Version: 2026-08-08 v1.0
This DPA applies where Momentum Digital Labs Ltd processes personal data on behalf of Customer in connection with the Services. Customer acts as controller and Momentum acts as processor unless applicable law requires a different allocation.
The subject matter is the processing necessary to provide, secure, maintain, support and administer the Services. Processing continues for the duration of the applicable Service relationship and any lawful retention period.
Processing may include collection, storage, organisation, retrieval, transmission, classification, analysis, orchestration, deletion and other operations necessary to provide the Services.
Personal data may include account, contact, staff, customer, supplier, business, document, communication, operational, device, authentication, billing and workflow data. Data subjects may include Customer personnel, customers, suppliers, contractors and other individuals whose data Customer lawfully submits.
Momentum will process personal data only on documented instructions from Customer, including instructions expressed through Customer Configuration and use of the Services, unless processing is required by applicable law. Where legally permitted, Momentum will inform Customer before processing required by law.
Momentum will ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations.
Momentum will implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, implementation cost, nature, scope, context and purposes of processing, and risk to individuals.
Customer gives general written authorisation for Momentum to appoint subprocessors where reasonably necessary to provide the Services. Momentum will impose data-protection obligations on subprocessors that are no less protective than those required by applicable law and this DPA.
Momentum will maintain a current subprocessor list and, where required by applicable law, provide reasonable advance notice of material new subprocessors so Customer may raise a documented data-protection objection.
Where personal data is transferred internationally, Momentum will use a lawful transfer mechanism where required, which may include adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or applicable EU Standard Contractual Clauses.
Taking into account the nature of processing and information available to Momentum, Momentum will provide reasonable assistance to Customer with data-subject requests, security obligations, breach notifications, data-protection impact assessments and regulator consultations where required by applicable law.
Momentum will notify Customer without undue delay after becoming aware of a confirmed personal data breach affecting Customer personal data and will provide information reasonably available to Momentum to support Customer's compliance obligations.
On termination of the applicable Service and subject to Customer's available export rights, Momentum will delete or return personal data in accordance with its retention schedule unless retention is required by law, necessary for security, fraud prevention, billing, dispute resolution or legal claims, or remains temporarily in protected backups pending normal rotation.
Momentum will make available information reasonably necessary to demonstrate compliance with applicable processor obligations. Customer may request a reasonable audit no more than once per year unless required following a confirmed breach or by a regulator. Audits must minimise disruption, protect other customers, preserve security and confidentiality, and may be satisfied through independent certifications, reports, questionnaires or remote review where appropriate.
Customer is responsible for the lawfulness of its instructions, data collection, notices, consents, lawful bases, data minimisation, retention requirements and use of the Services.
For data-protection subject matter, this DPA prevails over conflicting provisions in the Momentum Master Platform Terms or applicable Service-Specific Terms, except where mandatory law requires otherwise.
This DPA follows the governing law and jurisdiction provisions of the Momentum Master Platform Terms, subject to mandatory data-protection law.