Meskora Data Processing Addendum

Version 1.0 · Effective date: 1 November 2026 · Last reviewed: 26 October 2026

This Data Processing Addendum (the DPA) is incorporated into the agreement between Sefki Huseyin, trading as Meskora, with its principal place of business at Suite RA01, 195-197 Wood Street, London E17 3NU, United Kingdom (the Supplier), and the customer subscribing to the Service (the Customer). Capitalised terms used but not defined in this DPA have the meanings given in the Terms of Use. This DPA applies to personal data processed by the Supplier under that agreement. Where the Customer subscribes online, neither party needs to sign an unfilled template for an online DPA accepted as part of the subscription agreement.

1. Definitions

"Customer Personal Data" means personal data that the Customer, the Customer's authorised users and linked users provide to or through the Service, and information the Supplier collects in operating the Service on the Customer's instructions. It does not include records that the Supplier processes in its own capacity as data controller, as described in the Privacy Policy (for example, security and audit records, shared-link access records, and the Customer's account, billing and enquiry records).

"Processing" has the meaning given in UK data protection legislation, and includes collecting, recording, storing, using, disclosing, transferring and deleting.

2. Roles

The Customer is the controller of Customer Personal Data. The Supplier is the processor of Customer Personal Data. Each party will process only the personal data it needs to perform this DPA.

3. Instructions

The Supplier processes Customer Personal Data only on the Customer's documented instructions, including the agreement, the applicable settings and lawful subsequent instructions. The Supplier will notify the Customer in writing if it considers an instruction infringes UK data protection legislation, and the parties will use reasonable efforts to agree a resolution. The Supplier will not use Customer Personal Data for unrelated product development, advertising or model training.

4. Confidentiality

The Supplier will ensure that the people it authorises to process Customer Personal Data are bound by a confidentiality obligation, whether statutory, regulatory or contractual.

5. Security

The Supplier will apply the technical and organisational measures required by Article 32 UK GDPR, taking into account the risks and the nature of the processing. These include pseudonymisation, encryption where appropriate, access controls, logging, backup and restoration, and a process for testing and reviewing the effectiveness of those measures. The Customer may request a current summary of the measures, and the Supplier will provide it in a form appropriate to the Customer's reasonable needs.

6. Sub-processors

The Customer gives the Supplier a general written authorisation to use the sub-processors listed in the Sub-processor Register. The Supplier will notify the Customer in writing of any intended addition or replacement of a sub-processor at least 30 days before engagement. The Customer may object within 14 days of that notice, for reasonable data protection grounds. The parties will use reasonable efforts to resolve the objection in good faith. If the objection is not resolved, and the sub-processor is needed for the Customer's workspace, either party may terminate the affected part of the Service without penalty for the part not provided. The Supplier will impose on each sub-processor, by contract, data protection obligations substantially equivalent to this DPA and will remain liable to the Customer for the sub-processor's performance of those obligations.

7. Data subject rights

The Supplier will handle requests from data subjects in a way that helps the Customer respond within the statutory time limit, taking into account the nature of the request. The Supplier will promptly forward to the Customer any request it reasonably identifies as a data subject request. The Customer remains responsible for the substance of its response, including the legal basis, accuracy and any verification steps.

8. Personal data breach

The Supplier will notify the Customer without undue delay, and in any event within a reasonable period not exceeding 72 hours, after becoming aware of a personal data breach that may affect Customer Personal Data. The notification will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it and to mitigate its effects. The Supplier will keep the Customer informed of material developments and will provide reasonable cooperation for the Customer's notification to the ICO and to data subjects. The Supplier will be responsible for the breach where it is caused by the Supplier or its sub-processors. Liability under this Addendum is subject to the limitations in the Terms.

9. Assistance

The Supplier will assist the Customer, taking into account the nature of the processing and the information available to the Supplier, with the Customer's obligations under Articles 32 to 36 UK GDPR, including security, breach notification, data protection impact assessments and prior consultation. Where the assistance requires a separate payment, the parties will agree that before it is provided.

10. Return and deletion

At the Customer's choice, at the end of the Service the Supplier will return or delete Customer Personal Data. The Customer may ask for a final export within 30 days of the end date. The Supplier will delete Customer Personal Data after the end of the applicable export period, or within 30 days of the Customer's deletion request, whichever is later. The Supplier will confirm the completed deletion to the Customer in writing. Copies held in backups may remain until overwritten, up to 90 days, and the Supplier will delete those copies then. The Supplier may retain a minimum record needed to satisfy applicable legal, tax, audit or regulatory requirements, provided it identifies that record to the Customer and keeps it confidential.

11. International transfers

Where Customer Personal Data is transferred to a country outside the United Kingdom, the parties will apply the applicable safeguard under Chapter V UK GDPR. The Supplier will use UK adequacy regulations, or, where those do not apply, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with any additional measures required by the data protection test. This clause is not itself an executed IDTA or Addendum. A copy of the applicable transfer document will be made available to the Customer on request.

12. Audit

The Customer may audit the Supplier's compliance with this DPA, including through certificates, independent reports or a site visit, on reasonable notice. The Supplier may require the audit to be on agreed terms, at reasonable cost where more than a routine check, and subject to the Supplier's security and confidentiality controls. The Supplier will keep records sufficient to demonstrate compliance with this DPA.

13. Term

This DPA applies for the term of the agreement and continues for the personal data processing it covers until that data is returned or deleted in line with clause 10.

Schedule A: Subject matter, duration, nature and purpose of processing

Sanctions-screening indicators may require separate Article 10 treatment; the screening workflow is assessed before first use.

Schedule B: Categories of data subjects

1. The Customer's contact and authorised users.
2. Linked users and their contact details.
3. Owners, residents, guests and other portal recipients.
4. People who contact the Customer through the Service.

Contact for this DPA

The Customer may contact the Supplier about this DPA at privacy@meskora.com.