Effective Date: 18 September 2026
Last Updated: 18 September 2026
1.1 This Data Processing Agreement ("DPA") forms part of the Terms at https://www.matainable.com/legal/terms (the "Agreement"). It is made between the Customer, the entity agreeing to the Terms, acting as controller, and Matainable Ltd, acting as processor. Matainable Ltd is a company registered in England and Wales (Company Registration Number: 16543039) with its registered office at 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE.
1.2 This DPA applies where Matainable processes personal data on behalf of the Customer in providing the Service under the Agreement.
1.3 Matainable is the controller of the account, usage and marketing data it collects for its own purposes. That processing is described in the Privacy Policy at https://www.matainable.com/legal/privacy and is outside this DPA.
2.1 "Data Protection Law" means the UK GDPR and the Data Protection Act 2018 and, where the Customer is established in the EEA, the EU GDPR, in each case as amended or replaced.
2.2 "Customer Personal Data" means personal data that Matainable processes on behalf of the Customer in providing the Service.
2.3 "Sub-processor" means a third party that Matainable engages to process Customer Personal Data.
2.4 "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, Customer Personal Data.
2.5 Other capitalised terms have the meanings given in the Agreement.
3.1 The Customer is the controller of Customer Personal Data and Matainable is its processor. The Customer is responsible for the lawfulness of Customer Personal Data and of its instructions.
3.2 Details of people at the Customer's suppliers, facilities and buyers that the Customer enters into the Service are Customer Personal Data. Matainable processes them on the Customer's instructions. The Customer gives those people any privacy notice they need.
3.3 If such a person contacts Matainable about their data, Matainable will pass the request to the Customer and help the Customer respond.
4.1 Matainable processes Customer Personal Data only on the Customer's documented instructions. Those instructions are the Agreement, this DPA, and the Customer's use of the features of the Service.
4.2 If Matainable believes an instruction breaches Data Protection Law, it will tell the Customer before acting on it.
4.3 Matainable may process Customer Personal Data otherwise only where the law requires it. Where that happens, Matainable will tell the Customer about the requirement before processing, unless the law forbids it.
5.1 Matainable ensures that every employee and contractor with access to Customer Personal Data is bound by a contractual or statutory duty of confidentiality.
5.2 Access to Customer Personal Data is limited to the people who need it to provide, support and secure the Service.
6.1 Matainable implements and maintains appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access. Those measures are appropriate to the nature of the data and the risk to the people concerned.
7.1 The Customer gives Matainable general authorisation to engage Sub-processors to process Customer Personal Data on the terms of this clause 7.
7.2 The current Sub-processors are listed at https://www.matainable.com/legal/sub-processors, as updated from time to time.
7.3 Matainable will give at least 14 days' notice before adding or replacing a Sub-processor. Matainable gives notice by updating that page and by emailing the Customer's account administrator.
7.4 Matainable puts a written contract in place with each Sub-processor that imposes data protection obligations materially the same as those in this DPA. Matainable remains responsible to the Customer for the acts and omissions of its Sub-processors.
7.5 If the Customer does not accept a new Sub-processor, it may terminate the affected Service by written notice to Matainable before the change takes effect. The Customer remains liable for all Fees already due at the date of termination.
8.1 Matainable does not transfer Customer Personal Data outside the United Kingdom or the European Economic Area without appropriate safeguards under Data Protection Law. Transfers to the Sub-processors on the list at https://www.matainable.com/legal/sub-processors are permitted.
9.1 If Matainable receives a request from an individual to exercise a right under Data Protection Law in respect of Customer Personal Data, it will notify the Customer without undue delay. Matainable will not answer the request directly unless the Customer instructs it to, except to direct the individual to the Customer.
9.2 Matainable helps the Customer respond to such requests, primarily through the export, correction and deletion tools within the Service, and with further reasonable assistance where those tools are not enough.
9.3 Matainable also gives the Customer reasonable assistance with the Customer's own obligations on security, Personal Data Breach handling, data protection impact assessments and prior consultation with a supervisory authority.
9.4 Where assistance under this clause 9 requires significant work, Matainable may charge the Customer its reasonable costs, agreed in advance.
10.1 Matainable will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.
10.2 The notice will describe what is known at the time: the nature of the breach, the Customer Personal Data and people likely affected, the likely consequences, the steps taken or proposed, and a contact point. Where not all of this is known at once, Matainable will provide it in phases without undue further delay.
10.3 Matainable will cooperate with the Customer and take reasonable steps to contain, investigate and remedy the breach.
11.1 For 30 days after the Agreement ends, the Customer may export its Customer Personal Data using the export tools within the Service, or ask Matainable for a copy in a common machine-readable format.
11.2 Within 90 days after the Agreement ends, Matainable will delete the Customer Personal Data, unless the law requires Matainable to retain some of it. Matainable will keep any retained data confidential and process it only for the purpose the law requires.
12.1 On written request, Matainable will provide the information the Customer reasonably needs to demonstrate that Matainable is complying with this DPA. Matainable will also allow and contribute to audits, including inspections, by the Customer or an auditor it appoints. An audit needs at least 30 days' written notice, takes place no more than once in any 12 months unless a supervisory authority requires otherwise, and is at the Customer's cost.
13.1 Each party's liability under this DPA is subject to the exclusions and the limit of liability set out in the Agreement. Nothing in this DPA limits the rights of an individual under Data Protection Law.
13.2 This DPA is governed by the law of England and Wales, and the courts clause in the Agreement applies to it.
13.3 This DPA takes effect when the Customer enters into the Agreement and continues for as long as Matainable holds any Customer Personal Data.
| Subject matter | The provision of the Service. |
|---|---|
| Nature and purpose | The provision of the Service. |
| Duration | The term of the Agreement plus the return and deletion period in clause 11. |
| Categories of people | The Customer's staff and users, and contacts at the Customer's suppliers, facilities and buyers. |
| Types of personal data | Names, business contact details, roles, facility addresses, and the content of records the Customer uploads. |
For questions about this DPA, please contact:
Privacy enquiries: admin@matainable.com
Postal address: Matainable Ltd, 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE
Company Registration Number: 16543039
Sustainable Materials, Now Attainable
© 2026 Matainable. All rights reserved
Matainable Ltd. CRN: 16543039
3rd Floor, 86-90 Paul Street
London, England
United Kingdom,
EC2A 4NE