Data Processing Agreement

Version 1.2 - last updated 24 October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between KUZUB LTD, a private limited company registered in Scotland with company number SC890997, whose registered office is at Suite 2/3, 48 West George Street, Glasgow, G2 1BP, United Kingdom ("KUZUB", "we" and "us"), and the Customer. It applies whenever we process Customer Personal Data, and it takes effect when the Customer accepts the Terms of Service.

1. Definitions, roles and precedence

1.1 Words with capital letters that are not defined in this DPA have the meanings given in the Terms of Service. In this DPA:

Customer Personal Data means personal data contained in Customer Content that we process on behalf of the Customer.
Data Protection Law means the UK GDPR and the Data Protection Act 2018; Regulation (EU) 2016/679 (the "EU GDPR"), to the extent that it applies to the processing; the Law of Ukraine "On Personal Data Protection", to the extent that it applies to the processing; and any other law on the protection of personal data that applies to the processing.
Standard Contractual Clauses means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.
Sub-processor means a processor that we engage to process Customer Personal Data.
controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in the UK GDPR or, where the EU GDPR applies, in the EU GDPR.

1.2 The Customer is the controller of Customer Personal Data, and we are its processor. If the Customer processes Customer Personal Data as a processor on behalf of another controller, we are the Customer's sub-processor, and the Customer confirms that the controller has authorised our engagement on the terms of this DPA.

1.3 If this DPA and the rest of the Terms of Service conflict on a matter of data protection, this DPA prevails.

1.4 Annex 1 describes the processing, Annex 2 the technical and organisational measures and Annex 3 the Sub-processors. The annexes form part of this DPA.

2. Instructions

2.1 We process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to a third country, unless the law of the United Kingdom, or of the European Union or a member state to which we are subject, requires us to process it. In that case we inform the Customer of that legal requirement before processing, unless that law prohibits this on important grounds of public interest.

2.2 The Customer's documented instructions are: (a) the Terms of Service, including this DPA; (b) the Customer's use of the Service, including uploading, saving, sharing links to, exporting and deleting Customer Content, sending a File to support and contributing a File to the Engineering Library; and (c) any other instruction that the Customer gives in writing and that we accept in writing.

2.3 In particular, the Customer instructs us to:

delete Files, and the previews, Results and links derived from them, as clause 8.4 of the Terms of Service states;
check every File for the markings described in clause 7.6 of the Terms of Service; where a state or defence security classification marking is detected, stop processing and delete the File at once, and where a commercial confidentiality marking is detected, process the File normally but exclude it from support and from the Engineering Library;
derive from Customer Content only the Technical Statistics listed in clause 8.6 of the Terms of Service, solely to maintain and improve the reliability, compatibility and security of the Service; we do not derive any other information from Customer Content without the Customer's prior written instruction;
for each File that the Customer contributes under clause 10 of the Terms of Service, remove the data listed in clause 10.3 of the Terms of Service before the File is stored in the Engineering Library; and
for each File that the Customer sends to support under clause 9 of the Terms of Service, process it only to answer the request and correct the fault, and delete it as clause 9.4 states.

2.4 We inform the Customer immediately if, in our opinion, an instruction infringes Data Protection Law.

2.5 The Customer is responsible for having a lawful basis for the processing that it instructs, for giving data subjects the information that Data Protection Law requires, including people named on drawings and Clients named in Quotes, and for ensuring that its instructions comply with Data Protection Law. The Customer must not upload special category personal data or personal data relating to criminal convictions and offences.

3. Confidentiality

We ensure that every person whom we authorise to process Customer Personal Data is bound by an obligation of confidentiality, whether contractual or statutory. Our staff access Customer Content only in the cases set out in clause 8.2 of the Terms of Service, and we record each such access.

4. Security

4.1 We implement the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR and of the EU GDPR.

4.2 We may update the measures in Annex 2, provided that the level of protection of Customer Personal Data is not reduced.

5. Sub-processors

5.1 The Customer gives us general written authorisation to engage Sub-processors. The Sub-processors engaged on the date of this DPA are listed in Annex 3.

5.2 We tell the Customer by email at least 30 days before a new or replacement Sub-processor starts to process Customer Personal Data, and we update Annex 3 on the same day. The Customer may object by email to legal@cutmeter.com before the end of that period. If we cannot meet the objection by changing how we provide the Service to that Customer, the Customer may delete its Account or cancel Pro before the new Sub-processor starts; the price paid for the unused part of the Subscription Period is then refunded, calculated in whole days.

5.3 We impose on each Sub-processor, by written contract, data protection obligations that are the same in substance as those in this DPA, providing sufficient guarantees to implement appropriate technical and organisational measures. We remain liable to the Customer for the performance of each Sub-processor's obligations.

6. Transfers

6.1 The Customer authorises the transfers needed to provide the Service as described in section 6 of the Privacy Notice and in Annex 3: storage of Files and of our database in the European Union, processing in the Cloudflare data centre nearest to the user, and access by Sub-processors from third countries under the safeguards stated in Annex 3.

6.2 Transfers of Customer Personal Data from the European Economic Area to us rely on the European Commission's adequacy decision for the United Kingdom. If that decision ceases to apply to such transfers, the Standard Contractual Clauses are incorporated into this DPA from that date, as follows, where clause numbers refer to the Standard Contractual Clauses: Module Two applies where the Customer is a controller and Module Three where the Customer is a processor; the Customer is the data exporter and KUZUB the data importer; clause 7 does not apply; option 2 of clause 9(a) applies, with the notice period stated in section 5.2; the optional wording in clause 11 does not apply; in clause 17 option 2 applies, and the law of Ireland is the law chosen for the case described in it; in clause 18(b) the courts are those of the member state in which the Customer is established; and Annexes 1, 2 and 3 of this DPA complete Annexes I, II and III of the Standard Contractual Clauses. If the Standard Contractual Clauses conflict with this DPA, they prevail.

7. Assistance and personal data breaches

7.1 The Service allows the Customer to access, correct, export and delete Customer Content itself, which is the main way in which we assist the Customer to respond to requests from data subjects. If we receive a request from a data subject concerning Customer Personal Data, we pass it to the Customer within 5 Business Days and do not answer it ourselves, except to tell the data subject that we have passed it on. On request, we give the Customer any further information that we hold and that it needs to answer the request.

7.2 We give the Customer the information about the Service that we hold and that it needs to comply with its obligations on security of processing, notification of personal data breaches, data protection impact assessments and prior consultation of supervisory authorities.

7.3 We notify the Customer of a personal data breach affecting Customer Personal Data without undue delay and no later than 48 hours after we become aware of it, by email to the address of the Customer's Account. The notice describes, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed; where all of this information is not available at once, we provide it in stages as it becomes available. We take the measures needed to contain the breach and reduce its effects.

7.4 If a court or authority asks us to disclose Customer Personal Data, we tell the Customer before we disclose, unless the law forbids this, and we disclose only what we are legally required to disclose.

8. Deletion and return

8.1 Customer Personal Data is deleted as clause 8.4 of the Terms of Service states. When the Customer's Account is deleted, we delete the Customer Personal Data in it within 30 days, and copies in our encrypted backups are overwritten within a further 30 days, unless the law of the United Kingdom or of the European Union or a member state requires us to keep it.

8.2 Before deleting its Account, the Customer can obtain a copy of Customer Content with the export functions described in clause 16 of the Terms of Service. Exporting before deletion is the Customer's way of choosing the return of Customer Personal Data; deleting the Account without exporting is its choice of deletion.

8.3 Technical Statistics and the de-identified geometry in the Engineering Library contain no personal data and are not Customer Personal Data. If our checks find personal data remaining in the Engineering Library, we delete it.

9. Records, information and audits

9.1 We keep a record of the processing that we carry out on behalf of the Customer, as required of processors by Data Protection Law.

9.2 We make available to the Customer the information necessary to demonstrate compliance with Article 28 of the UK GDPR and of the EU GDPR. This consists of this DPA and its annexes and our written answers, given within 30 days, to the Customer's written questions; the Customer may send one set of questions in any 12 months, and further sets after a personal data breach affecting it or when a supervisory authority requires it.

9.3 If the information under section 9.2 is not sufficient to demonstrate compliance, if a supervisory authority requires it or after a personal data breach affecting Customer Personal Data, we allow and contribute to an audit, including an inspection, by the Customer or by an independent auditor whom the Customer appoints and who is bound by confidentiality and is not a competitor of ours. The Customer gives us at least 30 days' written notice; the audit takes place on Business Days, covers only our own premises and systems, and, except after a breach or when a supervisory authority requires it, takes place no more than once in any 12 months. For the premises and systems of Sub-processors, we provide the audit reports and certifications that the Sub-processors make available to us. Each party bears its own costs of an audit.

10. Duration, liability and law

10.1 This DPA applies for as long as we process Customer Personal Data, including after the Terms of Service end.

10.2 Each party's liability under or in connection with this DPA is subject to the limits in clause 17 of the Terms of Service, to the extent that Data Protection Law allows. Nothing in this DPA limits the rights of data subjects under Data Protection Law.

10.3 This DPA is governed by the law of Scotland and is subject to clause 23 of the Terms of Service, except that the Standard Contractual Clauses, when incorporated under section 6.2, are governed by the law and courts stated in that section.

Annex 1 - Details of the processing

Subject matter: the provision of the Service to the Customer under the Terms of Service.
Duration: for as long as the Customer uses the Service, and until deletion under section 8.
Nature: storage; analysis of drawings (reading, measuring and checking geometry); correction of geometry; calculation of Quotes; display; sharing through links that the Customer creates; export; blocking and deletion of Files with state or defence security classification markings; exclusion of Files with commercial confidentiality markings from support and from the Engineering Library; derivation of Technical Statistics; removal of data from Contributed Files; extraction of order details from the text of messages that the Customer pastes into the optional Pro intake helper; and handling of Files sent to support.
Purposes: to provide the Service to the Customer as the Terms of Service describe, to keep it secure and to carry out the instructions in section 2.3.
Types of personal data: names, initials, signatures (as images or as drawn lines), job titles, email addresses, telephone numbers and other identifying details that appear in title blocks, text, attributes, file properties or layer names of Files; names and contact details of Clients entered in Quotes and orders; names and other details of Clients and their staff contained in messages pasted into the intake helper; and names of machine operators in machine reports.
Categories of data subjects: the Customer's staff; the Customer's Clients and their staff; designers, engineers, draughtspersons and approvers named on drawings; and machine operators.
Special categories of personal data: none. The Customer must not upload them.
Frequency: continuous, for as long as the Customer uses the Service.

Annex 2 - Technical and organisational measures

Encryption: all connections to the Service use encrypted HTTPS; Files and our database are encrypted at rest by our providers.
Separation of Accounts: database access rules ensure that each Account can read and change only its own data, and stored Files are kept under keys that are not shared between Accounts.
Separate calculation engine: the calculation engine runs as a separate service without stored data of its own, and its code is not sent to browsers.
Minimisation and retention: Files expire automatically 24 hours after upload unless saved; logs never contain the content of Files, file names or layer or block names, only file size, engine version, time and error codes; Technical Statistics are limited to the fields listed in clause 8.6 of the Terms of Service and are not linked to Accounts; before a message pasted into the intake helper is sent to the language model, email addresses and telephone numbers are removed from it, and neither the message nor the model's answer is stored.
Access control: access to production systems is limited to named staff who need it and is protected by multi-factor authentication; staff open Customer Content only in the cases set out in clause 8.2 of the Terms of Service, and each access is recorded with the date, the person and the reason; Files sent to support can be opened only by support staff.
Markings: Files in which the Service detects a state or defence security classification marking are deleted immediately and are never stored; Files with a commercial confidentiality marking cannot be sent to support or contributed to the Engineering Library.
Contributed Files: the data listed in clause 10.3 of the Terms of Service is removed before storage, and samples of the Engineering Library are checked for remaining personal data.
No real Customer Content in development: we develop and test the Service with synthetic files; real Customer Content is used for that purpose only where it is a Contributed File, a File sent to support for its fault, or Customer Content provided under a separate written agreement with its Customer.
Application security: every request to the Service is validated; payment notifications are accepted only with a valid signature; software dependencies are kept up to date; and each major release receives a security review before it goes live.
Resilience: the Service runs on Cloudflare's network, which protects against denial-of-service attacks; our database is backed up daily in encrypted form, backups are kept for no longer than 30 days, and we test restoration from backup at least once a year.
Incidents: we follow a written incident procedure, including the notification in section 7.3.
Staff: everyone who has access to Customer Personal Data is bound by confidentiality and receives data protection instructions before access is granted.

Annex 3 - Sub-processors

Cloudflare, Inc. (United States of America): hosting and execution of the Service, storage of Files, and network security. Files are stored in the European Union; processing takes place in the Cloudflare data centre nearest to the user. Safeguards for access from third countries: Cloudflare's data processing terms incorporating the Standard Contractual Clauses and the United Kingdom's International Data Transfer Addendum, and Cloudflare's certification under the EU-US Data Privacy Framework and its UK Extension.
Supabase, Inc. (United States of America): database and sign-in system, storing Saved Orders, Rate Cards, Quotes and other Customer Content in the European Union. Safeguards for access from third countries: Supabase's data processing terms incorporating the Standard Contractual Clauses and the United Kingdom's International Data Transfer Addendum.
Plus Five Five, Inc. (Resend) (United States of America): delivery of emails sent by the Service to the Customer, such as sign-in links and notices about order requests, which may contain names and contact details. Safeguards for transfers: Resend's data processing terms incorporating the Standard Contractual Clauses and the United Kingdom's International Data Transfer Addendum.
Anthropic, PBC (United States of America): the language model behind the optional Pro intake helper, which receives the text of a message that the Customer pastes, without email addresses and telephone numbers, to extract the order details. Anthropic does not use the text to train its models and deletes it within 30 days, unless it must keep it longer by law or to enforce its usage policies. Safeguards for transfers: Anthropic's data processing terms incorporating the Standard Contractual Clauses and the United Kingdom's International Data Transfer Addendum.

Paddle is not a Sub-processor: it receives no Customer Content and processes payment data as a controller in its own right.