taking into account the nature of the processing. Charle will pass on any request it receives directly.
6. Help with compliance. Provide reasonable help with security, breach notification, data protection impact assessments and consultations with the regulator, as they relate to the processing.
7. Report breaches. Tell the Client without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Client's data, with the information the Client reasonably needs to meet its own obligations.
8. Return or delete. At the end of the services, delete the Client's personal data, or return it if the Client asks, unless the law requires Charle to keep it. Raw CSignal pixel events are in any case deleted automatically 12 months after collection.
9. Demonstrate compliance. Make available the information reasonably needed to show compliance with this DPA, and allow for and contribute to reasonable audits, on reasonable notice, no more than once a year unless a breach has occurred, and subject to confidentiality.

4. The Client's obligations

The Client will:

1. Make sure it has a lawful basis for the processing, including any consent needed for cookies or similar technologies on its website.
2. Tell its customers and visitors about the processing in its own privacy policy and cookie banner. Recommended wording is in the CSignal Convert Policy.
3. Make sure its instructions comply with data protection law.
4. Not configure CSignal, or ask Charle, to collect special category data or more personal data than the services need.
5. Pass on to Charle, promptly, any request it receives that Charle needs to act on, such as a customer's erasure request.

5. Sub-processors

1. The Client gives Charle general authorisation to use sub-processors to provide the services. The categories in use are listed in Annex 3, and the named list is available on request.
2. Charle will put a written contract in place with each sub-processor that gives the Client's data the same level of protection as this DPA, and stays responsible for its sub-processors.
3. Charle will tell the Client before adding a new category of sub-processor that will handle the Client's personal data. The Client may object on reasonable data protection grounds within 14 days, and the parties will discuss it in good faith. If they cannot resolve it, the Client may stop using the affected part of the services.

6. International transfers

Charle may transfer the Client's personal data outside the UK only where an appropriate safeguard is in place, such as the UK International Data Transfer Agreement or Addendum, the UK Extension to the EU-US Data Privacy Framework, or another approved mechanism.

7. Anonymised insights

The Client agrees that Charle may create anonymised, aggregated statistics from the data it processes, and use them to benchmark performance and improve its services. Once data is anonymised it is no longer personal data and Charle is responsible for it as its own. These statistics never identify an individual or the Client.

8. Liability and term

Each party's liability under this DPA is subject to the limits in the Agreement, except where the law does not allow a limit. This DPA lasts for as long as Charle processes personal data on the Client's behalf.

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption of data in transit (TLS) and at rest.
• Logical separation of each client's data, enforced by row-level security.
• Access limited to authorised staff on a least-privilege basis, with access removed when people leave.
• Passwordless sign-in to CSignal using one-time email links.
• Visitor IP addresses stored only as an irreversible, salted hash.
• Raw pixel events deleted automatically after 12 months.
• No passwords for the Client's systems stored in CSignal; staff access is given by staff or collaborator invites.
• Established hosting providers with their own security and compliance programmes.
• A documented incident response process.

Annex 3: Sub-processor categories