Data Processing Agreement

1 About this agreement

1.1 This Data Processing Agreement (the "DPA") forms part of the Truecast Terms of Service (the "Terms") between Wealthcast Ltd, a company registered in England and Wales with company number 17455947 and registered office at 128 City Road, London, United Kingdom, EC1V 2NX ("Wealthcast", "we", "us" and "our"), and the business that has agreed to the Terms (the "Customer", "you" and "your").

1.2 It applies whenever we process Customer Personal Data on your behalf in providing the Platform. It is intended to meet the requirements of Article 28(3) of the UK GDPR.

1.3 Words defined in the Terms have the same meaning here. In this DPA:

(a) "UK GDPR" has the meaning given in section 3(10) of the Data Protection Act 2018, and "Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any other law relating to personal data that applies to either of us, as amended or replaced from time to time;

(b) "Customer Personal Data" means personal data in Client Data and any other personal data we process on your behalf under the Terms, as described in Schedule 1;

(c) "controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "special category data" have the meanings given in Data Protection Law;

(d) "Subprocessor" means another processor we engage to process Customer Personal Data; and

(e) "Restricted Transfer" means a transfer of Customer Personal Data outside the United Kingdom that is restricted under Data Protection Law.

1.4 If there is a conflict between this DPA and the Terms, this DPA prevails on data protection matters.

2 Roles

2.1 You are the controller of Customer Personal Data and we are your processor. Where you use the Platform for clients of your appointed representatives, your principal or your group companies, you act as their agent for this DPA, you confirm you have their authority, and "Customer Personal Data" includes personal data you process on their behalf.

2.2 We are a controller, not your processor, for the personal data we use to run our own business, such as your Authorised Users' account and sign-in details, billing and contact details, support correspondence, Service Data and our security logs of sign-ins and account changes. Our Privacy Notice at https://truecast.co.uk/privacy explains that processing. The audit trail of changes to your client records is Customer Personal Data, which we keep for you under this DPA.

2.3 Where an Authorised User connects an AI Assistant under clause 10 of the Terms, you instruct us to disclose the Customer Personal Data needed to answer each request to that AI Assistant. The AI Assistant's provider (for example Microsoft, for Microsoft 365 Copilot) receives it under your agreement with that provider. It is not our Subprocessor, and we are not responsible for its processing. We make the data available only within the permissions the Authorised User approved and over an authenticated connection. Any transfer to that provider outside the United Kingdom is made on your instruction, and you are responsible for the transfer safeguard.

3 Your instructions

3.1 We will process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you before processing unless the law prohibits that.

3.2 Your instructions are: the Terms, this DPA, your configuration and use of the Platform (including the actions of your Authorised Users and any AI Assistant they connect), and any further written instructions that are consistent with the Terms and that we agree.

3.3 We will tell you promptly if we believe an instruction infringes Data Protection Law. We are not required to follow such an instruction.

3.4 You are responsible for:

(a) the lawfulness of the Customer Personal Data you provide and of your instructions;

(b) having a lawful basis, and where relevant a condition for special category data, for the processing;

(c) giving data subjects the privacy information the law requires about your use of the Platform; and

(d) keeping the Customer Personal Data you enter accurate and limited to what you need.

3.5 We will not sell Customer Personal Data or use it for our own purposes, including to develop or improve our products, to train any artificial intelligence model, or for marketing.

4 Our people

4.1 We will make sure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, and that access is limited to those who need it to provide, support and secure the Platform.

4.2 Our support console shows us your firm's details, settings and branding, your Authorised Users' names, email addresses, roles, sign-in methods and times, passkey counts and invitations, counts of your records, and activity logs, including the audit trail of client records, that identify records by reference number rather than content, and problem reports. Apart from any Client Data left in a problem report, it does not show the content of client records. From it, our staff can set up, rename, suspend and reinstate your Workspace, publish your branding, suspend and reinstate users, end a user's sessions, remove a user's passkeys and manage invitations, and they cannot sign in as one of your users. Our staff will access Client Data only where needed to operate, secure or restore the Platform, to investigate a problem you have reported, or to comply with the law, and only through administrator accounts protected by multi-factor authentication.

5 Security

5.1 We will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the UK GDPR. Schedule 2 describes the measures in place when this DPA was last updated.

5.2 We may update our measures over time, provided we do not reduce the overall level of protection.

6 Subprocessors

6.1 You give us general written authorisation to engage Subprocessors. The Subprocessors we use when this DPA was last updated are listed in Schedule 3.

6.2 We will give you at least 30 days' notice before adding or replacing a Subprocessor, by email to your Notice Contact and by updating Schedule 3. If you have reasonable data protection grounds to object, you may tell us within that period. We will discuss your objection in good faith. If we cannot resolve it, you may end the Terms by notice before the change takes effect, and we will refund any Fees paid for the period after termination.

6.3 We will only use Subprocessors that are bound by a written contract meeting the requirements of Article 28(4) of the UK GDPR, and we remain liable to you for the performance of our Subprocessors' obligations.

7 International transfers

7.1 We store Client Data in the European Union. We will not make a Restricted Transfer of Customer Personal Data unless it is covered by UK adequacy regulations or by appropriate safeguards under Data Protection Law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7.2 Schedule 3 describes where each Subprocessor processes Customer Personal Data and the transfer safeguard that applies.

8 Helping you with data subject requests

8.1 Taking into account the nature of the processing, we will help you, by appropriate technical and organisational measures, to respond to requests from data subjects to exercise their rights. Your Authorised Users can view and correct client records, and download a client's plan data, in the Platform. Where a request needs something the Platform does not let you do yourself, such as deleting a client's records or a fuller copy of them, we will do it on your written instruction within 30 days.

8.2 If we receive a request directly from one of your clients or other data subjects about Customer Personal Data, we will pass it to you without undue delay and will not respond to it ourselves, except to tell the person to contact you.

9 Personal data breaches

9.1 We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 We will give you the information we have, and update it as we learn more, so you can meet your own obligations, including any notification to the ICO within 72 hours and to data subjects. This includes a description of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences and the measures taken or proposed.

9.3 We will take reasonable steps to contain and investigate the breach and reduce its effects. Our notification is not an admission of fault or liability.

10 Helping you with your other obligations

10.1 Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your obligations under Articles 32 to 36 of the UK GDPR, including data protection impact assessments and any prior consultation with the ICO.

11 Information and audits

11.1 We will make available to you the information reasonably necessary to demonstrate our compliance with Article 28 of the UK GDPR and this DPA. We will normally do this by providing written answers, policies and certifications, such as our Cyber Essentials certificate and a summary of any independent penetration test once carried out.

11.2 We will also allow and contribute to audits, including inspections, by you or an independent auditor you appoint who is bound by confidentiality. You must give us at least 30 days' notice (unless a regulator requires less), audits may take place no more than once in any 12 months (unless following a personal data breach or at a regulator's request), and you bear your own costs.

11.3 Regulatory access. Where you are regulated by the Financial Conduct Authority, we will give you, your auditors and the FCA (and any person appointed by it) effective access to data relating to your use of the Platform, to our relevant business premises and personnel, and to the information our hosting provider makes available about its facilities, as needed for them to perform their functions. We will cooperate with the FCA in connection with your use of the Platform.

12 Deletion and return

12.1 When the Terms end, you can export Customer Personal Data as clause 18 of the Terms describes.

12.2 After the 30-day export period in clause 18.3 of the Terms, we will, at your choice, return Customer Personal Data to you and then delete it, or delete it, unless the law requires us to keep it. Copies held in our hosting provider's point-in-time restore facility expire in the normal cycle, which completes within 30 days. Our encrypted offsite backups are taken daily and locked against change or deletion for 35 days, so they are deleted after the lock on the last backup holding the data ends, usually about 36 days after the deletion. We will confirm when live data has been deleted, with the date each lock ends, and confirm again when the offsite copies have been deleted. Until then, backups remain protected by this DPA and are not used except to restore the service.

12.3 On request, we will confirm in writing that deletion is complete.

13 Liability

13.1 Each party's liability under or in connection with this DPA is subject to the limits and exclusions in clause 16 of the Terms, including any separate limit for data protection set in your Order under clause 16.6.

13.2 Nothing in this DPA limits either party's liability to data subjects under Data Protection Law, or the amount of any fine a regulator may impose on either party.

14 Duration

14.1 This DPA lasts for as long as we process Customer Personal Data on your behalf, including after the Terms end until deletion under clause 12 is complete.

15 Changes

15.1 We may update this DPA in the same way as the Terms, by emailing your Notice Contact at least 30 days before the change takes effect (clause 19 of the Terms), or where needed to comply with Data Protection Law. We will not make a change that reduces the protection given to Customer Personal Data without your agreement, unless Data Protection Law requires it.

16 Governing law

16.1 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Schedule 1 - Details of processing

Subject matter and duration. Providing the Platform to the Customer under the Terms, for the term of the Terms and until deletion under clause 12.

Nature and purpose. Hosting, storing, organising, calculating on, displaying, exporting and deleting Client Data so that the Customer's Authorised Users can build client plans, run projections and scenarios, review drafts and keep a record of their work; sending Client Data to an AI Assistant that an Authorised User has connected, when that AI Assistant requests it; investigating problems that Authorised Users report; and backing up and securing that data.

Categories of data subjects.

• The Customer's clients and prospective clients.
• Their partners, spouses, children, dependants, beneficiaries and other family members or individuals recorded in a plan.
• The Customer's own personnel, where named in client records or in the audit trail of work on them.

Categories of personal data.

• Identity and household: names, display names, ages, dates of birth (optional), marital status, household relationships, children's names and ages, and the date of death of a late spouse or partner.
• Financial: employment and other income, spending, pensions, ISAs and other investments, investment bonds, property, mortgages, student loans and other debts, cash, protection policies, company interests, gifts, trusts (including trust holdings, gifts into trust and trust income and gains), tax assumptions such as income-tax region, retirement ages and goals.
• Estate planning: beneficiary choices and charitable legacies.
• Planning assumptions that may relate to health: assumed ages of death and long-term care costs (see "Special category data" below).
• Planning records: plans and their revision history, scenarios and scenario notes, projects and project notes, projections, locked evidence records and the locked projection results stored with them (including labels Authorised Users have entered, such as a partner's name on a milestone), records of reports generated (a fingerprint and size of the file, not its content; reports are built and downloaded in the Authorised User's browser and not stored by us) and records of report content sent to an AI Assistant (its reference, a fingerprint, the parts sent and the connection, not the content), annual review updates, and drafts and proposed updates prepared by an AI Assistant, including the explanatory text it writes about where a proposed change came from.
• Free text entered by Authorised Users, such as notes on accounts, scenarios and assumption sets.
• Audit records of who changed a client record and when.

Special category data. The Platform does not ask for special category data. Authorised Users may nevertheless record information that reveals or suggests health, such as assumed ages of death, long-term care costs, health-related spending or free-text notes. The Customer is responsible for having a condition for processing any such data and for keeping it to what is needed.

Criminal offence data. None expected. The Customer must not enter it.

Frequency. Continuous, while the Customer uses the Platform.

Retention. For the term of the Terms, then as clause 12 describes. The audit trail is kept for as long as the client records it relates to.

Schedule 2 - Security measures

The measures below describe the Platform at the date of this DPA.

1. Hosting. The Platform runs on Cloudflare, in a Cloudflare account used only for Truecast and separate from Wealthcast's consumer product. Client Data is stored in Cloudflare D1 databases and R2 object storage created in Cloudflare's EU jurisdiction.
2. Encryption. Data is encrypted in transit using TLS and encrypted at rest by Cloudflare's storage platform. Session, email sign-in, invitation and connector tokens are stored only as one-way hashes. The short-lived values that protect a Microsoft sign-in, which are valid for 10 minutes, are stored as issued and deleted within a day.
3. Separation between firms. Each firm's records carry a firm identifier, and every request is checked against the signed-in user's firm before any client record is read or changed.
4. Sign-in. Your Authorised Users do not use passwords. They sign in with a single-use email link (valid for 15 minutes), a passkey or their organisation's Microsoft account. Microsoft personal and guest accounts are refused. Sessions end after 8 hours, or after 2 hours without activity.
5. Roles and permissions. Firm administrator, adviser and paraplanner roles, with firm-level policies and per-client access grants. Changes to firm settings and roles need a passkey check.
6. AI Assistant connections. Each connection is made by an individual Authorised User, is limited to the permissions they approve and can be revoked by that user. Access tokens we issue last one hour and refresh tokens 30 days; where the connection uses Microsoft sign-in, Microsoft's token lifetimes apply. An AI Assistant can save what-if scenarios and prepare draft records and proposed updates; nothing changes a client's record or plan until an Authorised User saves or applies it. Where an Authorised User approves it, an AI Assistant can also read client report content and charts. We record each report it reads, and which parts, with the client's report records. Our request log records which tool was called, by whom, the outcome and the time, but not the content of requests or responses, and is deleted after 90 days.
7. Staff access. Our support console shows firm and user details and settings, counts of records and activity logs that identify records by reference number, not the content of client records, apart from any Client Data left in problem reports (clause 4.2). Direct access to the production databases is limited to named administrators using accounts protected by multi-factor authentication. There is no feature that lets our staff sign in as one of your users.
8. Audit trail. Changes to client records, plans, scenarios and evidence are written to an append-only audit log. Changes to firm settings and roles are recorded in a separate audit log.
9. Backups and recovery. Cloudflare D1 point-in-time restore lets us recover databases to any point in the previous 30 days. We also take a daily encrypted backup of the Platform's databases and stored projection results, held in Microsoft Azure in the EU (the Netherlands, with a copy in Ireland) and locked against change or deletion for 35 days.
10. Secure development. Code changes go through version control and automated testing before release. Production and test environments are separate, and test environments use synthetic data only.
11. Company controls. We are Cyber Essentials certified. The Platform has not yet had an independent penetration test.
12. Incidents. We follow a written incident response process for the Platform and will notify you as clause 9 describes.

Schedule 3 - Subprocessors

Not Subprocessors.

• Your AI Assistant's provider (for example Microsoft for Microsoft 365 Copilot, OpenAI for ChatGPT or Anthropic for Claude). You choose and contract with that provider; see clause 2.3.
• Microsoft identity platform. When your Authorised Users sign in with Microsoft, Microsoft confirms their identity to us. Microsoft does not receive Client Data from us for this purpose.
• Email delivery. We use no separate email provider. Sign-in and invitation emails are sent through Cloudflare (listed above). Invitations to a client portal contain the client's email address and the name of their firm.