DATA PROCESSING AGREEMENT

Microsoft 365 Health Assessment (Vitals)

Version 2.5 · Effective 19 October 2026

This DPA applies to direct customer Assessments where the Client is Controller and Innova Group is Processor. IT-provider/sub-processor engagements require the applicable IT-provider terms.

Parties

(1) Controller: the organisation identified as the Client in the order and Terms of Supply (“Client”).

(2) Processor: Innova Technologies Group Ltd, company number 17205930, registered office 7 Stromberg Street, Anlaby, Hull, HU10 7ER, trading as Innova Group (“Innova Group”).

This DPA forms part of the Terms of Supply for the Assessment (together, the “Agreement”).

1. Definitions

Assessment. the Microsoft 365 health-assessment service supplied using Vitals. The £99 product is marketed as “Vitals Assessment”. The £295 product is marketed as “Vitals In-Depth” and includes the Vitals Assessment output, a detailed remediation document called the “Worklist”, and the review call described in the Terms.

Data Protection Legislation. the UK GDPR, Data Protection Act 2018 and other UK legislation applicable to the processing under this DPA, as amended or replaced.

Report. the assessment output produced for the Client.

Tenant. the Client’s Microsoft 365 tenant identified in the order.

UK GDPR. Regulation (EU) 2016/679 as it forms part of UK domestic law.

Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing and Sub-processor have the meanings given in the UK GDPR.

2. Roles, instructions and scope

2.1 The Client is Controller and Innova Group is Processor for Personal Data processed on the Client’s behalf in performing the Assessment.

2.2 The Client instructs Innova Group to process Personal Data to perform the Assessment, generate and make available the Report, provide related support, operate the retention/deletion controls in this DPA and comply with further documented instructions consistent with the Agreement.

2.3 The Client is responsible for the lawfulness of its instructions, its lawful basis for the processing and any transparency information it must provide to Data Subjects.

2.4 Innova Group may separately process business-contact, contract, billing, payment, fraud-prevention, security, audit, tax, accounting and account-administration information as an independent Controller where necessary for those purposes. Innova Group does not rely on this clause to keep Client Personal Data that this DPA requires it to delete or return.

2.5 Innova Group shall inform the Client without undue delay if, in its opinion, an instruction infringes Data Protection Legislation, unless prohibited by law.

3. Innova Group’s Article 28 obligations

3.1 Innova Group shall process Personal Data only on documented instructions from the Client, including for international transfers, unless UK law requires otherwise. Where legally permitted, Innova Group shall inform the Client before processing required by law.

3.2 Innova Group shall ensure persons authorised to process Personal Data are subject to confidentiality obligations. Production administrative access is currently restricted to Innova Group’s Managing Director.

3.3 Innova Group shall implement and maintain the technical and organisational measures in Schedule 2, having regard to the risks presented by the processing.

3.4 Taking account of the nature of processing, Innova Group shall assist the Client, insofar as reasonably possible, with Data Subject requests under Chapter III UK GDPR. If Innova Group receives such a request directly concerning Client Personal Data, it shall notify the Client without undue delay and shall not respond except on the Client’s instruction or where required by law.

3.5 Taking account of the nature of processing and information available to it, Innova Group shall reasonably assist the Client with obligations under Articles 32–36 UK GDPR, including security, breach notification, DPIAs and prior consultation.

3.6 Innova Group shall notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Client Personal Data and shall provide information reasonably available to it to assist the Client with its obligations.

3.7 Innova Group shall make available information reasonably necessary to demonstrate compliance with Article 28 and shall allow for and contribute to reasonable audits and inspections by the Client or its mandated independent auditor.

3.8 Unless an audit follows a Personal Data Breach, regulator request or reasonable evidence of material non-compliance, the Client shall give reasonable prior notice, conduct it during normal business hours, minimise disruption and ensure its auditor is bound by confidentiality.

4. Tenant access

4.1 Access is established only after a Tenant administrator grants Microsoft Entra admin consent to the Vitals application.

4.2 The production Microsoft Graph application permissions are listed in Schedule 1. They are read-only and do not permit Innova Group to create, alter or delete Tenant content, settings or objects.

4.3 The Client may revoke Vitals access through Microsoft Entra. Revocation prevents further use of that authorisation.

4.4 Innova Group shall not use the Client’s authorisation after completion of an Assessment except under a further documented instruction. A documented instruction may be a specific further order or, where the Client has expressly enrolled the Tenant in a recurring or verification service, a standing instruction identifying the Tenant, recurrence and duration. The Client may revoke Microsoft Entra access at any time; revocation prevents further Assessments requiring that access.

4.5 Customer Assessments are processed solely through the production Vitals service hosted in Microsoft Azure UK West. A command-line build exists for internal development and is not used to process customer data.

5. Data minimisation and restrictions

5.1 Vitals does not open, read, copy or store the contents or bodies of documents, email messages or Teams chats as part of the Assessment. MailboxSettings.Read is used only to read mailbox settings, including forwarding and inbox-rule metadata, and not the contents or bodies of email messages.

5.2 Vitals does not collect passwords, authentication secrets or MFA secrets.

5.3 The raw Microsoft Graph assessment snapshot is processed transiently in memory and is not persisted to disk or database.

5.3A For Conditional Access adoption and effectiveness checks, Vitals may temporarily process a limited subset of Microsoft Entra interactive sign-in records covering the preceding seven days. The request excludes names, UPNs/email addresses, IP addresses, locations, device details and application names. Account identifiers are used transiently in memory only to count distinct accounts and are not persisted. Individual sign-in records are not persisted. Vitals may also temporarily process directory group and role membership identifiers in memory where needed to determine accounts excluded from Conditional Access policies; those membership identifiers are not persisted for that purpose. Only aggregate counts and derived assessment results are stored. Innova Group does not treat a small aggregate as anonymous merely because it is a count where it may still relate to an identifiable individual.

5.3B The processing described in clause 5.3A is an optional processing feature and shall be carried out for a Tenant only where the Client has given a documented instruction expressly authorising that processing. Acceptance of this version of the Agreement before the relevant Assessment constitutes that instruction. For an existing order governed by an earlier version, notice of this version alone does not authorise the processing: Innova Group shall obtain the Client's affirmative acceptance of this version, or another written instruction that expressly authorises the processing described in clause 5.3A, before enabling it for that Tenant. If no such instruction has been recorded, the Assessment shall continue without collecting or using the sign-in evidence described in clause 5.3A.

5.4 Innova Group shall not use Client Personal Data to train, fine-tune or evaluate a machine-learning model.

5.5 Innova Group shall not process Client Personal Data for an unrelated purpose or disclose it except as permitted by the Agreement, on documented instruction, or as required by law.

6. Sub-processors

6.1 The Client gives general written authorisation for Innova Group to use the Sub-processors listed in Schedule 3 for the stated purposes.

6.2 Innova Group shall impose on each Sub-processor that processes Client Personal Data written data-protection obligations providing an equivalent level of protection to the obligations applicable under Article 28 UK GDPR.

6.3 Innova Group remains responsible for its Sub-processors’ performance to the extent required by Data Protection Legislation.

6.4 Innova Group shall give reasonable advance notice of an intended addition or replacement of a Sub-processor processing Client Personal Data. The Client may object on reasonable data-protection grounds. The parties shall work in good faith to resolve the objection; if they cannot, either may terminate the affected service before the change takes effect.

6.5 Microsoft’s operation of the Client’s own Microsoft 365 environment is not an appointment by Innova Group. Microsoft Azure is separately an Innova Group Sub-processor where it hosts Vitals and stores the Report.

7. Recommendation service and transfers

7.1 In the current service, Vitals produces prioritised recommendations automatically, from its analysis of the assessment information, and does not submit assessment information to an AI provider to do so.

7.2 [Intentionally left blank.]

7.3 If that factual position changes, Innova Group shall treat it as a material processing change and meet applicable Article 28 and Chapter V requirements before transmitting Personal Data.

7.4 Where a Sub-processor processes Client Personal Data outside the UK, Innova Group shall ensure a lawful Chapter V mechanism applies, including adequacy regulations or appropriate safeguards. The current Resend DPA provides for ex-UK transfers using the UK SCCs (EU SCCs as amended by the UK Addendum).

8. Reports, release, retention and deletion

8.1 The raw Graph snapshot and individual sign-in records are not persisted. The rendered Report and structured assessment results described in Schedule 1 may be stored in the production database, including findings, scores, counts and capability/check results. Where a result itself constitutes Personal Data, it remains subject to this DPA and the applicable retention/deletion provisions.

8.2 Vitals Assessment removes identifying item examples before rendering. Vitals In-Depth includes a Worklist which intentionally retains specific remediation evidence that may include file/folder paths, sharing links and account identifiers.

8.3 Vitals Assessment Reports are made available through a cryptographically random token-protected bearer URL sent to the purchasing/delivery email address. Possession of a valid token permits repeated access until expiry or earlier deletion. The token expires no later than 30 days after delivery.

8.4 Worklists included with Vitals In-Depth are generated but are not delivered by email on completion. Innova Group shall withhold the Worklist until the scheduled review has taken place and an authorised Innova Group administrator expressly releases it to the authorised recipient. Before authorised release, the Worklist shall be inaccessible through its report-access token even where that token is known or possessed. The Worklist retention period begins only when authorised release occurs.

8.5 Report-access tokens are cryptographically random bearer tokens and remain usable by anyone who holds a valid token until expiry or earlier deletion. They expire no later than 30 days after delivery (Vitals Assessment) or authorised release (Vitals In-Depth Worklist). Invalid, expired and otherwise unauthorised requests do not disclose whether a Report exists.

8.6 For a one-off Assessment, within 30 days after delivery/release, an automated retention process removes every persisted copy of the Report (the detailed Report and any executive summary, whether held in file storage or in the database) and assessment-related buyer/recipient name and email, approver email, agreement signatory information and associated approval/signature IP address, and invalidates the report-access token. The process runs at least every six hours and records when removal completed. If a stored copy of the Report cannot be deleted when the process runs, the process keeps a record of it and tries again at least every six hours until the deletion is confirmed.

8.6A Where the Client has expressly ordered a Verification Assessment, clause 8.6 applies in full: Innova Group does not retain the Client’s purchasing/delivery email address, or any other Assessment Personal Data listed in clause 8.6, for the purpose of the verification beyond the period in clause 8.6. Where verification is included, Innova Group may retain the minimum assessment baseline needed to perform it, for no longer than 180 days after release. The baseline is removed when the verification completes or lapses. The baseline is the identifier of the assessed Tenant and the stored results of the earlier Assessment, not contact details and not Report documents; the verification is run from it and not from the Report or the Worklist, it may run from about 90 days after release, and it adds nothing to the comparison profile described in clause 8.8. Report documents follow their own shorter retention in this clause 8. Innova Group delivers the verification report (a) for an order placed through an IT provider, to the IT provider’s current contact details or partner portal, and (b) for any other order, where the Client contacts Innova Group at hello@tenantvitals.com, quoting the order reference, within the verification window stated in the Terms of Supply, to the email address the Client supplies at that time, which Innova Group uses for that one delivery only and does not keep beyond the minimal delivery record that the send requires. A verification that cannot be run because the access it needs has not been restored, or that has not been completed 30 days after it fell due, lapses. A verification report is removed 30 days after it was delivered or, if it was not delivered, 30 days after it was completed. Detailed report-access links remain subject to their stated expiry unless expressly re-issued.

8.6B Where the Client has expressly enrolled the Tenant in a recurring Assessment service, Innova Group may retain between scheduled Assessments the minimum identifiable comparison/history data necessary to show change over time and administer the standing instruction. That data is retained only while the Tenant remains enrolled and is deleted or de-identified no later than 30 days after the enrolment ends, unless UK law requires longer retention. Each detailed Report remains subject to its own stated report-access retention period.

8.6C Whatever else this DPA provides, Innova Group removes the Report and the data listed in clause 8.6 from the live service within 120 days after the date on which the order was paid or, if it was never paid, created. Where an order is refunded or closed before the Report is delivered, the removal takes place within 30 days after the refund or closure; where an order is delivered and later refunded or closed, within the earlier of 30 days after delivery and 30 days after the refund or closure; in each case subject to the 120-day maximum. Later activity on an order, including a re-run of the Assessment, a release, or a pending Verification Assessment, does not extend any of these periods. Removal may be postponed only while a scan for the order is still running, and takes place on the first run of the retention process after that scan ends.

8.7 On written request sent to hello@tenantvitals.com, Innova Group shall perform the same personal-data removal early and without undue delay, unless UK law requires retention. A request may identify an order, the Tenant, or an individual by email address. Where the request identifies an individual by email address, the removal includes every stored Report document that contains that individual’s identifiers (for example a Report prepared for a client that was named after that individual’s address), while the stored scores and results remain; Innova Group does not leave embedded personal data in a Report merely because the order’s recipient field has been cleared. Where the request identifies the Tenant, the removal includes the Tenant’s stored assessment results and the data derived from them, including any pseudonymised comparison profile of the Tenant under clause 8.8; no named profile of the Tenant remains, and Innova Group does not keep a profile of that Tenant under clause 8.8. Where necessary, Innova Group shall verify that the request comes from the Client or a person authorised to act for it, and shall confirm the scope of the removal with the requester before carrying it out. When the removal is complete, Innova Group shall confirm that in writing to the requester and state the categories of data it has kept (for example under clause 8.9).

8.8 After that removal, Innova Group may retain a pseudonymised assessment comparison profile of the Client’s latest delivered Assessment: the structured results that a later comparison needs (scores, band, licence mix, rule versions, and the check, finding and capability results, but no Report document), kept solely to support comparison with a future Assessment of the same Tenant, so that the meaningful change between Assessments can be shown. The profile does not include the Tenant name or domain, the raw Tenant identifier, site names or addresses, or ordinary Client contact details, and it is associated with the Client only through a pseudonymous identifier that Innova Group can recompute when the Tenant is next assessed. It is therefore not anonymous and remains Personal Data to the extent the Client or Tenant is identifiable. Innova Group does not use it for any other purpose. Scans that were never delivered or sent to the Client as a copy are not retained. A Verification Assessment adds nothing to the profile: its scan and results are removed when it completes or lapses. A request under clause 8.7 that identifies the Tenant also removes the profile.

8.9 Commercial, payment, contract, tax and accounting records, and security, fraud-prevention and audit records, retained by Innova Group in its separate capacity as Controller are outside clauses 8.6–8.7 and are retained only as necessary for those purposes. The audit records include a record that a removal took place (its date, kind, internal identifiers, the reason given with any email address masked, and the Innova Group staff member who carried it out), which does not contain the removed data, and a ledger of removals that holds internal identifiers and dates only and is kept for 400 days (clause 8.11). Innova Group keeps the record that a removal took place, and the detailed administration and security records of its own staff (who carried out, revoked or sent what), for no longer than six years after the entry was made, on the basis of its legitimate interest in accountability and security; separately it keeps, for as long as that person could otherwise sign in, only the minimum identifier and revoked state needed to prevent withdrawn staff access from being restored. Those records do not hold the Client’s or any IT provider’s personal data, and removing the Client’s data does not remove them. Evidence that the Client accepted this DPA and the Terms of Supply is limited to the version accepted, the time of acceptance and a stable reference to the order or organisation, and is kept for no longer than six years after the order to which it relates has been completed, refunded or closed; the signatory’s name, email address and IP address are removed under clause 8.6 and are not kept to prove the acceptance, and the evidence is not kept together with unrelated Client content.

8.10 At the end of the processing services, and subject to 8.9, Innova Group shall at the Client’s choice delete or return Client Personal Data and delete copies unless UK law requires storage. Where the normal deletion cycle will complete deletion sooner, it may be used. Copies held in backups are dealt with under clause 8.11.

8.11 Backups and restoration. (a) Innova Group keeps encrypted backup copies of the production database only so that it can restore the service after a failure or loss, and does not read them for any other purpose. (b) Personal Data removed under clause 8.6, 8.6C, 8.7 or 8.10 is deleted from the live service when the removal is made. That deletion is separate from the expiry of backup copies: erased data may remain in encrypted recovery backups for no more than 45 days. Innova Group is not required to alter a backup copy. (c) If a backup copy is restored, Innova Group shall, before the restored service resumes processing and before it is made available to Clients, re-apply every removal made after that copy was taken, using a ledger of removals kept outside the database; and if it cannot establish that this has been done, it shall not make the restored service available to Clients. (d) Innova Group may keep a backup copy for longer than 45 days only as an exceptional hold, which must be placed explicitly by a named member of its staff for a stated and justified reason (the establishment, exercise or defence of legal claims, a regulator’s request, an incident investigation or UK law), recorded in a register with its scope, its reason, the person who placed it, its start date and its next review date, reviewed at least every 90 days, and released, with the release recorded, as soon as its basis no longer exists. A backup copy kept without such a register entry is not a hold. Erased data in such a copy may survive for the documented duration of the hold, and the ledger of removals is kept for at least as long as that copy. Routine backup storage, checkpoint copies and a copy taken before a release are not holds and are deleted within the 45 days in paragraph (b). (e) Subject to paragraph (d), the ledger of removals holds internal identifiers and dates only, and is kept for 400 days.

9. Anonymous information

9.1 Innova Group may retain and use information derived from the Assessment only where it has been rendered anonymous so that it is no longer Personal Data.

9.2 Anonymous information may be used to maintain and improve Vitals, compare repeat Assessments and produce aggregate benchmarks.

9.3 Innova Group shall not publish a benchmark/statistic in a form that identifies the Client without prior written consent.

10. Processing changes

10.1 Innova Group shall keep Schedule 1 materially accurate.

10.2 Innova Group shall not introduce a Microsoft Graph permission or feature that materially expands the categories of Personal Data processed without first updating its processing documentation and, where required, notifying the Client or obtaining further instruction/authorisation.

10.3 Mailbox-rule analysis is part of the standard Assessment and MailboxSettings.Read is part of the production permission set. It reads mailbox settings, including inbox-rule names, rule conditions and forwarding addresses, but does not read the contents or bodies of email messages.

11. Term and liability

11.1 This DPA applies for as long as Innova Group processes Client Personal Data in connection with the Assessment.

11.2 The exclusions and limitations of liability in clause 12 of the Terms of Supply apply to this DPA as if set out here. Nothing limits a liability to the extent it cannot lawfully be excluded or limited, and nothing changes responsibilities imposed directly by Data Protection Legislation.

11.3 Confidentiality, deletion, anonymous-information, liability and governing-law provisions survive to the extent necessary to give them effect.

12. General

12.1 This DPA is governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction, subject to mandatory rights or jurisdiction under Data Protection Legislation.

12.2 If this DPA conflicts with the Terms of Supply on a data-protection matter, this DPA prevails.

12.3 Nothing in this DPA relieves either party of responsibilities imposed directly on it by Data Protection Legislation.

Schedule 1 — Details of Processing

Item	Description
Subject matter	Read-only assessment of the configuration, security posture and metadata of the Client’s Microsoft 365 Tenant using Vitals.
Duration	One-off: through completion/deletion. Standing Enrolment or Verification: for the expressly authorised period, subject to Microsoft Entra revocation at any time.
Nature	Automated retrieval of specified Microsoft 365 metadata via Microsoft Graph; transient in-memory analysis, including limited seven-day interactive sign-in records and directory group/role membership identifiers for Conditional Access effectiveness; scoring; findings; Report rendering; controlled delivery/release; retention and deletion.
Purpose	Identify and prioritise risks concerning sharing, sensitivity labelling, content currency, duplication, findability, ownership, guests, identity/security configuration, Conditional Access adoption/effectiveness, device compliance, Microsoft 365 activity and related configuration checks.
Tenant	As identified in the order.
Authorised recipient	As identified in the order.
Tier	Vitals Assessment or Vitals In-Depth, as identified in the order.

Categories of Data Subject

• Employees, officers, workers and contractors holding Tenant accounts.
• External guests holding accounts in, or access to, Tenant content.
• Individuals whose names/identifiers appear incidentally in file, folder, site, Team, path, sharing or account metadata.
• Users associated with managed devices or Microsoft 365 activity/security-registration records.

Users whose interactive sign-in activity, group/role membership, licence/activity status, authentication-method changes or contact-method presence is assessed.

Types of Personal Data

• Identity/directory: display name, UPN, enabled state, user type/guest flag, account creation date and UPNs of Global Administrators.
• File/collaboration metadata: file/folder names and paths, size, last-modified date, quickXorHash, sharing scope/links, sensitivity label, site/Team/group names and owners, page titles/URLs/modified dates/draft state.
• Managed devices: device name, operating system, associated UPN, compliance state and last synchronisation.
• Microsoft 365 activity: UPN, deletion status and last-activity dates for Exchange, SharePoint, OneDrive and Teams for the relevant Microsoft reporting period. Where Microsoft report obfuscation is enabled, Vitals may receive pseudonymised identifiers instead.
• Mailbox-rule metadata: inbox-rule names, rule conditions and any forwarding address. Vitals does not read message content.
• Authentication-security registration: UPN, MFA-capable status, administrator status and registered authentication-method categories. No passwords, authentication secrets or MFA secrets.
• Application/consent metadata: service-principal/application names and OAuth permission scopes; this is generally organisational/configuration information but may contain Personal Data where an identifier relates to an individual.
• Incidental Personal Data in names/paths/URLs retrieved as metadata.

Interactive sign-in metadata for Conditional Access effectiveness: a limited subset of Microsoft Entra interactive sign-in records from the preceding seven days. Names, UPNs/email addresses, IP addresses, locations, device details and application names are not requested. Account IDs are processed transiently in memory to count distinct accounts; individual records and account IDs are not persisted. Aggregate counts and derived results may be stored and may remain Personal Data in small populations.

Directory group/role membership for Conditional Access exclusions: account, group and role membership identifiers processed transiently in memory where needed to determine excluded accounts; these identifiers are not persisted for this purpose.

Directory audit events relating to authentication/sign-in-method changes, including initiator and target UPN where supplied by Microsoft Graph.

Per-person SharePoint and OneDrive activity: account identifier/UPN and file-activity counts for the relevant Microsoft reporting period.

Licensing: per-person Microsoft 365 licence assignments and disabled service-plan information.

Contact-method presence: indicators of whether telephone and alternate-email contact details are present for an account.

Structured assessment results: findings, scores, counts, capability/check results and derived assessment states retained after the generated Report is deleted where permitted by clause 8. These may be Personal Data where they relate to, single out or can reasonably be linked to an identifiable person.

Ordinarily non-personal configuration data also processed

• Conditional Access policy names/states; authorisation-policy settings; security-defaults state.
• Secure Score/control status.
• SharePoint tenant sharing capability (whether external sharing and anonymous links are permitted at tenant level).
• Sensitivity-label taxonomy.
• Public DNS records for customer domains.

Production Microsoft Graph application permissions

• Sites.Read.All
• Files.Read.All
• Directory.Read.All
• SensitivityLabel.Read
• DeviceManagementManagedDevices.Read.All
• Policy.Read.All
• Reports.Read.All
• SecurityEvents.Read.All
• SharePointTenantSettings.Read.All
• MailboxSettings.Read
• AuditLog.Read.All

Tier differences

Stage	Vitals Assessment	Vitals In-Depth
Tenant data accessed	Same production engine/permission set	Same production engine/permission set
Raw Graph snapshot	Memory only; not persisted	Memory only; not persisted
Identifying examples in Report	Removed before rendering	Retained where required for remediation
Named MFA evidence in Report	Not rendered; aggregate evidence	Not rendered; aggregate evidence
Report detail	Scores/findings/counts plus relevant organisational/configuration information	Includes exact remediation evidence such as paths, sharing links and account identifiers
Recommendation payload	None in the current hosted service; recommendations are produced automatically by Vitals without transmitting assessment information to an AI provider.	None in the current hosted service; recommendations are produced automatically by Vitals without transmitting assessment information to an AI provider.
Release	Automatic protected-link delivery to authorised address	Generated and withheld; inaccessible by token until scheduled review and explicit authorised release
Deletion	Detailed Report: 30 days after delivery; a pending Verification Assessment does not extend this period (clause 8.6A); recurring-service history is deleted or de-identified within 30 days after enrolment ends (clause 8.6B). Refunded, closed or incomplete orders: clause 8.6C. Backup copies: clause 8.11.	Detailed Worklist: 30 days after release; a pending Verification Assessment does not extend this period (clause 8.6A); recurring-service history is deleted or de-identified within 30 days after enrolment ends (clause 8.6B). Refunded, closed or incomplete orders: clause 8.6C. Backup copies: clause 8.11.

Schedule 2 — Technical and Organisational Measures

1. Production hosting. Customer Assessments run solely in Microsoft Azure App Service, UK West. The production SQLite database is on App Service persistent storage. The CLI build is internal-development only and is not used for customer processing.

2. Read-only access. Only the read-only Graph application permissions in Schedule 1 are used. Vitals has no write/create/delete Tenant permission.

3. Consent/revocation. Tenant access requires Microsoft Entra administrator consent and can be revoked by the Client through Microsoft Entra.

4. Minimisation. Raw Graph data is memory-only unless a specific structured assessment result is expressly retained under Schedule 1. For Conditional Access effectiveness, individual sign-in records, sign-in account IDs and group/role membership IDs are processed transiently in memory and are not persisted; only aggregate counts and derived results are stored. The sign-in request excludes names, UPNs/email addresses, IP addresses, locations, device details and application names. Vitals Assessment identifying examples are removed before rendering. Named MFA evidence is rendered as aggregate counts. Small aggregates are not assumed to be anonymous where an individual may still be identifiable.

5. Encryption in transit. Encrypted transport (TLS) is used for service communications.

6. Encryption at rest. Production persistent storage is protected by Azure Storage encryption at rest using Microsoft-managed encryption; the Vitals workload is configured in UK West.

7. Access control. Production administrative access is restricted to Innova Group’s Managing Director. Innova Group has no employees with production access at the effective date.

8. MFA. MFA is enabled and enforced on Innova Group administrative and business accounts used to administer Vitals.

9. Report access. Reports use cryptographically random tokenised URLs with a maximum 30-day lifetime measured from Scan delivery or Worklist authorised release. Tokens are invalidated on early deletion; invalid, expired and unauthorised requests do not reveal whether a Report exists.

10. Worklist release. The fulfilment process does not email or make accessible a completed Worklist. The scheduled review must take place and an authorised Innova Group administrator must explicitly release it. Before release, possession of the token does not provide access. The 30-day retention period starts on release.

11. Retention. An automated process runs at least every six hours and removes persisted Reports and specified assessment Personal Data within the applicable periods in clause 8. A Verification Assessment does not extend the periods in clause 8.6, and recurring services may retain only the minimum comparison/history data permitted by clause 8.6B; early removal remains available subject to the Client’s instruction and applicable law. A report document that cannot be deleted stays on a list and its deletion is retried on each run until it is confirmed.

12. Incident handling. Innova Group maintains an incident-handling process proportionate to the service, including assessment, containment, remediation and Client notification where a breach affects Client Personal Data.

13. Change control. Material processing changes are reviewed and the processing description is updated before features that materially expand Personal Data processing are enabled.

14. Backups and recovery. Backup copies of the production database are encrypted at rest and are used only to restore the service. No copy is kept for more than 45 days except under an exceptional hold (clause 8.11(d)). After a restore, removals made since the backup was taken are re-applied from a separate ledger before the restored service resumes processing.

Schedule 3 — Authorised Sub-processors

Sub-processor	Purpose	Personal Data	Location	Transfer position
Microsoft (Azure)	Hosting, compute and persistent storage for Vitals	Report content, assessment results and associated service data stored by Vitals	Vitals production workload configured in Azure UK West	Innova Group maintains applicable Microsoft data-processing terms. Any provider processing/access outside the configured region remains subject to Microsoft’s applicable contractual and transfer safeguards.
Plus Five Five, Inc. (Resend)	Transactional email delivery: approval/consent messages, Scan report links, Worklist release links, reminders and service notices	Recipient/buyer/approver names and email addresses, message content and URLs included in messages	United States / as set out in Resend’s current DPA and sub-processor disclosures	Resend’s current DPA provides for ex-UK transfers using the UK SCCs (EU SCCs amended by the UK Addendum).

Recommendation provider. None in the current hosted service. Recommendations are produced automatically by Vitals and no assessment information is sent to an AI provider for that purpose. If that factual position changes, Innova Group will reassess the processing and any provider before transmitting Personal Data.

Acceptance

This DPA is accepted with the Terms of Supply through the electronic acceptance recorded against the order.