SCHEDULE 1: PROCESSING OF PERSONAL DATA
1. Definitions
In this schedule the terms data subject, personal data, processing, processor and supervisory authority have the meanings given to them in data protection laws and the following terms have the meaning given below:
adequate country is any country determined by the UK Government as providing an adequate level of protection as set out in Section 17A of the DPA;
incident is any accidental, unlawful, or unauthorised destruction, loss, alteration, processing, disclosure of, or access to any Client data (including any personal data) or to any facilities or systems where such data is maintained; and
IDTA is the ICO's International Data Transfer Agreement for the transfer of personal data from the UK and/or the ICO's International Data Transfer Addendum to the standard contractual clauses set out in European Commission Decision 2021/914.
2. Processing
2.1 Personal data. In relation to personal data processed in connection with the platform:
(a) Client is the data controller and CultureAI is the data processor for the purposes of data protection laws;
(b) a description of the personal data processed by CultureAI and its sub-processors is set out at the end of this schedule (in the format used in the IDTA);
(c) CultureAI and Client will: (i) comply with (and not cause the other to breach) data protection laws, and (ii) promptly (and in any event within 2 business days) inform the other of any relevant notices or requests; and
(d) CultureAI will: (i) process personal data only as set out in this schedule (and CultureAI shall immediately inform Client if, in CultureAI’s opinion, an instruction from Client infringes data protection laws); (ii) not process or transfer (or allow others to process or transfer) personal data outside the United Kingdom, EEA or another adequate country unless in accordance with paragraph 4 (Transfers) below; (iii) impose a duty of confidentiality on its staff in accordance with clause 6.1 (Staff) and implement and maintain appropriate technical and organisational measures for handling Client data, including having an information security policy and restricting access to relevant staff only; (iv) provide Client with such reasonable information and assistance to enable Client to comply with data protection laws in connection with the agreement, including in relation to data protection impact assessments, consulting the supervisory authority, data subjects’ rights, notifying breaches, submitting to audits and inspections and complying with security obligations and (v) delete or deliver up personal data to Client on its request.
2.2 Incidents. CultureAI will inform Client immediately after becoming aware of an incident, take immediate steps to contain the incident and provide any additional information and assistance as reasonably requested by Client.
3. Sub-processors
3.1 Authorisation. CultureAI may engage sub-processors as listed in Annex 1.B of paragraph 5 below (the approved sub-processors) which may be updated from time to time and Client provides a general authorisation for CultureAI to engage sub-processors that is conditioned on the following:
(a) CultureAI will restrict the sub-processor's access to Client data only to what is strictly necessary to provide the platform or operate its business, and CultureAI will prohibit the sub-processor from processing Client data for any other purpose;
(b) CultureAI agrees to impose contractual data protection obligations, including appropriate technical and organisational measures to protect personal data, on any sub-processor it appoints that require such sub-processor protect Client data to the standard required by data protection laws; and
(c) CultureAI will remain liable and accountable for any breach of this schedule that is caused by an act or omission of its sub-processors.
3.2 Additional sub-processors. CultureAI will notify Client if it intends to add or replace approved sub-processors at least 10 days prior to any such changes. If Client objects within such notice period to the appointment of an additional sub-processor on reasonable grounds relating to the protection of Client data, then CultureAI will work in good faith with Client to find an alternative solution. In the event that the parties are unable to find such a solution, Client may terminate the agreement at no additional cost.
4. Transfers
Where CultureAI transfers Client data to sub-processors or other third parties in a location that is not an adequate country, such transfers will take place in accordance with: (i) the IDTA and those clauses will be incorporated into the agreement populated by the information set out in this schedule, or (ii) another lawful transfer mechanism providing appropriate safeguards that meet the requirements of applicable data protection laws.
5. Description of personal data processed
Annex 1.A (Parties)
Exporter (Controller): Client
Importer (Processor): CultureAI
Annex 1.B (Description of Data Processing)
Categories of data subjects: Client’s permitted users
Categories of personal data transferred: Personal data collected by the platform through its use by Client's permitted users.
The baseline data required to provide the platform comprises a permitted user's:
(a) personal identification (first, last and full name);
(b) contact and organisational information (company email address and aliases, job title, business unit or department, working location and line manager, together with such additional directory attributes as Client elects to synchronise from its identity provider or HR system);
(c) account information (unique account identifiers, authentication method (e.g. SSO – single sign-on), securely hashed passwords where CultureAI acts as the identity provider rather than Client’s own SSO solution, and login records including IP address and browser/device information).
Where certain platform modules have been selected by Client the following data is also collected:
Security Awareness & Phishing Simulation
(a) interactions with simulated phishing emails and simulated MFA push requests (delivery, opens, clicks, reports and responses), including IP address and browser/device information;
(b) where enabled by Client, data entered on simulated phishing pages, limited to the username, password complexity metrics and a one-way hash of the password (the password itself is not stored); and
(c) training and quiz records (allocation date, completion time and score), policy acknowledgements and user feedback where provided.
Email Reporting
(d) emails reported by permitted users as suspicious, including content, headers, attachments, sender and recipient details and any comments from the reporting user, which may be analysed by an AI service to assess whether the email is malicious.
Identity & SaaS Risks
(e) web browser activity limited to application logins made with the user’s company email address (or, where Client elects to enable it, other accounts used in the browser), including the website, username, login method, IP address and browser information, for the purpose of identifying security risks such as password reuse, weak or compromised credentials, suspicious logins and malicious websites. General browsing activity is not collected;
(f) authentication metadata, including password complexity metrics and a one-way hash of the password used to identify password reuse and known-compromised passwords (the password itself is not collected);
(g) account identities detected in the browser (email address and identity provider), which may include accounts other than the user’s company account;
(h) where Client connects its identity provider, sign-in records (IP address, approximate location and browser/device information) and MFA registration status.
Collaborative Tool Usage
(i) content of messages sent in Client’s connected collaboration tools (e.g. MS Teams and Slack), which is scanned for potentially sensitive data using Client-configurable pattern matching, with potential matches validated through an EU-hosted AI service operating under Zero Data Retention (ZDR);
(j) where potentially sensitive data is detected, the message with detected sensitive values replaced by placeholder characters, together with the sender, channel and detection metadata, and messages reported by permitted users.
Risk Scoring & Automation
(k) risk scores and risk events derived from the data described above, and records of automated actions (such as training assignments and notifications) taken by workflows configured by Client.
Further personal data may be processed by the platform where Client has requested. Reported emails and collaboration tool messages may contain personal data of individuals who are not permitted users, such as external senders and message participants. No sensitive personal data is intentionally collected by the platform but CultureAI cannot guarantee this will not occur inadvertently where such data has been disclosed by users, is contained in scanned or reported content, or is included in directory attributes that Client elects to synchronise.
Nature and purpose of the processing: As necessary for CultureAI to provide, maintain and improve the platform which may (where Client has selected the relevant module) include operations to facilitate:
(a) (if selected) detection of personal data and other data specified by Client as being particularly sensitive, where excerpts from Client data may be used to create and/or fine-tune our customised models to further enhance the accuracy of detecting such data – such excerpts may include data from instant messages (e.g. from MS Teams, Slack etc.), file matches (e.g. from Google Drive hosted files) or data entered into LLM chats or other AI tools via the web browser (e.g. ChatGPT, or Claude.ai); and
(b) (if selected) email triage where headers and contents of reported phishing emails may be processed by our AI models to support enhanced scoring of risks to help triage.
Such operations use functionality provided by Amazon Web Services (see below).
Duration: While the platform is being used by Client's permitted users.
Sub-processors: The platform is hosted on Microsoft Azure and Amazon Web Services cloud servers in the UK and EU.
Other key sub-processors used to provide the platform are listed on the CultureAI website at https://www.culture.ai/data/subprocessors along with details of their role.
Transfer frequency: Continuous.
Annex 1.C (Competent Supervisory Authority)
Competent Supervisory Authority: The UK Information Commissioner but where the exporter is established in an EU Member State, The Irish Data Protection Commissioner.
Annex 2 (Technical and Organisation Measures)
Technical and organisational measures: CultureAI shall process personal data in accordance with its information security policy (available on request).