This Agreement is made under Article 28 of the UK GDPR between the Client, as controller, and Included AI Limited trading as Clu, as processor. It is attached to the Order Form and forms part of the agreement between the parties, together with the Clu Platform Terms of Service at getaclu.io/terms.

How it is entered into. Signing the Order Form accepts this Agreement. A separate signature below is not required, but is available where the Client’s own process calls for one. The version attached to the Order Form is the version that applies for the term, whatever is later published at getaclu.io.

Where this Agreement and the Terms differ on the processing of personal data, this Agreement takes priority. Terms defined in the Platform Terms of Service have the same meaning here. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018, and any successor or amending legislation, together with guidance and codes of practice issued by the Information Commissioner.

This Agreement sets out the matters Article 28(3) requires a processor contract to contain. It does not repeat the commercial, liability or general provisions of the Terms, which apply to this Agreement as they do to the rest of the engagement. Engagement-specific particulars, including which optional features are enabled, are recorded in the Order Form.

​

1 | What this Agreement covers

​

1.1 Clu processes personal data on the Client’s behalf in order to provide the Platform and the services described in the Order Form.

1.2 Client Data is personal data. The Client supplies structural data at role level, including role and manager identifiers and titles. Those identifiers carry no names, but the Client can link them to individuals using its own records, and a role held by one person can identify that person. Both parties therefore treat Client Data as personal data and this Agreement applies to it in full.

1.3 The Client is controller. Clu is processor, except as set out in clause 1.4.

1.4 One activity where Clu is controller. Clu produces statistics from the operation of its models and anonymises them before using them to refine its benchmark. Clu is controller for the step that produces and anonymises those statistics, relying on its legitimate interests as documented in its Legitimate Interests Assessment (LIA-001), available on request. Once anonymised the statistics are no longer personal data. Client Data itself is never used to refine the benchmark. This activity operates only where the Order Form records that it does, and the Client may stop it at any time. It is outside the scope of this Agreement except as stated in this clause.

​

2 | Clu’s Obligations

​

Clu shall:

• (a) Act only on instructions. Process personal data only on the Client’s documented instructions, including in relation to transfers to a third country, unless required otherwise by law. Where the law requires Clu to process without instruction, Clu will tell the Client before processing unless the law prohibits it. The Order Form, this Agreement and the Terms are the Client’s initial documented instructions; further instructions are given in writing to legal@getaclu.io.

• (b) Flag unlawful instructions. Tell the Client immediately if, in Clu’s opinion, an instruction infringes Data Protection Law.

• (c) Keep people under confidentiality. Ensure that every person authorised to process the personal data, including Clu employees and Delivery Affiliates, is subject to a binding written confidentiality obligation and has completed data protection and security training.

• (d) Secure the data. Implement and maintain the technical and organisational measures of Article 32 of the UK GDPR. Clu may update those measures provided the level of protection is not reduced.

• (e) Control sub-processing. Engage sub-processors only in accordance with clause 4.

• (f) Help with data subject rights. Assist the Client, by appropriate technical and organisational measures and so far as is reasonably possible, in responding to requests from data subjects exercising their rights under Chapter III of the UK GDPR. Clause 6 sets out how.

• (g) Help with the Client’s wider duties. Assist the Client in complying with its obligations under Articles 32 to 36 of the UK GDPR, taking into account the nature of the processing and the information available to Clu. This includes security, personal data breach notification, data protection impact assessments and prior consultation with the Information Commissioner.

• (h) Return or delete at the end. At the Client’s choice, delete or return all personal data at the end of the provision of services, and delete existing copies unless the law requires Clu to keep them. Clause 8 sets out how.

• (i) Demonstrate compliance. Make available to the Client all information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits and inspections conducted by the Client or an auditor it appoints. Clause 7 sets out how.

​

3 | The Client’s Obligations

​

The Client shall:

• (a) Ensure it has a lawful basis for the processing, and that it has given data subjects the transparency information Data Protection Law requires, usually through its existing HR privacy notice. Clu can supply suggested wording.

• (b) Supply only the data fields set out in the data specification, and none of the categories excluded by clause 7.1(a) of the Terms. Where excluded data is supplied in error, Clu removes it on load and does not use it in the modelling.

• (c) Ensure its instructions to Clu comply with Data Protection Law.

• (d) Tell Clu promptly of any personal data breach it becomes aware of that affects data processed under this Agreement.

• (e) Remain responsible for how it uses the outputs, in accordance with clause 4.2 of the Terms and the Acceptable Use Policy.

 

4 | Sub-Processors

​

4.1 The Client gives Clu general written authorisation to engage sub-processors. The sub-processors engaged at the date of this Agreement are listed in the Privacy Policy.

4.2 Delivery Affiliates. Clu engages affiliate consultants to deliver engagements. An affiliate who will access Client Data or the Client’s Platform instance is a sub-processor, is named to the Client in the Order Form before access is given, uses a named Clu account subject to multi-factor authentication, and is bound by obligations no less onerous than those in this Agreement.

4.3 Clu will give the Client at least 30 days’ written notice before adding or replacing a sub-processor. The Client may object on reasonable data protection grounds within that period. Clause 7.4 of the Terms sets out what happens if an objection cannot be resolved.

4.4 Clu imposes on each sub-processor, by written contract, data protection obligations equivalent to those in this Agreement, and remains fully liable to the Client for the performance of each sub-processor’s obligations.

 

5 | Location of Processing and International Transfers

​

5.1 Clu processes and stores the primary copy of Client Data in the United Kingdom.

5.2 Clu holds encrypted backup copies in the Netherlands. The United Kingdom recognises the European Union as providing an adequate level of protection, so no additional transfer safeguards are required for that backup. Clu intends to move backups to the United Kingdom as part of a planned change of hosting provider.

5.3 Clu makes no other transfer of Client Data outside the United Kingdom or the European Economic Area without the Client’s prior written consent. Where such a transfer is agreed, the parties will put in place the UK Addendum to the Standard Contractual Clauses or another lawful transfer mechanism before the transfer takes place. Clause 7.3(e) of the Terms governs notice of any change to where Client Data is processed or stored.

​

6 | Security, Breaches and Data Subject Rights

​

6.1 Security measures. Clu maintains security measures having regard to the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to data subjects.

6.2 Breach notification. Clu will notify the Client without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Client Data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected so far as known, the likely consequences, the measures taken or proposed, and a contact point. Clu will provide further information as the investigation progresses and will cooperate with any notification the Client must make.

6.3 The 48-hour period in clause 6.2 is an obligation owed to the Client. It does not alter the Client’s own obligation, as controller, to notify the Information Commissioner within 72 hours where Article 33 requires it.

6.4 Data subject rights. Where Clu receives a request directly from a data subject relating to Client Data, Clu will not respond to it substantively and will forward it to the Client without undue delay. Because Client Data is held at role level, access, rectification and erasure requests are normally answered from the Client’s own records. On the Client’s written instruction, Clu will locate, correct, restrict, export or delete a record and confirm when it has done so.

6.5 Candidate data. Where the Client enables assessment screening, Clu holds the candidate’s name, the interviewer’s ticked checklist, the interviewer’s score and a figure calculated from those entries. Clu does not assess, score or rank any candidate. Clu will assist the Client in responding to a candidate’s request to see that data.

6.6 Impact assessments. Clu will provide the information the Client reasonably requires for a data protection impact assessment, and makes a pre-populated template available on request.

 

7 | Audit

​

7.1 Clu will make available to the Client the information necessary to demonstrate compliance with this Agreement and with Article 28 of the UK GDPR.

7.2 On reasonable written notice, the Client or an auditor it appoints may audit Clu’s compliance with this Agreement. Audits may be carried out once in any 12-month period, and more often following a material personal data breach or where the Client’s regulator requires it.

7.3 Clu may satisfy an audit request by providing its current certifications, independent penetration test reports, its ISO 27001 control mapping and a technical briefing, where these reasonably address the matters raised. Each party bears its own costs, and an audit shall not unreasonably disrupt Clu’s operations.

 

8 | Return and Deletion

​

8.1 At the end of the provision of services, Clu deletes or returns all personal data at the Client’s choice, and deletes existing copies, unless the law requires Clu to keep them. The export window and deletion timing follow the delivery model recorded in the Order Form and clause 12.4 of the Terms.

8.2 Backup copies are deleted as backups expire, within seven days.

8.3 Clu provides written confirmation of deletion on request.

8.4 Where the law requires Clu to retain personal data, it does so for no longer than the law requires and continues to protect it under this Agreement for that period.

8.5 Anonymised statistics produced under clause 1.4 are not Client Data and are not deleted. They cannot be linked to the Client or to any individual.

​

9 | Details of the Processing

​

Subject matter: Provision of the Clu platform and the services set out in the Order Form: analysis of how work is distributed across the Client’s organisation.

Duration: The term stated in the Order Form, plus the export and deletion periods in clause 8.

Nature and purpose: Collection, storage, structuring, analysis, retrieval and erasure of structural workforce data, in order to produce diagnostic outputs the Client uses to inform its own workforce and organisational decisions. Clu makes no decision about any individual.

Types of personal data

• Core: role identifiers and titles, manager identifiers and titles, team or department, headcount, grade or band, pay ranges at grade level, and job specifications.

• Platform users and approvers: name, work email address, job title, login activity.

• Only where the relevant feature is enabled in the Order Form: survey responses with no name or email stored against them; and, for assessment screening, candidate name, the interviewer’s checklist entries and scores.

• No special category data within the meaning of Article 9, and no criminal offence data within the meaning of Article 10.

Categories of data subject: Employees and workers of the Client, represented at role level. Platform users and approvers at the Client. Where assessment screening is enabled, job candidates of the Client.

Frequency of transfer: One upload for a short diagnostic engagement. For a subscription, as and when the Client uploads or refreshes data, which may be scheduled.

Deletion: As set out in clause 8.

 

10 | Technical and organisational measures

 

These are the measures Clu maintains under Article 32. The full position is set out in Clu’s Technical and Security Overview

Location: Processing and primary storage in the United Kingdom. Encrypted backups in the European Union.

Encryption: AES-256 at rest. TLS 1.2 minimum in transit, with TLS 1.3 supported. Backups encrypted. 

Pseudonymisation: Records are stored against randomised identifiers rather than organisational labels.

Access control: Named individual licences that cannot be shared. Mandatory multi-factor authentication. Role-based access on least privilege. One active device per user, with password reset or trust revocation ending all sessions. Login restricted to the Client’s approved email domains. Configurable inactivity timeouts.

Separation: Each client’s data is held logically separate and is never used to produce another client’s outputs.

Logging: Tamper-evident audit logs of key system activity, exportable to the Client’s security monitoring tool. 

Resilience: Encrypted daily backups with tested restoration. 

Testing: Continuous vulnerability scanning across infrastructure and application layers, severity-based patching with critical findings remediated within 48 hours, and independent penetration testing. [CONFIRM: most recent test date.]

Organisational: Cyber Essentials certification. Mandatory data protection and security training for all personnel. Written confidentiality obligations in every contract of employment and engagement. Pre-employment screening and DBS checks.

Incident response: Documented investigation, containment and notification procedure, with notification to the Client within 48 hours of Clu becoming aware.

​

11 | Sub-processors

A full list of sub-processors is available in our Privacy Policy.

​

​

​