Effective Date: 20th October 2025
This Data Processing Addendum ("DPA") forms part of the Master Services Agreement ("MSA") between Big Decisions and Client (each a "Party" and together the "Parties").
This DPA sets out the terms that apply when Big Decisions processes Personal Data on behalf of Client in connection with the Services provided under the MSA.
"Controller" means the entity which determines the purposes and means of the Processing of Personal Data. For the purposes of this DPA, Client is the Controller.
"Data Protection Laws" means all applicable laws and regulations relating to privacy and data protection, including but not limited to: (i) the GDPR; (ii) the UK GDPR and Data Protection Act 2018; (iii) the Swiss Federal Act on Data Protection (FADP); (iv) the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA); and (v) any other applicable national, state or provincial data protection laws.
"Data Subject" means an identified or identifiable natural person whose Personal Data is Processed under this DPA.
"GDPR" means the General Data Protection Regulation (EU) 2016/679.
"Personal Data" means any information relating to an identified or identifiable natural person that is Processed by Big Decisions on behalf of Client under the MSA.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.
"Processing" (and "Process", "Processes", "Processed") means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
"Processor" means the entity which Processes Personal Data on behalf of the Controller. For the purposes of this DPA, Big Decisions is the Processor.
"Services" means the services provided by Big Decisions to Client as described in the MSA, including but not limited to Forecast (NLP and predictive analytics), On the Call (real-time AI guidance), Train-AI (AI-based training), Insights (analytics and reporting), and any other services as may be agreed between the Parties.
"Standard Contractual Clauses" or"SCCs" means the standard contractual clauses for the transfer of Personal Data to third countries pursuant to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
"Sub-processor" means any third party appointed by Big Decisions to Process Personal Data on behalf of Client.
"Supervisory Authority" means an independent public authority established by a Member State pursuant to Article 51 GDPR or equivalent authority under other Data Protection Laws.
In the event of any conflict or inconsistency between the provisions of this DPA and the MSA, the following order of precedence shall apply with respect to the Processing of Personal Data and compliance with Data Protection Laws:
For all matters not related to Personal Data Processing or Data Protection Laws, the MSA shall prevail.
This DPA applies to all Processing of Personal Data by Big Decisions on behalf of Client in connection with the Services provided under the MSA.
Client is the Controller of the Personal Data and is responsible for:
Big Decisions is the Processor and shall:
Subject Matter: Processing of Personal Data in connection with the provision of AI-powered communication intelligence, analytics, and coaching services.
Duration: For the duration of the MSA, unless terminated earlier in accordance with this DPA.
Nature and Purpose: To enable Big Decisions to provide the Services, including analysis and insights, real-time guidance, training and development, reporting and analytics, service delivery, customer support, and service improvement (only with Client's consent).
Categories of Data Subjects:
Types of Personal Data:
Special Categories of Personal Data: Client warrants that it shall not submit Special Categories of Personal Data (as defined in Article 9 GDPR) or Personal Data relating to criminal convictions and offences without Big Decisions' prior written consent and implementation of additional safeguards.
Big Decisions shall Process Personal Data only on documented instructions from Client, unless required to do so by applicable law. If Big Decisions believes that any instruction violates Data Protection Laws, it shall immediately inform Client and may suspend performance until Client confirms or modifies the instruction.
Big Decisions shall ensure that all persons authorised to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Access to Personal Data is limited to personnel who require such access to perform the Services.
Big Decisions shall maintain written records of all categories of Processing activities carried out on behalf of Client as required by Article 30(2) GDPR.
Big Decisions shall assist Client by implementing appropriate technical and organisational measures to enable Client to respond to requests from Data Subjects exercising their rights under Data Protection Laws, including rights of access, rectification, erasure, restriction, data portability, objection, and rights related to automated decision-making.
If Big Decisions receives a request directly from a Data Subject, it shall forward the request to Client without undue delay and shall not respond except on Client's documented instructions or as required by law.
Big Decisions shall provide Client with commercially reasonable assistance in responding to Data Subject requests within thirty (30) calendar days of Client's written request, or such shorter period as required by applicable Data Protection Laws.
Big Decisions shall provide reasonable assistance to Client in:
Big Decisions shall make available to Client all information necessary to demonstrate compliance with the obligations laid down in this DPA and Data Protection Laws.
In the event of a Personal Data Breach, Big Decisions shall notify Client without undue delay and in any event within forty-eight (48) hours of becoming aware of the breach.
The notification shall include, to the extent possible:
Big Decisions shall cooperate with Client and provide such further information and assistance as reasonably required to enable Client to comply with its obligations under Data Protection Laws, including notification to Supervisory Authorities and Data Subjects where required.
Big Decisions shall document all Personal Data Breaches and make such documentation available to Client upon request.
Big Decisions shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.
Such measures shall include, at a minimum:
Encryption:
Access Controls:
Network Security:
Data Integrity:
Availability and Resilience:
Testing and Evaluation:
Physical Security:
Organisational Measures:
AI Services: Client acknowledges that certain Services incorporate artificial intelligence and machine learning technologies, including Forecast (NLP), On the Call (real-time AI guidance), and Train-AI (AI-based training).
Transparency: Big Decisions shall provide Client with reasonable information about the logic involved in AI-based Processing, the significance and consequences for Data Subjects, and measures to ensure accuracy and prevent bias.
Automated Decision-Making: Where Services involve automated decision-making that produces legal effects or similarly significantly affects Data Subjects (Article 22 GDPR):
AI Training Data: Where Personal Data is used to train, test or improve AI models:
AI Security Measures:
Client shall have the right, upon reasonable written notice (not less than thirty (30) calendar days) and during normal business hours, to audit Big Decisions' compliance with its obligations under this DPA.
Client may conduct or commission audits no more than once per calendar year, unless:
Audits shall be conducted in a manner that does not unreasonably interfere with Big Decisions' business operations. Any auditor appointed by Client must execute a confidentiality agreement, be independent and not a competitor of Big Decisions, and conduct the audit in accordance with industry-standard practices.
Client shall bear all costs associated with audits, including reasonable costs incurred by Big Decisions in facilitating the audit.
If an audit reveals non-compliance, Big Decisions shall take prompt action to remedy such non-compliance within a timeframe agreed with Client, taking into account the nature and severity of the non-compliance.
Client provides general authorisation for Big Decisions to engage Sub-processors to Process Personal Data, subject to the requirements of this Section 8.
Current Sub-processors include:
Big Decisions shall inform Client of any intended changes concerning the addition or replacement of Sub-processors at least thirty (30) calendar days prior to authorisation. Notification shall include the Sub-processor's name, location, description of Processing activities, and transfer mechanism if located outside the EEA.
Client may object to Big Decisions' use of a new Sub-processor on reasonable grounds relating to data protection by notifying Big Decisions in writing within fifteen (15) calendar days. If the Parties cannot reach a resolution within thirty (30) calendar days, Client may terminate the affected Services without penalty.
Big Decisions shall enter into a written agreement with each Sub-processor imposing data protection obligations substantially equivalent to those in this DPA. Big Decisions remains fully liable to Client for the performance of any Sub-processor's obligations.
Personal Data shall be Processed and stored primarily within the European Economic Area (EEA) or in countries recognised by the European Commission as providing an adequate level of data protection.
Client acknowledges that the provision of the Services may require the transfer of Personal Data to countries outside the EEA. Any such transfers shall be made in accordance with applicable Data Protection Laws and subject to appropriate safeguards.
Where Personal Data is transferred to countries not recognised as providing adequate protection, Big Decisions shall implement appropriate safeguards, including:
Standard Contractual Clauses: The Standard Contractual Clauses adopted by European Commission Decision 2021/914 (Module Two: Controller to Processor) shall apply to such transfers. For UK transfers, the UK International Data Transfer Addendum applies. For Swiss transfers, the Swiss FDPIC-approved modifications apply.
Data Privacy Framework: Where Big Decisions or Sub-processors are certified under the EU-U.S. Data Privacy Framework, UK Extension, or Swiss-U.S. DPF, such certification may serve as an additional transfer mechanism.
In addition to SCCs, Big Decisions implements supplementary measures including:
Big Decisions shall:
Personal Data may be transferred to:
Big Decisions shall retain Personal Data only for as long as necessary to provide the Services or as required by applicable law.
Upon termination or expiry of the MSA, or upon Client's written request, Big Decisions shall, at Client's election:
Client must notify Big Decisions of its election within thirty (30) calendar days of termination. If Client fails to provide such notification, Big Decisions shall delete all Personal Data.
Big Decisions shall complete the deletion or return within sixty (60) calendar days.
Upon completion of deletion, Big Decisions shall provide Client with written certification that all Personal Data has been deleted.
Big Decisions may retain Personal Data to the extent required by applicable law. Any such retained data shall continue to be subject to the confidentiality and security obligations of this DPA and shall be deleted as soon as the legal requirement no longer applies.
Personal Data in backup systems shall be deleted in accordance with Big Decisions' standard backup retention procedures, which shall not exceed ninety (90) calendar days from the date of deletion of primary data.
Upon Client's request, Big Decisions shall provide Personal Data in a structured, commonly used and machine-readable format (JSON, CSV, XML, or other format as reasonably requested and technically feasible).
Big Decisions shall provide exported data within thirty (30) calendar days of receiving Client's written request, or such shorter timeframe as required by Data Protection Laws.
Exported data shall be transferred securely using encryption and secure file transfer protocols.
Data portability requests made in connection with termination of the MSA or as required by Data Protection Laws shall be provided at no additional cost. Additional or frequent requests may be subject to reasonable fees.
Client represents and warrants that:
If Big Decisions becomes aware that it is Processing Personal Data of a child without appropriate consent, it shall notify Client immediately and shall delete such data upon Client's instruction.
Big Decisions shall implement appropriate additional safeguards when Processing children's Personal Data, including stricter access controls, enhanced security measures, and limitations on profiling and automated decision-making.
Big Decisions shall be liable for any damage caused by Processing where it has not complied with obligations specifically directed to Processors under applicable Data Protection Laws or where it has acted outside or contrary to lawful instructions of Client.
Big Decisions shall indemnify and hold harmless Client from and against all claims, losses, damages, liabilities, costs and expenses (including reasonable legal fees) arising from any breach by Big Decisions of its obligations under this DPA or applicable Data Protection Laws, except to the extent such claims arise from Client's instructions or Client's breach of its obligations.
Any limitation of liability provisions in the MSA shall apply to this DPA, except where such limitations are prohibited by applicable Data Protection Laws. Nothing in this DPA shall limit or exclude either Party's liability for fraud, gross negligence, wilful misconduct, breach of confidentiality, or matters for which liability cannot be limited under applicable law.
This DPA shall remain in effect for as long as Big Decisions Processes Personal Data on behalf of Client under the MSA.
Upon termination:
Either Party may terminate this DPA (and, at its option, the MSA) with immediate effect by written notice if the other Party commits a material breach and fails to remedy such breach within thirty (30) calendar days of receiving written notice.
Client may terminate immediately if a Supervisory Authority orders suspension of transfers or if Big Decisions is unable to provide appropriate safeguards for international data transfers.
This DPA shall be governed by and construed in accordance with the laws of Spain without regard to conflict of law provisions.
The courts of Madrid shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this DPA.
No amendment or modification to this DPA shall be valid unless made in writing and signed by authorised representatives of both Parties.
If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect.
This DPA, together with the MSA, constitutes the entire agreement between the Parties regarding the Processing of Personal Data and supersedes all prior agreements relating to such subject matter.
All notices under this DPA shall be in writing and delivered by email or registered post to the addresses set out in the MSA. Notices by email are deemed received upon transmission; notices by post are deemed received five (5) business days after posting.
No person who is not a party to this DPA shall have any right to enforce any term, except that Data Subjects shall be third-party beneficiaries of Sections 4, 5, 6, and 9.
For questions or concerns regarding this DPA or data protection matters, please contact:
Big Decisions Data Protection Officer Email: privacy@the297.com Address: Calle Arroyo del Soto,2,28914, Leganés, Madrid
Last Updated: 20th October 2025
