Data Processing Agreement
Last updated: 12th October 2026
This Data Processing Agreement ("DPA") is entered into between the Customer that has agreed to the Dwel Platform Terms ("Controller", "Customer") and Dwel AI Ltd, a company registered in England and Wales (company number 15899996), registered office 45 Albemarle Street, Mayfair, London, England, W1S 4JL ("Processor", "Dwel"), and forms part of the Platform Terms agreed between the parties.
1. Background
1.1. The parties have entered into the Dwel Platform Terms, under which Dwel provides an AI-powered guide platform to the Customer.
1.2. In the course of that relationship, the Customer may upload Customer Content that contains personal data of identifiable individuals (for example, a name or photograph in exhibit material).
1.3. In relation to that personal data only, the Customer is the data controller and Dwel is the data processor, and this DPA sets out the terms on which Dwel processes it.
1.4. This DPA does not cover Visitor Data, for which Dwel is separately the data controller under the Visitor Terms and Dwel's Privacy Policy.
2. Definitions
2.1. "Data Protection Legislation" means the UK GDPR, the Data Protection Act 2018, and, where applicable, the EU GDPR, in each case as amended or replaced from time to time.
2.2. "Customer Personal Data" means personal data contained within Customer Content that Dwel processes on the Customer's behalf under this DPA.
2.3. "Sub-processor" means any third party engaged by Dwel to process Customer Personal Data in providing the Service.
2.4. "Data Subject", "Processing", "Controller", "Processor", and "Personal Data Breach" have the meanings given in the UK GDPR.
2.5. "Platform Terms", "Customer Content", "Place", "Team" and "Service" have the meanings given in the Platform Terms.
3. Processing Instructions
3.1. Dwel will process Customer Personal Data only on the Customer's documented instructions, including as set out in the Platform Terms and this DPA, unless required to do otherwise by law (in which case Dwel will inform the Customer before processing, unless the law prohibits this).
3.2. Dwel will inform the Customer if, in its opinion, an instruction infringes Data Protection Legislation.
3.3. Details of the processing (subject matter, duration, nature and purpose, data types, and data subject categories) are set out in Annex 1.
3.4. The Customer is responsible for ensuring it has a lawful basis for the Customer Personal Data it uploads, that its instructions are lawful, and that it does not upload special category data except as agreed under Platform Terms §6.6.
4. Confidentiality and Security
4.1. Dwel will ensure that personnel authorised to process Customer Personal Data are subject to confidentiality obligations.
4.2. Dwel will implement appropriate technical and organisational security measures, as set out in Annex 3.
5. Sub-processors
5.1. The Customer authorises Dwel to engage the Sub-processors listed in Annex 2.
5.2. Dwel will give the Customer at least 30 days' written notice, by email to its Team administrators, before adding or replacing a Sub-processor that processes Customer Personal Data. The Customer may object on reasonable data-protection grounds within that period. If the parties can't resolve the objection, the Customer may terminate the affected part of the Service without penalty.
5.3. Where a Sub-processor must be changed urgently for security or legal reasons, Dwel may do so and will notify the Customer as soon as reasonably practicable.
5.4. Dwel will enter into a written contract with each Sub-processor imposing data protection obligations no less protective than those in this DPA. Dwel remains liable for a Sub-processor's acts and omissions to the same extent as if it were performing that processing itself.
6. International Transfers
6.1. Where Customer Personal Data is transferred outside the UK or EEA, Dwel will ensure an appropriate transfer mechanism is in place (such as the UK International Data Transfer Addendum or Standard Contractual Clauses, or a transfer to a country benefiting from an adequacy decision).
6.2. The transfer mechanism relied on for each Sub-processor is stated in Annex 2.
7. Assistance to the Customer
7.1. Dwel will, taking into account the nature of the processing, provide reasonable assistance to the Customer in responding to data subject requests (access, rectification, erasure, and similar rights).
7.2. Dwel will provide reasonable assistance to the Customer with its obligations relating to security, breach notification, data protection impact assessments, and consultation with supervisory authorities, to the extent these relate to Customer Personal Data processed under this DPA.
7.3. If Dwel receives a request from a data subject about Customer Personal Data, it will promptly forward it to the Customer and will not respond other than to acknowledge it, unless the Customer instructs otherwise or the law requires.
8. Audit
8.1. Dwel will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including the security summary in Annex 3 and, where Dwel is permitted to share them, the then-current SOC 2 or ISO 27001 reports or certificates of its infrastructure Sub-processors.
8.2. If that information doesn't reasonably answer the Customer's concern, or where a regulator requires it, Dwel will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it appoints. These will be on reasonable notice, subject to confidentiality, and Dwel will act reasonably on scope and timing. They will take place no more than once per year, unless following a Personal Data Breach or a regulator's request.
9. Personal Data Breach
9.1. Dwel will notify the Customer without undue delay, and in any event within 48 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data.
9.2. That notification will include the information reasonably available to Dwel at the time to allow the Customer to meet its own breach-notification obligations, with further detail provided as it becomes available.
10. Return and Deletion
10.1. After termination of the Platform Terms, the Customer has 30 days to choose, by written notice, whether Dwel returns or deletes Customer Personal Data. If the Customer asks for return, Dwel will provide it promptly and won't delete it until it has been delivered. At the end of that 30-day period (or earlier on the Customer's written request), Dwel will delete Customer Personal Data from its live systems and require its Sub-processors to do the same, except where retention is required by law. Copies held in backups are removed as the backups expire, within 7 days afterwards. Dwel will confirm deletion in writing on request. This doesn't apply to de-identified conversation data that Dwel holds as controller under its Privacy Policy (see Section 1.4).
11. Liability, Term and Precedence
11.1. This DPA takes effect on the date the Platform Terms take effect and continues for as long as Dwel processes Customer Personal Data on the Customer's behalf.
11.2. Liability under this DPA is subject to Sections 16.4 and 16.7 of the Platform Terms.
11.3. If this DPA conflicts with the Platform Terms or any Order Form in relation to the processing of Customer Personal Data, this DPA prevails, unless the Order Form expressly says it varies this DPA.
12. Governing Law and Contact
12.1. This DPA is governed by the laws of England and Wales, consistent with the Platform Terms.
12.2. Questions about this DPA: privacy@dwel.ai.
Annex 1: Details of Processing
| Item | Detail |
|---|---|
| Subject matter | Dwel's provision of an AI-powered visitor guide platform to the Customer. |
| Duration | For the term of the Platform Terms, plus the 30-day post-termination period and 7-day backup expiry described in Section 10. |
| Nature and purpose of processing | Hosting and storing Customer Content; generating AI Output (narration, conversational responses) from Customer Content; making Guides available to Visitors; providing the Customer with analytics on Guide usage. |
| Categories of data subjects | Individuals identifiable within Customer Content uploaded by the Customer (e.g. named or pictured in exhibit material). Personal data of the Customer's authorised platform users (account data) is not Customer Personal Data; Dwel processes it as controller under its Privacy Policy. |
| Types of personal data | Names, images, and other identifying details that a Customer chooses to include in its own Customer Content. Dwel does not require or request special category data; Customers should not upload it. |
Annex 2: Sub-processors
Stripe is deliberately not listed here. This DPA covers only Customer Personal Data (Section 2.2) - personal data embedded within Customer-uploaded content. Stripe processes visitor payment data and Customer billing data, neither of which fall within that scope (see Section 1.4); Stripe's role is described in Platform Terms §4 and Privacy Policy §9 instead. Speech-to-text and service monitoring (Grafana Cloud) are likewise not listed: they process Visitor Data or operational metadata only, never Customer Content. Providers that process only Visitor Data or platform user data are listed on our third-party providers page.
| Provider | Purpose | Region | Transfer Mechanism |
|---|---|---|---|
| Amazon Web Services | Hosting of Dwel's backend services and cache; AI response generation and content indexing (Amazon Bedrock) | UK (London, eu-west-2) | None needed (UK region) |
| Supabase | Database and file storage for Customer Content; account login | UK (London, eu-west-2) | EU adequacy for the hosting itself, plus the transfer clauses in its DPA |
| Vercel | Hosting of the Customer dashboard and the visitor guide web app | Washington DC (US) | UK Extension to the EU-US Data Privacy Framework where certified, otherwise the UK Addendum or IDTA in its DPA |
| ElevenLabs | Text-to-speech for narration and spoken responses | US (us-central-1) | UK Extension to the EU-US Data Privacy Framework where certified, otherwise the UK Addendum or IDTA in its DPA |
| Firecrawl | Importing content from a Customer's web pages into the Guide's knowledge | US | UK Extension to the EU-US Data Privacy Framework where certified, otherwise the UK Addendum or IDTA in its DPA |
Annex 3: Technical and Organisational Security Measures
Encryption in transit: all access to the dashboard, guide, APIs and websockets is over HTTPS/WSS (TLS), with security headers on the web apps and API. Calls to sub-processors are also over TLS.
Encryption at rest: Customer Content sits in Supabase (database and storage) and AWS ElastiCache, both encrypted at rest by the provider. Dwel adds no app-level encryption of its own.
Access control:
- Customer users sign in with Supabase Auth (magic link) and have role-based team permissions.
- Tenant isolation is enforced at four layers, ending in Postgres row-level security (RLS) that is covered by automated tests.
- Only one service reads tenant data.
- Secrets are kept in AWS Secrets Manager, and CI scans for leaked secrets.
- Access to production systems and data is limited to Dwel's engineering lead, granted only where needed to operate or support the Service, protected by multi-factor authentication on all administrative accounts (hosting, database, secrets management and source control), and revoked promptly when no longer required.
Backup policy and retention: Customer Content held in Dwel's database is backed up automatically once a day by Dwel's database provider (Supabase), and each backup is kept for 7 days before it is permanently deleted. Point-in-time recovery is not currently enabled.
Incident response process: Dwel monitors its production services through centralised logging and tracing (Grafana Cloud) and investigates any suspected security incident promptly on becoming aware of it. On confirming an incident, Dwel will:
- (a) contain it, including by revoking affected sessions and rotating any exposed credentials or keys;
- (b) assess its scope, including whether Customer Personal Data has been accessed, altered, lost or disclosed;
- (c) where a Personal Data Breach affecting Customer Personal Data has occurred, notify the Customer in accordance with Section 9;
- (d) restore affected systems and data, from backups where necessary; and
- (e) review the incident afterwards and put in place measures to prevent it from recurring.
Dwel keeps a written record of each incident, including its facts, effects and the remedial action taken.
Certifications: none held by Dwel. AWS, Supabase and Vercel hold SOC 2 or ISO 27001.
End of Data Processing Agreement.