Data Processing Agreement
Bulk's processor obligations, processing schedule, security measures and international-transfer requirements for customer personal data.
Effective
1. Parties, incorporation and roles
This Data Processing Agreement (“DPA”) applies when incorporated into an accepted order between ManagementSupport LLC, trading as Bulk (“Bulk”), and the customer identified in that order (“Customer”). Bulk’s privacy contact is support@trybulk.app.
Customer is the controller and Bulk is the processor of personal data processed on Customer’s behalf through the Services (“Customer Personal Data”). Where Customer itself acts as a processor, it confirms authority from its controller to appoint Bulk as subprocessor and pass on the instructions and authorisations necessary under this DPA. The applicable order, this DPA and the completed processing schedule form the documented instructions. An employee’s website analytics choice is not an instruction to process their employer’s workspace records.
“Applicable Data Protection Law” means the data-protection laws applicable to the relevant processing, including the EU GDPR, UK GDPR and UK Data Protection Act 2018 as amended, and applicable US state privacy laws. Terms such as personal data, controller, processor and personal data breach have their meanings under the applicable law. The DPA lasts while Bulk processes Customer Personal Data, including authorised retention after the subscription ends.
2. Instructions and permitted use
Bulk will process Customer Personal Data only on documented lawful instructions to provide, maintain, secure and support the Services, including instructions about transfers, unless the applicable law permits a legal requirement to override those instructions. For EU GDPR processing, this exception is limited to Union or Member State law to which Bulk is subject; for UK GDPR processing, it is limited to applicable UK law. Bulk will inform Customer of that requirement before processing unless that law prohibits notice on important grounds of public interest. Other government demands must be assessed under section 8 and cannot automatically override Customer’s instructions. Bulk will promptly inform Customer if, in its opinion, an instruction infringes applicable EU or UK data-protection law and may pause that instruction while the parties resolve it.
Customer determines the purposes of its processing and the appropriateness of its configuration, integrations and user permissions. Customer is responsible for the notices, lawful bases and, where needed, sensitive-data conditions required for its use. Bulk will not use Customer Personal Data for its own unrelated advertising or to train a general-purpose model without separate express agreement and an appropriate legal basis.
Where a US state law requires service-provider or contractor restrictions, Bulk will not sell or share Customer Personal Data as those terms are defined by that law; retain, use or disclose it outside the specified business purposes and direct business relationship except as legally permitted; or combine it with other personal information except as permitted by that law. Bulk will comply with applicable obligations, provide the required level of privacy protection, and notify Customer if it can no longer meet those obligations. Customer may take reasonable and appropriate steps to verify compliant use and to stop and remediate unauthorised use, including through section 7. These restrictions do not reclassify Bulk’s genuinely independent controller activities, which must remain separate and described in the Privacy Notice.
3. Confidentiality and security
Bulk will ensure that people authorised to process Customer Personal Data are subject to contractual or statutory confidentiality obligations and access information only as necessary for their duties. Bulk will apply technical and organisational measures appropriate to the risk, including the agreed measures in Schedule B and the requirements of Article 32 where applicable. Bulk may improve or replace measures without materially reducing the agreed level of protection.
Security descriptions must reflect the applicable deployment. A supplier’s certification does not mean Bulk is certified. Features, written policies and verified operating controls are distinct; an unverified control is not incorporated as an implemented measure merely because it appeared in earlier marketing or a draft questionnaire.
4. Subprocessors
Customer gives general written authorisation for the subprocessors identified in the completed processing schedule and the applicable version of the Subprocessor List. Optional processing is authorised only within Customer’s documented instructions. Before enabling it, the parties must identify the provider, data and transfer arrangements that apply. An unused software dependency is not evidence that the provider has received Customer Personal Data.
Bulk will give the nominated Customer contact at least 30 days’ prior written notice of a proposed addition or replacement affecting Customer Personal Data, including its purpose and processing locations. Customer may object during that period on reasonable data-protection grounds. Bulk will work in good faith to resolve the objection; it will not route the affected data to the disputed provider before resolution. If no reasonable alternative resolves the issue, either party may terminate the affected Services, and Bulk will refund prepaid fees for the unused affected term. The parties may agree a shorter period for a specific change in writing.
Bulk will impose materially equivalent applicable data-protection obligations by written contract on each subprocessor and remains responsible for its performance of those obligations. A global edge network, remote access or message transport is not excluded from assessment simply because it is not the primary database.
5. Requests and assistance
Taking account of the processing and information available to it, Bulk will reasonably assist Customer with individuals’ rights requests and Customer’s obligations concerning security, breach notifications, impact assessments and prior consultation. Bulk will promptly refer a request relating to Customer-controlled information to Customer and will not independently respond substantively except on instructions or where law requires.
Customer should supply the information needed to locate the relevant records and identify the action requested. Bulk must preserve its assistance obligations; any charge for work beyond ordinary support must be reasonable, agreed in advance and must not prevent compliance with mandatory duties. No additional charge applies merely to correct Bulk’s own breach.
6. Personal data breaches
Bulk will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notice will go to the incident contact in the order, or otherwise the nominated customer contact. It will describe, to the extent known, the nature of the breach, affected categories and approximate numbers of individuals and records, likely consequences, action taken or proposed, and a contact for further information. Information may be provided in phases without undue further delay.
Bulk will investigate, take appropriate containment and remediation steps and reasonably cooperate with Customer. Customer is responsible for its own regulatory and individual notifications unless law requires Bulk to notify independently. A processor’s obligation to notify Customer without undue delay is separate from a controller’s regulatory reporting deadline; these Terms do not give Bulk a routine 72-hour waiting period. Notification is not an admission of fault.
7. Demonstrating compliance and audits
Bulk will make available information necessary to demonstrate compliance with its applicable processor obligations and allow and contribute to audits, including inspections, by Customer or a mandated independent auditor. The parties will ordinarily begin with relevant documentation and proportionate remote review, protecting other customers’ information, security-sensitive details and legally privileged material.
Audits should have reasonable notice, defined scope and confidentiality protections and avoid unnecessary disruption. Routine audits are ordinarily limited to once per year, but that limit does not restrict audits needed following a material incident, credible evidence of non-compliance, a regulator’s request or applicable law. No fixed notice period or document-first process prevents an urgent legally required inspection. Customer ordinarily bears its audit costs, except reasonable costs attributable to a confirmed material breach by Bulk. Customer may provide results to its controller or regulator as legally required.
8. International transfers
Primary hosting, backups, logs, support access, email and AI are assessed separately. Bulk will not make a restricted transfer outside the agreed arrangements without the required authorisation and a valid mechanism under Applicable Data Protection Law. A US contracting entity and global AI routing must be considered when determining the parties, locations and transfer protections; a UK or EU server location alone does not settle that assessment.
Schedule C must identify whether a restricted transfer exists and which mechanism is valid for it. Where applicable, the parties may incorporate the European Commission’s approved standard contractual clauses and the UK Addendum by completing the required selections and annex information. The 2021/914 clauses must not be assumed to cover an importer’s processing already subject to the GDPR under Article 3; that situation requires a separately verified valid mechanism. Generic mention of the clauses does not itself complete or execute them.
Required transfer-risk assessments and supplementary safeguards must be completed before the relevant transfer. The parties will cooperate in responding to government demands, challenging unlawful requests where appropriate, and limiting disclosure as the applicable mechanism requires. If lawful protection cannot be maintained, the affected transfer must be suspended and the parties must resolve or end the affected processing consistently with the applicable mechanism.
9. Return, deletion and retention
At Customer’s choice, Bulk will return or delete Customer Personal Data after the end of the processing services and delete existing copies unless retention is required by Union or Member State law for EU GDPR processing, UK law for UK GDPR processing, or the applicable lawful-retention exception for other processing. Other government demands must be assessed under section 8. The completed Schedule A must specify an operationally supported export and deletion arrangement, including the exit-access period, formats, timing for live copies, and the separate backup-expiry schedule. Those particulars are required before adoption; there is no implied universal 30-day all-system wipe.
Where the agreed arrangement permits residual backups to expire on a defined cycle rather than immediate selective removal, they must be isolated from ordinary use, remain protected, expire by the specified deadline, and be subject to reapplication of deletion instructions if restored. This cannot extend retention indefinitely or override a legal deletion requirement. Legally retained information is limited to the necessary scope and period. Bulk will provide confirmation of completed deletion on request, accurately identifying any lawful or scheduled residual retention rather than issuing an unsupported destruction certificate.
10. Liability and precedence
The commercial liability provisions in the applicable agreement apply between the parties only to the extent permitted by law. They do not restrict an individual’s mandatory rights, a regulator’s powers or protections that cannot be restricted under applicable transfer clauses. Mandatory transfer clauses prevail over conflicting provisions; this DPA prevails over other commercial terms for Customer Personal Data. Wyoming commercial law does not override the separate governing-law, forum or enforcement provisions required by a transfer mechanism.
Schedule A. Processing particulars
This schedule is completed through the order’s processing attachment and applies only to the enabled, authorised Services.
| Particular | Processing description / required order detail |
|---|---|
| Subject matter and purpose | Hosting and operating the subscribed manufacturing/laboratory platform, including authorised workflows, identity, reporting, communications and support |
| Nature and frequency | Continuous collection, storage, organisation, retrieval, consultation, transmission, analysis, export and deletion as instructed; AI and external integrations only for enabled operations |
| Duration | The subscribed processing period plus the expressly agreed exit and lawful retention arrangements |
| Individuals | Customer employees, contractors and authorised users; customer and supplier contacts; other individuals referenced in authorised records |
| Personal data | Identity and business contacts; account and access information; attendance and work records; training; workflow records, uploads, photographs and signatures; audit and diagnostic information; communications and selected AI context |
| Sensitive information | Health-related absence and safety/incident information may arise in enabled modules. Identify intended categories, legal conditions, restricted access, minimisation and any additional safeguards before enabling this use. Unagreed sensitive or regulated data is not authorised by default |
| Customer particulars | Legal name, controller/processor role, nominated privacy and incident contacts, authorised controller where relevant |
| Deployment and recipients | Primary location; backup, logging and replay destinations; support-access locations; subprocessors; selected AI and customer integrations |
| Retention and exit | Per-category retention or objective criteria; export formats and method; exit-access period; live deletion deadline; backup expiry and restored-copy procedure; legal holds and confirmation method |
Schedule B. Technical and organisational measures
The order’s security attachment must identify deployment-specific implementation and evidence for these measures. The following describes the control areas to be applied, not a certification or a claim that every deployment has identical settings.
- Access management: unique authenticated identities where applicable, tenant/site and role-based permissions, account/session revocation and restricted administrator access. Confirm MFA and privileged-access arrangements for the deployment.
- Transport and storage: protected connections, access-controlled storage and the agreed encryption/key-management arrangements. Verify coverage of databases, files, backups and logs rather than inferring disk encryption from TLS.
- Operational protection: controlled change and deployment processes, vulnerability handling, security monitoring and incident response appropriate to the risk.
- Records and confidentiality: access appropriate to duties, activity history, minimisation of logged information and restricted support access. Masking configuration must be assessed against the data displayed.
- Continuity and lifecycle: documented backups, restoration procedures, retention, deletion and recovery arrangements, with the agreed evidence of operation and testing.
- Suppliers and transfers: documented approved recipients, contractual protection and the relevant transfer assessments.
Schedule C. Transfer attachment
For each relevant data flow, complete: exporter and importer identities and roles; countries and access locations; whether the importer processing is subject to GDPR Article 3; the valid mechanism and its current version; the required clause/module selections; the competent authority and governing law/forum required by that mechanism; processing and security annexes; approved subprocessors; and the transfer assessment and supplementary measures.
Where the approved UK Addendum is used, complete its parties, selected clauses, appendix information and permitted change/termination selections. Do not replace its mandatory clauses with Wyoming law. Where no restricted transfer occurs, record the factual basis rather than signing an unnecessary mechanism. The attachment must be completed and binding before the relevant transfer is authorised.