NEW · Two indices, one open record: the Research Collaboration Index and the new Industry Collaboration Index.
Global Research PartnershipsCreate free account

Legal

Data Processing Agreement

Effective 28 October 2026 · Global Research Partnerships Ltd (Company No. 15971529), 3rd Floor, 86-90 Paul Street, London, EC2A 4NE.

This Data Processing Agreement ("DPA") forms part of the agreement between Global Research Partnerships Ltd ("GRP") and each organisation that licenses the GRP Partnership Intelligence Platform (the "licensee") under an order form and our platform licence terms. It sets out how GRP processes personal data on the licensee's behalf, as Article 28 of the UK GDPR requires, and applies in the same way under the EU GDPR where that law applies to the licensee. If anything else in the agreement, including an order form, conflicts with this DPA about personal data, this DPA takes priority.

1. Roles

  • GRP as processor. For the account data of the licensee's authorised users and the content of the licensee's workspace, the licensee is the controller and GRP is its processor.
  • GRP as controller. For its own administration of the licence (the contact details of the people it deals with, order forms and invoices, and the records it needs to keep the service secure and prevent misuse), GRP is a controller, as described in its privacy notice.

2. Subject matter, duration, nature and purpose

  • Subject matter: providing the platform to the licensee under the agreement.
  • Duration: the licence term, and afterwards until the data is returned or deleted under section 9.
  • Nature: hosting and storing, organising, retrieving and displaying, sending transactional email (such as invitations and password links), logging, and deleting.
  • Purpose: to give authorised users secure access to the licensee's workspace, keep the service secure and within its fair-use limits, provide support, and follow the licensee's other documented instructions.

3. Personal data and data subjects

  • Categories of personal data: work email address; name; role and job title; workspace membership and permission level; sign-in and security records, including two-step verification status and the technical records GRP's providers keep for security, such as IP address and browser type; usage logs, such as views opened, briefs printed, evidence copied and data downloaded, including the daily data-use log that applies the fair-use limits; and the saved items, notes and confirmed peer set the workspace keeps.
  • Special category data: none is needed for the platform, and the licensee asks its users not to add any in notes.
  • Data subjects: the licensee's staff, and contractors working for it, who are authorised users, and any person a user names in a note.

4. GRP's obligations as processor

GRP will:

  • process the personal data only on the licensee's documented instructions (the agreement, and the licensee's use of the platform's features), including for any transfer outside the UK, unless the law requires otherwise, in which case GRP tells the licensee first unless the law forbids it; and tell the licensee if it believes an instruction breaks data protection law;
  • make sure everyone it authorises to process the data is bound by confidentiality;
  • take the security measures in section 7, as Article 32 requires;
  • use sub-processors only as section 5 sets out;
  • help the licensee, taking into account the nature of the processing, to respond to requests from people exercising their data protection rights;
  • help the licensee meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation with the regulator (Articles 32 to 36), taking into account the nature of the processing and the information available to GRP;
  • at the end of the services, delete or return the personal data as section 9 sets out; and
  • make available the information needed to show that it meets these obligations, and allow for and contribute to audits as section 10 sets out.

5. Sub-processors

The licensee gives GRP general authorisation to use the sub-processors below. GRP will tell the licensee in advance before it adds or replaces a sub-processor, so that the licensee can object on reasonable grounds. GRP puts the same data protection obligations on each sub-processor by contract and remains responsible to the licensee for their work.

  • Supabase, Inc. (a US company). Purpose: database and authentication. Location: platform data is stored in London (AWS eu-west-2); Supabase Edge Functions run on Supabase's global edge network.
  • Netlify, Inc. (a US company). Purpose: hosting, content delivery network and serverless functions. Location: serverless functions set to run in London (AWS eu-west-2) on 28 October 2026; pages are delivered through Netlify's global content delivery network.
  • Brevo (Sendinblue SAS). Purpose: transactional email, such as invitations and password links. Location: France, European Union.

6. International transfers

Platform data is stored in the UK (London). Netlify, Inc. and Supabase, Inc. are US companies, and some processing (Netlify's global content delivery network, Supabase's edge network and provider support access) can take place outside the UK. Where a sub-processor processes personal data outside the UK, GRP relies on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, as each provider offers, or on UK adequacy regulations, which cover Brevo's processing in the European Union.

7. Security measures

  • Encryption in transit: traffic to the platform and between its services uses HTTPS (TLS).
  • Row-level security in the database, so that each workspace's data can be read only by that workspace's users and by GRP administrators.
  • Invite-only accounts: only people GRP adds to a workspace can sign in.
  • Two-step verification required for GRP administrators and available to all users.
  • Least privilege: GRP staff and services get only the access their role needs.
  • An audit trail of administrative actions.
  • Automated daily fair-use limits, with logging of data use, to detect and stop bulk extraction.

8. Personal data breaches

GRP will notify the licensee without undue delay after becoming aware of a personal data breach affecting the licensee's data. It will give the licensee the information it needs to meet its own obligations, including those in Article 33(3) of the UK GDPR, as that information becomes available, and will help the licensee contain and investigate the breach.

9. Deletion or return at the end

When the agreement ends, access closes. If the licensee asks before the term ends, GRP will return the workspace content (saved items, notes and the confirmed peer set) in a common machine-readable format. GRP then deletes the personal data it processed for the licensee, unless the law requires it to keep some; copies in routine backups are deleted as those backups expire. During the term, the daily data-use log that applies the fair-use limits is deleted automatically 13 months after the day it records; other usage records and the audit trail of administrative actions are kept for the term, so that the licensee and GRP can review use and investigate misuse, and are then deleted with the rest of the licensee's data as this section sets out.

10. Audits and information

GRP will give the licensee the information reasonably needed to show that it meets this DPA, and will allow for and contribute to audits, including inspections, by the licensee or an auditor it appoints: on reasonable notice, during normal working hours, no more than once a year unless a regulator requires it or a breach has occurred, and subject to confidentiality. GRP will first try to answer an audit request with documents and written answers.

11. Requests and contact

GRP passes on to the licensee, without undue delay, any request it receives from a data subject about the licensee's data, and does not answer it except on the licensee's instructions. To reach GRP about this DPA, a data protection question or a security concern, use the website contact page.