BIMP Beta Data Processing Addendum

Version: v1.0
Effective date: 4 August 2026

1. Scope

This Data Processing Addendum (“DPA”) forms part of the BIMP Beta Terms and Conditions governing your use of BIMP (the “Agreement”).

It applies only where you are the controller of personal data processed through BIMP and Pendrica Ltd is processing that data on your behalf.

Personal data that Pendrica processes for its own purposes, including account management and communications, is covered by the BIMP Beta Privacy Policy.

Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meanings given in the UK GDPR.

2. Your responsibilities

You are responsible for ensuring that:

• you have a lawful basis for the processing;
• any required privacy information has been provided;
• your instructions comply with data protection law; and
• you have the right to provide or make the personal data available to BIMP.

Your use and configuration of BIMP constitute your documented instructions to Pendrica.

3. Pendrica’s responsibilities

Pendrica will:

• process personal data only on your documented instructions, unless required otherwise by law;
• tell you if we believe an instruction infringes data protection law;
• ensure that people authorised to process the data are subject to confidentiality obligations;
• maintain appropriate technical and organisational security measures;
• notify you without undue delay after becoming aware of a personal data breach;
• provide reasonable assistance with data subject requests, security obligations, data protection impact assessments and regulatory enquiries;
• provide information reasonably necessary to demonstrate compliance with this DPA; and
• permit reasonable audits where that information is not sufficient, subject to reasonable notice and appropriate confidentiality and security protections.

4. Subprocessors

You authorise Pendrica to use the subprocessors listed in Schedule 2.

Pendrica may add or replace subprocessors. The current list and any intended changes will be published in Schedule 3. You agree that publication on that page constitutes notice of the change.

Before a new subprocessor begins processing personal data on your behalf, you will have a reasonable opportunity to object by contacting hello@bimp.ai. Any objection must be based on reasonable data protection grounds.

Pendrica will require its subprocessors to provide an equivalent level of data protection and will remain responsible for their compliance with those obligations.

Services that you choose to connect to BIMP, such as repository providers or notification destinations, are not Pendrica’s subprocessors.

5. Hosting and international transfers

BIMP is hosted using Google Cloud’s global infrastructure. Information about Google Cloud’s data processing practices and locations is available in its Cloud Data Processing Addendum and Cloud locations documentation.

Information about Google Cloud’s processing and locations is available in its:

• Cloud Data Processing Addendum; and
• Cloud locations documentation.

Pendrica will ensure that transfers of personal data comply with UK data protection law. Where required, we will use an appropriate safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses.

If you would like to discuss dedicated or privately hosted deployment options, contact hello@bimp.ai.

6. Ending the processing

When your use of BIMP ends, you may ask Pendrica to return or delete personal data processed on your behalf.

If you do not request its return, your instruction is for Pendrica to delete it. Pendrica may retain data where required by law, and data held in backups will be deleted through our ordinary backup deletion process.

7. General

The liability provisions and governing law in the Agreement also apply to this DPA. Nothing limits any rights or liabilities that cannot lawfully be limited.

If this DPA conflicts with the Agreement on the processing of personal data, this DPA takes priority.

This DPA continues for as long as Pendrica processes personal data on your behalf.

Privacy enquiries can be sent to privacy@pendrica.com.

Schedule 1: Processing details

Schedule 2: Approved subprocessors

Schedule 3: New subprocessors

None at present