Legal
Data processing agreement
Last updated 12 October 2026
This is Incbury's standard data processing agreement (DPA). It forms part of our terms of use for customers who use Incbury on behalf of an organisation and applies without needing to be signed.
If you need a countersigned copy, request one with your organisation's legal name and we will return it signed by Foundry Systems Ltd (company number 16940612, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom).
1. Scope and roles
This DPA applies where Foundry Systems Ltd ("Incbury") processes personal data on behalf of a customer ("Customer") through Incbury Chat, Teams, Business or the developer platform (the "Service"). Customer is the controller and Incbury is the processor. It applies under the UK GDPR, the Data Protection Act 2018 and, where relevant, the EU GDPR.
2. Instructions
Incbury processes Customer personal data only on Customer's documented instructions, which are the agreement, this DPA and Customer's use and configuration of the Service. Incbury will tell Customer if it believes an instruction breaks data protection law.
3. Confidentiality
Incbury ensures that everyone authorised to process Customer personal data is bound by confidentiality and only has the access their role needs.
4. Security
Incbury implements the technical and organisational measures in Annex 2. Incbury may update them as long as the overall level of protection is not reduced. Current details are on our trust centre.
5. Sub-processors
Customer authorises Incbury to use the sub-processors in our sub-processor list. Incbury will give at least 30 days' notice of a new sub-processor, Customer may object on reasonable data protection grounds, and Incbury will impose equivalent obligations on each sub-processor and remain responsible for it.
6. International transfers
Where Customer personal data is transferred outside the UK or EEA, Incbury relies on adequacy regulations or decisions, or on the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses, which are incorporated by reference.
7. Assistance
Incbury helps Customer respond to data subject requests through the Service's export, deletion, SCIM and compliance API features, and gives reasonable help with security, breach notification, data protection impact assessments and consultation with regulators.
8. Personal data breaches
Incbury will notify Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer personal data, with the information available and updates as it learns more.
9. Audits
Incbury will make available the information needed to show compliance with this DPA, including certificates and audit reports once issued. Customer may carry out an audit once a year on 30 days' notice, at its own cost, or whenever a regulator requires it.
10. Deletion and return
Customer can export its data at any time. When the agreement ends, Incbury deletes Customer personal data from live systems within 30 days and from backups within 90 days, unless the law requires it to be kept.
11. No training or sale
Incbury does not use Customer personal data to train its models and does not sell it.
12. Liability and precedence
Liability under this DPA is subject to the limits in the agreement. If this DPA conflicts with the agreement on data protection, this DPA applies; if it conflicts with the Standard Contractual Clauses or transfer agreement, those apply.
Annex 1: Details of processing
| Subject matter | Providing the Service to Customer. |
|---|---|
| Duration | The term of the agreement, plus the deletion periods in clause 10. |
| Nature and purpose | Storing, transmitting and processing content with AI models to generate responses, search, run tools and provide workspace features. |
| Data subjects | Customer's authorised users, and people whose personal data appears in content Customer submits. |
| Personal data | Account and profile details, conversations, prompts and outputs, uploaded files, connector content Customer chooses to share, usage and device information. |
| Special category data | None intended. Customer decides whether to submit any and is responsible for having a lawful basis. |
| Frequency | Continuous, for as long as Customer uses the Service. |
Annex 2: Technical and organisational measures
- Encryption in transit with TLS 1.2 or later and encryption at rest for databases, object storage and backups.
- Single sign-on, SCIM provisioning, two-factor authentication and role-based access control.
- Least-privilege production access, secrets management and a tamper-evident audit log.
- Isolated, short-lived sandboxes for code execution and browsing.
- Network controls including IP allowlists for business workspaces.
- Code review, automated testing and continuous integration before deployment.
- Daily encrypted backups of managed databases and documented recovery procedures.
- Incident response with breach notification as set out in clause 8.
- Configurable retention and deletion, and data export at any time.
Annex 3: Sub-processors
The current list of sub-processors, with their purpose and location, is published in our privacy policy.