Sigora Partner Data Processing Agreement

1. Definitions

1.1 "Data Protection Law" means the UK GDPR and the Data Protection Act 2018, together with any other applicable United Kingdom data protection legislation.

1.2 "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in Data Protection Law.

1.3 "Partner Account Data" means personal data relating to the Partner's personnel that Sigora collects and holds for its own purposes as controller: business contact details provided at signup (work email, name, role, business name and website), billing and subscription records, Console audit trail entries, service and billing emails, and signup security records (including the requesting IP address used for rate-limiting and abuse prevention).

1.4 "End-User Data" means the personal data described in Annex A that arises from End Users' browsers when the Widget is served from the Partner's websites.

1.5 "Sub-Processor" means a third party engaged by Sigora to process End-User Data on the Partner's behalf.

1.6 Capitalised terms not defined here have the meanings given in the Terms.

2. Roles of the parties

2.1 Sigora as processor. For End-User Data, the Partner is the controller (or, where the Partner acts for its own clients, a processor) and Sigora is the Partner's processor. Sections 3 to 12 of this DPA apply to that processing.

2.2 Sigora as controller. For Partner Account Data, Sigora is an independent controller. Sigora processes Partner Account Data to provide and bill the Service, secure its platform, meet its legal obligations and communicate with the Partner, and handles it in accordance with Data Protection Law. Partner Account Data is not subject to the processor clauses of this DPA.

2.3 What the Widget does not do. The parties record, as a matter of fact and of contract: the Widget sets no cookies, uses no cross-site tracking or fingerprinting, serves no advertising, and stores no identifiers about End Users. No third-party analytics or tag-management script of any kind loads inside the Widget. Sigora's own site analytics, including Google Analytics on the Sigora marketing pages, are built as a separate bundle that the Widget does not load and cannot load. Widget interaction events recorded for partner analytics contain the site key, an event token issued by Sigora, the event type and outcome, and technical metadata about the widget session; they are designed to contain no End-User personal data. The only End-User personal data Sigora processes is the transient network data described in Annex A.

2.4 Partner obligations. The Partner warrants that it has a lawful basis under Data Protection Law for the processing it instructs under this DPA, and will reflect the Widget's data flow, as described in section 2.3 and Annex A, in its own privacy notice where Data Protection Law requires it.

2.5 Area Reports. Generating an Area Report is an action taken by the Partner's personnel in the Console: the input is a property location supplied by the Partner, and the output document contains aggregated public-sector statistics and the Partner's business identity. Area Report generation involves no End Users and is designed to process no personal data beyond the Partner Account Data (Console audit trail and billing records) already described in section 2.2. If a property address could identify a living individual in a particular case, the Partner is responsible for its lawful basis for requesting a report on that address. Area Reports are rendered on Sigora's own hosting in Frankfurt; no external document-generation or PDF service is used. To draw report maps, the renderer requests map tiles from OpenFreeMap and rivers-and-sea flood tiles from the Sigora Places host. Tile requests describe the map area around the property, but do not send the property address or the Partner's identity to the tile provider.

3. Subject matter, duration, nature and purpose

3.1 The subject matter, duration, nature and purpose of the processing, the categories of personal data and the categories of data subjects are set out in Annex A, which forms part of this DPA.

3.2 Processing continues for the term of the Terms and for the wind-down period described in section 10.

4. Documented instructions

4.1 Sigora will process End-User Data only on the Partner's documented instructions, including with regard to international transfers, unless required to do otherwise by law applicable to Sigora; in that case Sigora will inform the Partner of the legal requirement before processing, unless that law prohibits doing so.

4.2 The Partner's complete instructions at the Effective Date are: process End-User Data as necessary to (a) serve the Widget on the Partner's Allow-Listed Origins, (b) operate origin checks, rate limits and abuse prevention protecting the Service, and (c) produce aggregate, non-identifying usage analytics for the Partner's Console — each as described in Annex A. Use of the Console (for example, configuring Lenses or registering origins) constitutes further documented instructions within this scope.

4.3 Sigora will inform the Partner without undue delay if, in its opinion, an instruction infringes Data Protection Law.

5. Confidentiality

5.1 Sigora ensures that persons authorised to process End-User Data are bound by contractual or statutory obligations of confidentiality.

6. Security

6.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk to data subjects, Sigora implements appropriate technical and organisational measures to protect End-User Data, including:

• (a) encryption of data in transit using TLS across all Service endpoints;
• (b) hosting on managed cloud infrastructure with access restricted to authorised personnel;
• (c) origin allow-listing, so the Widget is served only to website origins the Partner has registered;
• (d) request rate-limiting and abuse prevention at site, IP and platform level;
• (e) audit logging of administrative actions in the partner platform; and
• (f) data minimisation by design: no End-User cookies, no stored End-User identifiers, and event records that carry no personal data.

6.2 The risk profile of the processing is deliberately low: the End-User Data processed is limited to transient network data, retained only as long as needed for security and delivery.

7. Sub-Processors

7.1 The Partner gives Sigora general written authorisation to engage the Sub-Processors listed in Annex B and to replace or add Sub-Processors in accordance with this section.

7.2 The current list is Annex B below, published on this page and kept up to date. Sigora will give the Partner at least 30 days' notice by email, to the Partner's registered billing address, before adding or replacing a Sub-Processor that processes End-User Data. If the Partner has reasonable data-protection grounds to object, the parties will discuss the objection in good faith; if it cannot be resolved, the Partner may cancel the affected subscription under the Terms with effect from the end of the current billing period.

7.3 Sigora will impose on each Sub-Processor data protection obligations materially equivalent to those in this DPA, and remains liable to the Partner for the performance of each Sub-Processor's obligations.

7.4 For transparency, Annex B also lists providers that process Partner Account Data (where Sigora acts as controller) and notes the map-tile provider. The End User's browser requests its tiles directly when the Widget map renders; Sigora's renderer requests tiles when producing an Area Report. Sigora does not send End-User Data to the map-tile provider.

8. International transfers

8.1 Sigora's Sub-Processors may process personal data outside the United Kingdom, including in the European Economic Area and the United States.

8.2 Where End-User Data is transferred outside the United Kingdom, Sigora will ensure the transfer is covered by a lawful transfer mechanism under Data Protection Law: UK adequacy regulations where they apply (including, for the United States, the UK–US data bridge where the importer participates), and otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, in each case as implemented in the relevant Sub-Processor's terms. Sigora does not claim any certification on its own behalf.

9. Assistance and personal data breaches

9.1 Taking into account the nature of the processing, Sigora will assist the Partner with appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Partner's obligations to respond to data subject rights requests under Data Protection Law. Given the design described in section 2.3, Sigora does not hold data with which it could identify an individual End User; where that makes identification impossible, Sigora will say so and explain why. If a data subject contacts Sigora directly about End-User Data, Sigora will not respond on the Partner's behalf and will pass the request to the Partner without undue delay, unless the law requires Sigora to answer it itself.

9.2 Sigora will assist the Partner, to the extent reasonably required and taking into account the information available to Sigora, with the Partner's obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, and data protection impact assessments and prior consultation).

9.3 Sigora will notify the Partner without undue delay after becoming aware of a personal data breach affecting End-User Data, by email to the Partner's registered billing address, and will provide information reasonably available to it about the nature of the breach, the likely consequences, and the measures taken or proposed to address it, supplementing the notification as further information becomes available.

10. Deletion and return

10.1 On termination or expiry of the Terms, Sigora will, at the Partner's choice, delete or return the End-User Data it holds on the Partner's behalf, and delete existing copies, within 90 days, unless and to the extent the law applicable to Sigora requires continued storage.

10.2 In practice, because End-User Data is transient (Annex A), little or no such data will remain at termination; aggregate analytics, which are designed to contain no End-User personal data, fall outside this section to the extent they contain none.

11. Audit and information rights

11.1 Sigora will make available to the Partner the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Partner or an auditor mandated by the Partner, subject to the conditions in this section.

11.2 The Partner will first exhaust Sigora's written information channel: a written request to [email protected], which Sigora will answer within 30 days. An audit beyond written information may be conducted no more than once in any 12-month period, on at least 30 days' written notice, during business hours, without disrupting the Service, under confidentiality obligations, and at the Partner's cost. An audit required by the Information Commissioner's Office, or following a personal data breach affecting the Partner's End-User Data, does not count toward this limit.

12. Liability and precedence

12.1 Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms, except to the extent Data Protection Law does not permit liability to data subjects or supervisory authorities to be limited in that way.

12.2 If this DPA conflicts with the Terms in relation to the processing of personal data, this DPA prevails. This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, as set out in the Terms.

Annex A — Details of processing (End-User Data)

Annex B — Sub-Processors and service providers

Sub-Processors of End-User Data (section 7):

Providers of Partner Account Data (Sigora as controller — listed for transparency):

Map-tile provider (not a Sub-Processor of End-User Data):