indifeed Data Processing Agreement

Effective date: 4 September 2026

This Data Processing Agreement ("DPA") forms part of the indifeed Terms of Service (the "Terms") between:

Bit Monkey Ltd
Company number: 17306463
ICO registration number: ZC239561
132a High Street
Bromsgrove
United Kingdom
B61 8ES

("Bit Monkey", "we", "us", "our" or the "Processor")

and the person or organisation accepting the Terms (the "Customer").

This DPA applies where Bit Monkey processes Personal Data on behalf of the Customer in connection with indifeed.

1. Definitions

For this DPA:

Applicable Data Protection Law means the UK GDPR, the Data Protection Act 2018 and, where applicable to the relevant processing, other data protection laws including the EU GDPR.

Customer Personal Data means Personal Data processed by Bit Monkey on behalf of the Customer in connection with indifeed.

Data Subject, Personal Data, Personal Data Breach, Controller, Processor and Processing have the meanings given to them under Applicable Data Protection Law.

Services means the indifeed services provided by Bit Monkey under the Terms.

Subprocessor means another processor engaged by Bit Monkey to process Customer Personal Data in connection with the Services.

2. Roles of the parties

For Customer Personal Data:

the Customer is the Controller, or a Processor acting on behalf of another Controller; and
Bit Monkey is the Processor, or a Subprocessor where the Customer itself acts as a Processor.

The Customer determines the purposes for which Customer Personal Data is processed.

Bit Monkey processes Customer Personal Data only to provide, secure, maintain and support the Services and in accordance with the Customer's documented instructions.

3. Customer instructions

The Terms, this DPA, the Customer's configuration and use of the Services, and any additional written instructions agreed between the parties constitute the Customer's documented instructions.

Bit Monkey will process Customer Personal Data only on those instructions unless required to do otherwise by applicable law.

If applicable law requires Bit Monkey to process Customer Personal Data other than on the Customer's instructions, Bit Monkey will inform the Customer before doing so unless the law prohibits such notification.

If Bit Monkey reasonably believes an instruction infringes Applicable Data Protection Law, it will inform the Customer.

4. Customer responsibilities

The Customer is responsible for:

ensuring that its instructions comply with Applicable Data Protection Law;
having an appropriate lawful basis for its collection and processing of Personal Data;
providing required privacy information to Data Subjects;
ensuring that Customer Personal Data submitted to the Services is appropriate for the Customer's purposes; and
responding to Data Subjects where the Customer is responsible for doing so.

The Services do not require the routine collection of special category Personal Data. The Customer should not intentionally submit special category Personal Data unless it has determined that doing so is lawful and appropriate.

5. Confidentiality

Bit Monkey will ensure that people authorised to process Customer Personal Data:

process it only where necessary for their role; and
are subject to appropriate contractual, statutory or professional confidentiality obligations.

6. Security

Bit Monkey will maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Our security measures are described in Schedule 2 and may evolve as the Services and available security technologies change.

We may update those measures provided that the overall level of protection is not materially reduced.

7. Subprocessors

The Customer gives Bit Monkey general written authorisation to engage Subprocessors to provide parts of the Services.

Current Subprocessors are listed at:

https://indifeed.dev/legal/subprocessors

Bit Monkey will:

carry out reasonable due diligence before appointing a Subprocessor;
enter into a written agreement requiring the Subprocessor to provide data protection obligations materially equivalent to those required by this DPA;
remain responsible to the Customer for the performance of its Subprocessors' relevant data protection obligations; and
maintain an up-to-date Subprocessor list.

Where reasonably practicable, Bit Monkey will give Customers at least 14 days' notice before a new Subprocessor begins processing Customer Personal Data.

The Customer may object during that period on reasonable grounds relating specifically to data protection.

The parties will seek to resolve a valid objection in good faith. Where no reasonable alternative is available, either party may terminate the affected Services without penalty before the new Subprocessor begins processing.

Advance notice may not be possible where an urgent change is reasonably necessary to address a security issue, legal requirement, service failure or similar emergency. In such circumstances, Bit Monkey will provide notice as soon as reasonably practicable.

8. International transfers

Bit Monkey will not make a restricted international transfer of Customer Personal Data except:

on the Customer's documented instructions; and
using a transfer mechanism permitted by Applicable Data Protection Law.

Where required, such mechanisms may include:

UK adequacy regulations;
the UK International Data Transfer Agreement;
the UK Addendum to the European Commission Standard Contractual Clauses;
applicable Standard Contractual Clauses; or
another legally recognised safeguard.

Where a transfer mechanism requires a transfer risk assessment or equivalent assessment, Bit Monkey will undertake or obtain the relevant assessment as appropriate.

9. Data Subject requests

Taking into account the nature of the Processing, Bit Monkey will provide reasonable assistance to enable the Customer to respond to requests by Data Subjects exercising their rights.

If Bit Monkey receives a request relating to Customer Personal Data directly from a Data Subject, Bit Monkey will normally:

direct the Data Subject to the relevant Customer; or
notify the Customer and follow its reasonable instructions.

Bit Monkey will not independently respond to such a request except where required by law.

10. Personal Data Breaches

Bit Monkey will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

Where available, the notification will include information reasonably necessary for the Customer to understand:

the nature of the breach;
the categories of information and Data Subjects affected;
the likely consequences;
measures taken or proposed to contain or remedy the breach; and
relevant contact information.

Where all information is not immediately available, Bit Monkey may provide it in stages.

Notification of a Personal Data Breach does not constitute an admission of fault or liability.

11. Assistance and compliance

Taking into account the nature of the Processing and information available to Bit Monkey, we will provide reasonable assistance with:

the Customer's security obligations;
Personal Data Breach assessments and notifications;
data protection impact assessments;
prior consultation with supervisory authorities where required; and
demonstrating compliance with the Customer's obligations relating to our Processing.

12. Records and regulatory cooperation

Bit Monkey will maintain records of its Processing where required by Applicable Data Protection Law.

Bit Monkey will cooperate with the Information Commissioner's Office and other competent supervisory authorities where required by law.

13. Return and deletion of data

When provision of the Services ends, Bit Monkey will, at the Customer's choice and subject to the functionality of the Services:

return Customer Personal Data; or
delete Customer Personal Data,

unless applicable law requires us to retain it.

Where the Customer does not request a particular method, Bit Monkey may delete Customer Personal Data in accordance with its normal retention and deletion procedures.

Customer Personal Data may remain temporarily within backups until those backups are overwritten or deleted through the normal backup lifecycle. Such data will remain protected under this DPA and will not be restored except where required for disaster recovery or service continuity.

14. Audits

Bit Monkey will make information reasonably necessary to demonstrate compliance with this DPA available to the Customer.

Where reasonably sufficient, Bit Monkey may satisfy this obligation by providing:

relevant policies;
security documentation;
independent audit or certification reports, if available; and
responses to reasonable security or compliance questionnaires.

If this information is insufficient to demonstrate compliance, the Customer may request an audit.

Audits must:

be directly relevant to Customer Personal Data;
take place no more than once in any twelve-month period unless required following a material security incident or by a regulator;
be conducted on reasonable prior written notice;
take place during normal business hours;
minimise disruption to Bit Monkey and other customers;
protect confidential information belonging to Bit Monkey and other customers; and
normally be conducted at the Customer's expense.

The parties may agree appropriate alternative audit arrangements where physical access to systems or facilities would create a security risk.

15. Costs of assistance

Normal assistance required to comply with Applicable Data Protection Law is included in the Services.

Where a Customer requests unusually extensive, repetitive or bespoke assistance, Bit Monkey may charge reasonable costs after informing the Customer in advance.

16. Liability

The liability provisions and limitations in the Terms apply to this DPA.

Nothing in this DPA limits liability to the extent that Applicable Data Protection Law prohibits such limitation.

17. Order of precedence

If there is a conflict between this DPA and the Terms concerning the Processing of Customer Personal Data, this DPA takes precedence.

If an applicable international transfer mechanism conflicts with this DPA, that transfer mechanism takes precedence to the extent required by law.

18. Term

This DPA takes effect when the Customer becomes bound by the Terms and continues for as long as Bit Monkey processes Customer Personal Data.

Provisions intended to protect Customer Personal Data continue for as long as Bit Monkey retains that data.

19. Governing law

This DPA is governed by the laws of England and Wales.

The courts of England and Wales have exclusive jurisdiction, subject to any rights or requirements that cannot lawfully be excluded under Applicable Data Protection Law.

Schedule 1 — Details of Processing

Subject matter

Processing Personal Data in order to provide indifeed, including collecting, storing, organising, displaying, transmitting, analysing, securing, backing up and deleting data submitted to Customer workspaces.

Duration

For the duration of the Customer's use of the Services and for any subsequent period during which Customer Personal Data remains within normal deletion and backup processes.

Nature and purpose

Processing required to:

collect feedback and related information on behalf of Customers;
store and organise that information;
make it available to authorised Customer users;
support Customer workflows;
provide application functionality;
perform AI-assisted processing requested through the Services;
authenticate users and enforce access control;
maintain service reliability and security;
prevent abuse;
provide support; and
back up and recover the Services.

Categories of Data Subjects

Depending on the Customer's use of the Services:

people submitting feedback;
Customer employees;
Customer contractors;
Customer administrators;
Customer users;
users of the Customer's products or services;
prospective users or customers of the Customer; and
other individuals whose Personal Data is lawfully submitted to the Services by or on behalf of the Customer.

Types of Personal Data

Depending on Customer use:

name;
email address;
account identifiers;
organisation or role information;
feedback and comments;
feature requests;
bug reports;
communications;
attachments;
technical information;
IP address and request metadata;
authentication and security information; and
other Personal Data included by Data Subjects or Customers in submitted content.

Special category data

The Services are not designed to require special category Personal Data.

Such information may nevertheless be contained incidentally in Customer Content where a Customer or Data Subject chooses to provide it.

Schedule 2 — Technical and Organisational Security Measures

Bit Monkey maintains measures appropriate to the nature and risk of the Processing, including:

Access control

production access restricted to authorised personnel;
access granted according to operational need;
administrative access separated from ordinary application access where appropriate;
authentication required for privileged systems; and
access removed when no longer required.

Application security

logical separation of Customer workspaces;
server-side authorisation for access to Customer data;
controlled handling of authentication and session information;
secure configuration of session cookies;
protection against common web application vulnerabilities; and
security-sensitive functionality subject to review and testing.

Network and transport security

encrypted HTTPS/TLS connections for public application traffic;
Cloudflare network and application security controls;
network access restricted to services required for operation; and
administrative services not intentionally exposed publicly unless required.

Infrastructure and data protection

production infrastructure and object storage hosted with Hetzner in Germany and Finland;
production systems separated from development environments where reasonably practicable;
controlled management of infrastructure configuration;
restricted access to databases and storage;
backups appropriate to the Services;
measures to protect backup data against unauthorised access; and
recovery procedures appropriate to the Services.

Software development

source control;
controlled production deployment;
code review appropriate to the risk of changes;
automated testing where appropriate;
dependency management;
security updates and vulnerability remediation according to risk; and
secrets and production credentials kept outside application source code.

Monitoring and incident management

operational and security logging;
Sentry error monitoring in the EU region;
monitoring appropriate to production systems;
investigation of suspicious activity;
documented incident response procedures; and
procedures for handling Personal Data Breaches.

Organisational measures

confidentiality obligations;
data protection responsibilities assigned within Bit Monkey;
periodic review of Subprocessors and relevant service providers;
documented retention and deletion processes; and
security and data protection practices reviewed as the Services evolve.