Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Gareth Bradley, a sole trader trading as Pulse Training ("Pulse", the "Processor") and the organization using Pulse (the "Customer", the "Controller"), and applies whenever Pulse processes personal data on the Customer's behalf — principally, the name, email address, and session responses of the Customer's training participants.

1. Definitions

"Controller", "Processor", "Data Subject", "Personal Data", and "Sub-processor" have the meanings given to them in applicable data protection law (including, where relevant, the UK/EU GDPR).

2. Scope & roles

Pulse processes Personal Data solely to provide the Pulse service, and solely on the Customer's documented instructions (including instructions given by using Pulse's ordinary functionality, e.g. creating and running a training session). The Customer is the Controller for its hosts' and participants' Personal Data; Pulse is the Processor.

3. Annex A — Processing details

• Data subjects: the Customer's hosts, and the participants who join their training sessions.
• Categories of data: names, email addresses, session responses (poll/scenario/discussion/word-cloud answers), and AI-generated coaching/report content derived from those responses.
• Purpose: delivering live training sessions, generating AI coaching/reports where enabled, sending related transactional email, and billing.
• Duration: for the term of the Customer's subscription, plus any retention period described in our Privacy Policy.

4. Sub-processors

The Customer authorizes Pulse to engage the following Sub-processors, each engaged under terms that impose data-protection obligations no less protective than this DPA:

• OpenAI — AI coaching/report generation
• Resend — transactional email
• Paddle — payment processing (Merchant of Record)
• Upstash — short-lived rate-limiting counters
• PostHog — product analytics and crash/error reporting, including session/participant activity
• Railway — application, database, and object storage hosting

We'll give reasonable advance notice before adding or replacing a Sub-processor; the Customer may object on reasonable data-protection grounds within a reasonable period after notice.

5. Confidentiality

Pulse ensures that anyone authorized to process Personal Data is under an obligation of confidentiality.

6. Security measures

Pulse maintains appropriate technical and organizational measures, including: passwordless authentication (no passwords to leak), encryption in transit and at rest, hashed and short-lived sign-in codes, and least-privilege access to production systems.

7. Sub-processing terms

Pulse imposes data-protection obligations on each Sub-processor equivalent to those in this DPA.

8. Assistance with Data Subject rights

Pulse will provide reasonable assistance to the Customer in responding to a Data Subject request relating to data Pulse processes on the Customer's behalf.

9. Personal data breach notification

Pulse will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach affecting the Customer's data.

10. International transfers

Railway (hosting, database, and object storage) and PostHog (analytics) run on EU infrastructure. Where Personal Data is transferred outside the Customer's jurisdiction to any other Sub-processor listed above, Pulse relies on appropriate safeguards, such as Standard Contractual Clauses or an applicable adequacy decision.

11. Audit rights

On reasonable notice and no more than once per year (unless required by a supervisory authority or following a security incident), the Customer may request evidence of Pulse's compliance with this DPA.

12. Deletion or return of data on termination

On termination of the Customer's subscription, Pulse will delete or return the Customer's Personal Data within a reasonable period, except where retention is required by law.

13. Liability & term

This DPA takes effect for as long as Pulse processes Personal Data on the Customer's behalf under the main Terms of Service, and liability under this DPA is subject to the limitations in those Terms.

14. Governing law

This DPA is governed by the same law as the main Terms of Service — see Section 11 there.

Enterprise customers who need a countersigned copy of this DPA (or a customer-specific Annex B of technical and organizational measures) should contact their Pulse account team.