Version 1.0 11/08/2026

Schedule 1: ZURVA DATA PROCESSING AGREEMENT

Version 1.0 – 11 August 2026

This Data Processing Agreement (“DPA”) forms part of the Zurva End User Licence Agreement (“Agreement”) between Zurva Limited (“Zurva”) and the Licence-Holder.

This DPA applies where and to the extent that Zurva processes Personal Data on behalf of the Licence-Holder in connection with the Software.

Data Protection

Where Zurva processes Personal Data on behalf of the Licence-Holder in connection with the Software, that processing shall be governed by the Data Processing Agreement set out in Schedule 1 to this Agreement.

Zurva's processing of Personal Data for its own purposes as a Controller is described in Zurva's Privacy Notice, available at https://zurva.co.uk/privacy-notice.

1. Definitions

Unless otherwise defined in this DPA, capitalised terms have the meanings given to them in the Agreement.

For the purposes of this DPA:

“Applicable Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and any applicable legislation, regulations or binding regulatory requirements relating to the processing of Personal Data.

“Controller”, “Processor”, “Personal Data”, “Processing”, “Data Subject” and “Personal Data Breach” have the meanings given to them under Applicable Data Protection Law.

“Customer Data” has the meaning given in Section 5.2 of the Agreement.

“Sub-processor” means any third party appointed by Zurva to process Personal Data on behalf of the Licence-Holder.

2. Roles of the Parties

2.1 The Licence-Holder is the Controller and Zurva is the Processor in respect of Personal Data processed by Zurva on behalf of the Licence-Holder in connection with the provision of the Software.

2.2 Zurva shall process such Personal Data only:

(a) to provide, operate, maintain, secure and support the Software and associated services;

(b) in accordance with the documented instructions of the Licence-Holder; or

(c) as otherwise required by Applicable Data Protection Law.

2.3 Zurva shall promptly inform the Licence-Holder if, in its reasonable opinion, an instruction from the Licence-Holder infringes Applicable Data Protection Law.

3. Categories and Purpose of Processing

3.1 The subject matter of the processing is the provision of the Software and associated services, including the capture, storage, transmission, processing and export of Customer Data.

3.2 The duration of processing shall be for the duration of the Licence-Holder’s use of the Software, subject to the deletion and retention provisions of this DPA and the Agreement.

3.3 The categories of Personal Data may include, depending on how the Software is used:

(a) names and contact details;

(b) account and professional information;

(c) photographs, images, video, audio or other captured media;

(d) location and property-related information;

(e) building, household or site information that may relate to an identifiable individual;

(f) device, usage and technical information contained within Customer Data; and

(g) any other Personal Data uploaded or otherwise submitted by the Licence-Holder through the Software.

3.4 The categories of Data Subjects may include the Licence-Holder’s employees, contractors, customers, clients, tenants, property owners, occupants and other individuals whose Personal Data is included in Customer Data.

4. Obligations of Zurva

4.1 Zurva shall ensure that persons authorised to process Personal Data are subject to appropriate confidentiality obligations.

4.2 Taking into account the nature of the processing and the risks to Data Subjects, Zurva shall implement appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

4.3 Zurva shall provide reasonable assistance to the Licence-Holder in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law.

4.4 Zurva shall provide reasonable assistance to the Licence-Holder in relation to:

(a) Personal Data Breaches;

(b) data protection impact assessments; and

(c) consultations with the Information Commissioner’s Office or another competent supervisory authority,

in each case taking into account the nature of the processing and information reasonably available to Zurva.

4.5 Zurva shall notify the Licence-Holder without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed on behalf of the Licence-Holder.

4.6 Zurva shall not knowingly do anything which would cause the Licence-Holder to breach Applicable Data Protection Law in relation to the processing of Personal Data by Zurva.

5. Sub-processors

5.1 The Licence-Holder provides Zurva with general authorisation to appoint third-party Sub-processors where reasonably necessary to provide the Software and associated services.

5.2 Zurva shall remain responsible for the performance of its Sub-processors’ obligations relating to the processing of Personal Data.

5.3 Zurva shall require each Sub-processor to comply with data protection obligations providing an appropriate level of protection for Personal Data consistent with this DPA.

5.4 Zurva may maintain and make available a current list of its material Sub-processors. Where reasonably practicable, Zurva shall notify the Licence-Holder of any material change to its Sub-processors.

6. International Transfers

6.1 Zurva shall not transfer Personal Data outside the United Kingdom except where such transfer is permitted under Applicable Data Protection Law and appropriate safeguards are in place.

6.2 Where required, Zurva may rely upon an applicable adequacy regulation, international data transfer agreement, international data transfer addendum, standard contractual clauses or another lawful transfer mechanism recognised under Applicable Data Protection Law.

7. Data Retention and Deletion

7.1 Upon termination of the Agreement, Zurva shall, subject to any applicable legal retention requirement, delete or return Personal Data processed on behalf of the Licence-Holder in accordance with the Agreement and Zurva’s applicable retention procedures.

7.2 Zurva may retain limited Personal Data where required by law, for the establishment, exercise or defence of legal claims, for legitimate security and audit purposes, or where otherwise permitted by Applicable Data Protection Law.

7.3 Where Personal Data is retained under this Section, Zurva shall continue to protect it and shall not process it for any other purpose except as required or permitted by law.

8. Audits and Compliance Information

8.1 Upon reasonable request, Zurva shall make available information reasonably necessary to demonstrate compliance with the obligations applicable to Zurva as a Processor under this DPA.

8.2 The Licence-Holder may, on reasonable written notice and no more than once in any twelve-month period unless required by Applicable Data Protection Law or following a material Personal Data Breach, request reasonable information concerning Zurva’s data protection and security measures.

8.3 Any audit shall be conducted during normal business hours and in a manner that does not unreasonably disrupt Zurva’s operations or compromise the security or confidentiality of other customers’ information.

9. Customer Responsibilities

9.1 The Licence-Holder is responsible for:

(a) determining the purposes and lawful basis for processing Personal Data;

(b) providing appropriate privacy information to Data Subjects;

(c) ensuring that it has the necessary rights and permissions to provide Personal Data to Zurva;

(d) providing lawful and documented instructions to Zurva where required; and

(e) ensuring that its use of the Software complies with Applicable Data Protection Law.

9.2 The Licence-Holder shall not instruct Zurva to process Personal Data in a manner that would knowingly cause Zurva to breach Applicable Data Protection Law.

10. Anonymised and Aggregated Data

10.1 Nothing in this DPA prevents Zurva from using information that has been genuinely anonymised so that individuals are no longer identifiable, or aggregated information that does not identify the Licence-Holder, any Data Subject or any particular property, for Zurva’s legitimate business purposes.

10.2 Such purposes may include:

(a) analysing product performance and usage;

(b) improving the Software;

(c) developing new features and services;

(d) improving spatial measurement, geometry and building-performance functionality;

(e) developing, testing and improving statistical, machine-learning or artificial-intelligence models; and

(f) research, benchmarking and product development.

10.3 Zurva shall not treat pseudonymised or otherwise identifiable Personal Data as anonymous merely because direct identifiers have been removed.

10.4 Where Zurva proposes to use Personal Data for its own independent purposes, including the development or training of AI or machine-learning systems, Zurva shall first determine the appropriate legal basis, transparency requirements, contractual arrangements and other safeguards required under Applicable Data Protection Law.

11. Security and Confidentiality

11.1 Zurva shall maintain appropriate technical and organisational measures having regard to the nature of the Personal Data processed and the risks associated with the processing.

11.2 Such measures may include, where appropriate:

(a) access controls and authentication;

(b) encryption or equivalent protective measures;

(c) secure storage and transmission;

(d) backup and recovery procedures;

(e) measures to protect against unauthorised access;

(f) procedures for managing security incidents; and

(g) confidentiality obligations for personnel with access to Personal Data.

12. Precedence

12.1 In the event of any conflict between this DPA and the Agreement concerning the processing of Personal Data, this DPA shall prevail to the extent of that conflict.

12.2 Nothing in this DPA limits or excludes any liability that cannot lawfully be limited or excluded under Applicable Data Protection Law.

13. Term

13.1 This DPA shall remain in force for so long as Zurva processes Personal Data on behalf of the Licence-Holder.

13.2 Sections which by their nature are intended to survive termination shall continue to apply for so long as necessary to give effect to their purpose.