Legal Document
Data Processing
Agreement
Effective date: 25 June 2026 · Version 1.0
Section 01
Purpose
This Data Processing Agreement ("DPA") governs the processing of personal data by AI by EDM on behalf of clients in connection with the provision of AI architecture and development services.
This DPA forms part of the service agreement between AI by EDM and the Client. Where there is conflict between this DPA and the main service agreement in relation to data protection matters, this DPA shall prevail.
This DPA is designed to comply with the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Section 02
Roles of the Parties
The Client
Data Controller
Determines the purposes and means of processing personal data
AI by EDM
Data Processor
Processes personal data solely on the Controller's instructions
AI by EDM agrees to process personal data only as a Data Processor acting under the documented instructions of the Client, unless otherwise required by applicable UK law.
Section 03
Processing Activities
| Activity | Description |
|---|
| AI system development | Using client data to train, fine-tune, test, or configure AI models and systems |
| System testing | Processing data to verify AI system performance, accuracy, and safety |
| Integration | Connecting AI systems to client databases, CRMs, and APIs that contain personal data |
| Deployment support | Monitoring and troubleshooting live AI systems that process personal data |
Section 04
Categories of Personal Data
The categories of personal data processed will depend on the specific project. They may include:
- Names, email addresses, and contact details
- Professional information (job titles, employer, industry)
- Behavioural and interaction data
- Usage data from client systems
- Any other personal data provided by the Client for AI system development
AI by EDM does not process special category data (as defined by UK GDPR Article 9) unless explicitly agreed in writing and with appropriate additional safeguards in place.
Section 05
Processor Obligations
AI by EDM agrees to:
- Process personal data only on the documented instructions of the Client
- Ensure all personnel with access to personal data are subject to confidentiality obligations
- Implement appropriate technical and organisational security measures
- Not engage subprocessors without prior written consent (except those listed in Section 6)
- Assist the Client in meeting its UK GDPR obligations, including data subject rights requests and DPIAs
- Make available information necessary to demonstrate compliance upon written request
- Notify the Client if any instruction appears to infringe applicable data protection law
Section 06
Subprocessors
The Client provides general written authorisation for AI by EDM to engage the following categories of subprocessors:
| Subprocessor Type | Purpose |
|---|
| AI model providers (e.g. OpenAI, Anthropic, Google) | Foundation model APIs used in AI system development |
| Cloud hosting providers | Infrastructure for AI system deployment |
| Development tools and platforms | Software used in building and testing AI systems |
AI by EDM will notify the Client of any intended changes to subprocessors, giving the Client the opportunity to object. All subprocessors are required to maintain data protection standards equivalent to this DPA.
Section 07
International Transfers
Some subprocessors, particularly AI model providers, may transfer and process data outside the United Kingdom. Where this occurs, AI by EDM ensures appropriate safeguards are in place including UK Adequacy Regulations, Standard Contractual Clauses (SCCs) approved by the ICO, or other recognised transfer mechanisms.
Section 08
Security Measures
AI by EDM implements appropriate technical and organisational measures including:
- Access controls and role-based permissions limiting data access to authorised personnel
- Use of encrypted communication and storage where appropriate
- Secure development practices and code review processes
- Regular review of access rights when team members change
- Use of security-certified third-party platforms
Section 09
Data Breaches
In the event of a personal data breach, AI by EDM will notify the Client without undue delay and where feasible within 72 hours of becoming aware. Notification will include the nature of the breach, categories and approximate numbers of affected individuals and records, likely consequences, and measures taken or proposed.
Section 10
Data Deletion
Upon project completion or termination, AI by EDM will, at the Client's election, securely delete or return all personal data processed under this DPA, within a reasonable timeframe. Deletion will be confirmed in writing upon request, except where retention is required by applicable law.
Section 11
Governing Law
This DPA is governed by the laws of England and Wales.
On behalf of the Client (Data Controller)
Authorised signature
Name & title
Date
On behalf of AI by EDM (Data Processor)
Authorised signature
Name & title
Date
Second document on this page
Acceptable Use Policy
Effective date: 25 June 2026 · Version 1.0
What this policy covers
This Acceptable Use Policy governs how you may use our website and any AI systems, tools, or services built and deployed by AI by EDM. Use of our services constitutes acceptance of this policy.
Permitted Use
What You May Do
- Use AI systems for the specific business purpose agreed in your project contract
- Access our website for legitimate information and enquiry purposes
- Share AI system outputs internally within your organisation for legitimate business use
- Provide feedback to us to help improve system performance
Prohibited Use
What You May Not Do
You must not use our website or any AI systems we build to:
- Generate, distribute, or facilitate illegal content of any kind
- Produce or spread misinformation, disinformation, or deliberately misleading content
- Harass, threaten, intimidate, or abuse any individual or group
- Create content that is discriminatory on the basis of race, gender, religion, disability, sexual orientation, or any other protected characteristic
- Generate spam, phishing content, or unsolicited commercial communications
- Attempt to bypass, manipulate, or circumvent AI system safety measures (including prompt injection or jailbreaking)
- Reverse engineer, decompile, or attempt to extract model weights or proprietary components
- Use AI outputs to make automated decisions about individuals without appropriate human oversight and legal basis
- Process personal data in ways that violate UK GDPR or the Data Protection Act 2018
- Generate content that infringes the intellectual property rights of third parties
- Use AI systems for purposes other than those agreed in the project contract without our written consent
- Conduct or facilitate any criminal activity
- Create deepfakes, synthetic media, or impersonations without the explicit consent of the individuals involved
- Generate content related to weapons, explosives, or other means of causing physical harm
- Process special category data (health, biometric, political, religious etc.) without our explicit written agreement and appropriate safeguards
Enforcement
Consequences of Violation
Violation of this Acceptable Use Policy may result in:
- Immediate suspension or termination of access to AI systems
- Termination of the project or service agreement
- Legal action where violations constitute unlawful activity
- Reporting to relevant regulatory authorities where required