DELLI AI — Data Processing Addendum

Version 1.0 · Effective 27 October 2026

This Data Processing Addendum (DPA) forms part of the agreement between DELLI Limited (DELLI) and its customer (you) under the DELLI AI Terms of Service at delli.ai/legal/terms (the Terms). It applies whenever DELLI processes Customer Personal Data on your behalf. Words defined in the UK GDPR (such as controller, processor, personal data, personal data breach, processing and data subject) have the same meaning here, and other capitalised words have the meaning given in the Terms.

1. Scope and roles

1.1 You are the controller, and DELLI is your processor, of the Customer Personal Data. Annex A describes the processing.

1.2 This DPA applies to processing under the UK GDPR and the Data Protection Act 2018 and, where the EU GDPR applies to your processing, under that too.

1.3 If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails.

2. Instructions

2.1 DELLI will process Customer Personal Data only on your documented instructions, including about international transfers, unless the law requires otherwise. In that case DELLI will tell you before processing, unless the law prohibits it.

2.2 Your instructions are: the Agreement; your use and settings of the Service, including the services you connect and the actions you or your users take or ask the AI Assistant to take; and any other reasonable written instructions consistent with the Agreement. You instruct DELLI to process Customer Personal Data to provide, secure and support the Service, and to comply with law.

2.3 DELLI will tell you promptly if it believes an instruction breaks data protection law, and is not obliged to follow it.

2.4 You are responsible for the lawfulness of your instructions and of the Customer Personal Data, including having a lawful basis and giving data subjects the information the law requires.

3. DELLI's own processing

3.1 DELLI is a controller, not your processor, for personal data about your users that it needs to run its relationship with you, such as account, billing, support and usage data, as described in its Privacy Policy.

3.2 DELLI is also a controller when it keeps limited samples of data to check and improve the accuracy of the Service under section 5.3 of the Terms, and when it creates Aggregated Data under section 5.5 of the Terms. That processing is not carried out under this DPA.

4. DELLI personnel

DELLI will ensure that people it authorises to process Customer Personal Data are bound by confidentiality obligations, and only access it as needed to provide the Service, support or onboard you, keep the Service secure, or as section 5.3 of the Terms allows.

5. Security

5.1 DELLI will maintain the technical and organisational measures in Annex B, which are designed to meet Article 32 of the UK GDPR. DELLI may update them, provided the overall level of protection is not reduced.

5.2 You are responsible for how you use the Service, including keeping credentials secure, managing your users and choosing which services to connect.

6. Sub-processors

6.1 You give DELLI general authorisation to engage sub-processors. DELLI will give you its current list of sub-processors on request to data@delli.com.

6.2 DELLI will give at least 30 days' notice before adding or replacing a sub-processor, by email to Administrators who have asked to be notified. You may object on reasonable data protection grounds within 14 days of the notice. The parties will discuss the objection in good faith. If it cannot be resolved, you may end the affected part of the Service by notice, and DELLI will refund any Fees you have paid for the period after it ends. This is your only remedy for an objection.

6.3 DELLI will impose data protection obligations on each sub-processor that are no less protective than this DPA, and remains liable to you for each sub-processor's performance of them.

6.4 Providers of services you connect to the Service are not DELLI's sub-processors. You choose them, and data you send to them is governed by your agreement with them.

7. International transfers

7.1 DELLI stores Customer Personal Data in the UK or the European Economic Area. DELLI may transfer it outside the UK, or allow a sub-processor to, only where: (a) UK adequacy regulations cover the destination, including the EEA and, for certified recipients, the UK Extension to the EU-US Data Privacy Framework; (b) the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses is in place, with a transfer risk assessment; or (c) data protection law otherwise allows the transfer.

7.2 You authorise transfers to the sub-processors on DELLI's list, made in line with paragraph 7.1.

8. Data subject requests

8.1 If DELLI receives a request from a data subject about Customer Personal Data, it will pass it to you without undue delay, and will only respond to tell the data subject to contact you, unless you instruct otherwise.

8.2 DELLI will give you reasonable help to respond to data subject requests, through the Service's functions or otherwise. DELLI may charge its reasonable costs for help beyond what the Service's functions provide.

9. Personal data breaches

9.1 DELLI will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

9.2 The notice will describe, as far as DELLI then knows: the nature of the breach; the categories and approximate numbers of data subjects and records affected; its likely consequences; and the measures taken or proposed. DELLI will provide further information as it becomes available and take reasonable steps to contain and remedy the breach.

9.3 You are responsible for notifying the Information Commission and data subjects where required. A notice from DELLI is not an admission of fault or liability.

10. Impact assessments

Taking into account the nature of the processing and the information available to it, DELLI will give you reasonable help with data protection impact assessments and prior consultations with the Information Commission that relate to the Service. DELLI may charge its reasonable costs for this.

11. Return and deletion

When the Agreement ends, DELLI will return and delete Customer Personal Data as set out in section 15.8 of the Terms, unless the law requires DELLI to keep it. Copies in backups are deleted as the backups expire and, until then, are kept secure and not actively processed.

12. Information and audits

12.1 DELLI will make available the information reasonably needed to show that it complies with this DPA, including by answering a reasonable written security questionnaire once in any 12-month period.

12.2 You (or an independent auditor bound by confidentiality who is not a competitor of DELLI) may audit DELLI's compliance with this DPA only where: that information is not enough to show compliance; a regulator requires it; or after a personal data breach. You must give at least 30 days' notice, audit during business hours, and not disrupt DELLI's business or compromise other customers' data. Audits may take place no more than once in any 12-month period, and are at your cost.

13. Liability

13.1 Each party's liability under or in connection with this DPA is subject to section 13 of the Terms.

13.2 Where both parties are liable to a data subject for the same damage, each is responsible for the share that reflects its own responsibility, as provided in Article 82 of the UK GDPR. DELLI is liable for damage caused by processing only where it has not complied with the obligations of the UK GDPR that apply to processors, or has acted outside or against your lawful instructions.

13.3 Section 14.1 of the Terms applies to claims, fines and costs arising from your instructions or from your breach of data protection law.

Annex A: Details of the processing

Item	Description
Subject matter	Providing the DELLI AI Maker Hub service to the customer
Duration	The term of the Agreement, and afterwards until deletion under section 15.8 of the Terms
Nature of processing	Collecting data from services the customer connects; storing, organising and displaying it; analysing messages and documents with AI to identify and extract orders; matching customers and products; creating and updating records in connected services; sending messages the customer sets up or approves; deleting data
Purposes	Managing the customer's orders, customers, stockists, products, prices and invoices; answering the customer's questions and carrying out tasks they request through the AI Assistant and routines; support and onboarding; keeping the Service secure
Data subjects	The customer's own customers (such as retailers, wholesalers and distributors) and their staff; the customer's suppliers, carriers and other business contacts; people who send or receive messages in a mailbox or channel the customer connects; the customer's staff; and consumers who buy from the customer, where the customer imports retail orders from a connected store
Categories of personal data	Names, job titles and business names; email addresses, phone numbers, and postal and delivery addresses; order and transaction details (products, quantities, prices, discounts, payment terms, invoice numbers, delivery notes); the content of emails, attachments and messages, including signatures and any other information senders include; identifiers in connected services
Special category data	None intended. Connected mailboxes may incidentally contain other information that senders include
Frequency	Continuous

Annex B: Security measures

DELLI maintains these measures, and reviews them regularly:

Access control: access to Customer Personal Data is limited to personnel who need it for their role, granted on the principle of least privilege, reviewed regularly and logged.
Staff authentication: single sign-on for staff access to production systems, with multi-factor authentication required.
Encryption: data encrypted in transit and at rest; credentials for connected services stored with additional encryption.
Separation: each customer's data kept logically separate, with every request checked against the customer it belongs to.
Customer authentication: password rules, verified email addresses, rate limits on sign-in and verification, and multi-factor authentication available to users.
Infrastructure: hosting with a leading cloud provider certified to recognised security standards, in private networks with firewalls.
Resilience: regular backups kept for a limited period, and recovery procedures.
Monitoring: logging, monitoring and alerting on production systems, with logs kept for a limited period.
Secure development: code review, dependency and vulnerability scanning, and controlled releases.
People: confidentiality obligations for staff and contractors.
Incidents: a documented incident response process and a vulnerability disclosure policy.
Suppliers: due diligence on sub-processors and written data protection terms with each.

DELLI Limited · Company number 13063011 · 9th Floor, 107 Cheapside, London, England, EC2V 6DN

Support: support@delli.com · Data protection: data@delli.com · ICO registration ZB313119