Data Processing Agreement

Important. These materials describe how The Long Run Group (“TLR”) presents its website and related services, based on the current implementation in this project. They are not legal advice and are not represented as final or binding until a verified contracting party, applicable law, and counsel review are completed. Where a statement depends on corporate registration, hosting region, or contractual arrangements TLR has not published, the text explains the limitation instead of assuming facts.

This document is a draft framework for a Data Processing Agreement (“DPA”) between the verified legal operator of TLR services (not yet published on this site) (“TLR,” “Processor”) and a customer (“Controller”) when TLR processes personal data on the Controller’s instructions in connection with Runner or other services. It is not self-executing and has no legal effect until signed or otherwise formally agreed by authorized representatives of both parties. Executed DPAs, order forms, and master agreements prevail over this summary.

Effective date and governing law for this DPA will be stated in the executed agreement between the parties once the verified contracting party and applicable law are confirmed.

1. Introduction and scope

This DPA applies when TLR processes personal data on behalf of the Controller as a processor (or subprocessor where documented) under applicable data protection law, including UK GDPR and EU GDPR where relevant. It supplements the main services agreement. For TLR’s own marketing site forms and accounts, TLR may act as controller—see the Privacy Policy, not this DPA.

2. Definitions

“Personal data,” “processing,” “controller,” “processor,” “data subject,” and “supervisory authority” have the meanings in applicable data protection law. “Services” means Runner and related TLR offerings described in the order form. “Subprocessor” means a third party engaged by TLR to process personal data on behalf of the Controller. “Security incident” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data processed under this DPA, as defined in applicable law and finalized DPA text.

3. Roles and instructions

The Controller determines purposes and means of processing personal data relating to the Controller’s business use of the Services. TLR processes such personal data only on documented instructions from the Controller, including as set out in the agreement, this DPA, and the Controller’s configuration of the Services, unless required by law (in which case TLR informs the Controller unless prohibited). The Controller is responsible for ensuring a lawful basis and notices to data subjects.

4. Subject matter and duration

Subject matter: provision of the Services and related support. Duration: the term of the main agreement plus any post-termination period needed for return or deletion of data . Annex I (below) summarizes subject matter and duration for GDPR Article 28(3) once completed.

5. Nature and purpose of processing

Processing may include storage, retrieval, organization, transmission, analysis, and display of personal data as necessary to provide marketing operations, collaboration, integrations, support, and AI-assisted features enabled by the Controller . TLR does not use Controller personal data for unrelated TLR marketing except as permitted by law or explicit agreement .

6. Types of personal data and categories of data subjects

The Controller determines categories of data subjects (for example customers, prospects, employees, or end users) and types of personal data submitted to the Services. Annex I to an executed DPA must describe the customer-specific scope. Examples may include contact details, campaign content, usage logs, and identifiers—limited to what the Controller uploads or connects.

7. Processor obligations

TLR shall:

Process personal data only on documented instructions .
Ensure persons authorized to process personal data are bound by confidentiality .
Implement appropriate technical and organizational measures per Section 11 and Annex II .
Engage subprocessors only per Section 8 .
Assist the Controller with data subject requests per Section 12 .
Assist with DPIAs and supervisory authority consultations where required .
Delete or return personal data at end of services per Section 14 .
Make available information necessary to demonstrate compliance and allow audits per Section 13 .
Notify the Controller of instructions that infringe data protection law if TLR believes they do .

8. Subprocessors

The Controller provides general authorization for TLR to engage subprocessors listed on the Subprocessors page when verified, subject to notification and objection rights in the executed DPA . TLR remains responsible for subprocessors’ performance of data protection obligations. Sub-subprocessors are permitted only as allowed in the executed agreement .

9. Controller obligations

The Controller shall: provide lawful instructions; ensure lawful basis and transparency to data subjects; configure the Services appropriately; and not submit special category data unless permitted by agreement and law .

10. International transfers

Where personal data is transferred outside the UK, EEA, or other protected regions, parties will implement appropriate safeguards—such as UK IDTA, EU Standard Contractual Clauses (2021/914), or UK Addendum—as specified in Annex III once completed .

11. Security measures

TLR implements measures described in the Security Overview and Annex II. Measures are designed to ensure a level of security appropriate to risk; they are not a certification unless TLR publishes audit evidence separately .

12. Security incidents

TLR will notify the Controller without undue delay after becoming aware of a Security incident affecting Controller personal data, with information required by applicable law and the executed DPA . TLR will take reasonable steps to mitigate and remediate.

13. Audits and demonstrations of compliance

TLR will make available information reasonably necessary to demonstrate compliance and allow audits as specified in the executed agreement— which may include questionnaires, summaries of certifications if available, or on-site audit under confidentiality and frequency limits .

14. Return and deletion of data

Upon termination or expiry of the Services, TLR will delete or return Controller personal data per the Controller’s choice and documented instructions, subject to legal retention requirements and backup cycles .

15. Liability

Liability under this DPA is subject to the limitation and indemnity provisions of the main agreement .

16. Annexes (to be completed before execution)

Annex I — Description of processing

Annex I (processing description): To be completed in each executed DPA with subject matter, duration, nature and purpose, types of personal data, categories of data subjects, and processing operations aligned to the customer’s Runner configuration.

Annex II — Technical and organizational measures

Annex II (technical and organizational measures): To be completed from verified operational controls (see Security Overview) before execution; do not copy generic security claims into a binding annex without evidence.

Annex III — International transfers

International transfers: Document destinations, transfer mechanisms, and supplementary measures in the executed DPA once subprocessors and regions are confirmed.

Annex IV — Subprocessors

Subprocessors: Reference the published Subprocessors register at execution time; the register must list only verified providers before reliance.

17. How to request an executed DPA

Contact TLR via contact sales, company contact, or Contact TLR via company contact or request demo / sales. Do not rely on this draft for procurement, regulatory filings, or transfer impact assessments until countersigned.