DPA
Last Updated: November 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Use between the Contracting Entity (as defined in the Terms of Use: Motives Inc. for US-based customers, and BTRT Ltd for all other customers), trading as Motives ("Processor"), and the Customer ("Controller") who has executed an Service Agreement incorporating this DPA by reference.
1. Definitions
Terms not defined herein shall have the meanings set forth in the Terms of Use. In this DPA:
“Controller Recipients” means Customer Recipients (as defined in the Terms of Use) to which Controller instructs Processor to make Personal Data available.
"Data Protection Laws" means the UK GDPR, EU GDPR (where applicable), and any other applicable data protection legislation.
"Personal Data" means any personal data processed by Processor on behalf of Controller under the Agreement.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
"Processing" has the meaning given in Data Protection Laws.
“Retention Period” has the meaning given in the Terms of Use.
"Sub-processor" means any third party engaged by Processor to process Personal Data.
2. Processing of Personal Data
2.1 Scope of Processing
Processor shall process Personal Data only on documented instructions from Controller, except where required by applicable law. The processing details are:
Categories of Data Subjects: Research interview participants, survey respondents, and other individuals whose data is collected through the Services
Types of Personal Data: Voice recordings, video recordings, transcripts, demographic information, contact details, and survey responses
Purpose: To provide AI-powered consumer research and market research services, including making Personal Data available to Controller Recipients on Controller’s instructions
Duration: For the Retention Period and deletion period that follows it under Section 2.2(f)
2.2 Processor Obligations
Processor shall:
a) Process Personal Data only on Controller's written instructions;
b) Ensure that all persons authorized to Process Personal Data have committed themselves to confidentiality or are under an appropriate statutory duty of confidentiality and receive appropriate training regarding the handling of Personal Data;
c) Implement appropriate technical and organizational measures to ensure security of Personal Data, including measures to prevent unauthorized access, disclosure, alteration, or destruction;
d) Not transfer Personal Data outside the UK/EEA except (i) to a Sub-processor authorized under Section 3, (ii) with Controller’s prior consent, or (iii) to a Controller Recipient on Controller’s instructions under Section 2.4, and in the case of (i) and (ii) subject to the appropriate safeguards described in Section 8;
e) Taking into account the nature of the processing, assist Controller in ensuring compliance with Articles 32–36 GDPR, including security obligations, Personal Data Breach notifications, Data Protection Impact Assessments and consultations with supervisory authorities;
f) Delete or return, at Controller’s choice, all Personal Data within 60 days after the end of the Retention Period, and any Personal Data that Controller instructs Processor in writing to delete earlier within one month of that instruction, except where retention is required by law, and certify such deletion to Controller on request;
g) Make available information necessary to demonstrate compliance with this DPA and allow for audits as described in Section 5;
h) Immediately inform Controller if, in Processor's opinion, an instruction infringes applicable Data Protection Laws;
i) Maintain records of the Processing activities carried out on behalf of Controller as required by Article 30(2) UK GDPR or EU GDPR, as applicable, and make such records available to Controller or a supervisory authority on request.
2.3 Use for AI and Model Training
Processor shall not, and shall procure that its Sub-processors do not, use Personal Data — or any recordings, transcripts, analyses or other outputs derived from it — to train, fine-tune, develop or otherwise improve any artificial intelligence or machine-learning model. Processor does not train, fine-tune or develop its own foundation models.
Where Processor engages a Sub-processor to provide artificial intelligence or machine-learning services, Processor shall ensure that such Sub-processor is engaged under terms that contractually prohibit the use of Personal Data submitted through the Services to train, fine-tune or improve that Sub-processor's models.
Nothing in this clause restricts Processor from Processing Personal Data at inference solely to provide the Services in accordance with Controller's documented instructions.
2.4 Disclosures at Controller’s direction.
Controller may instruct Processor to make Personal Data available to Controller Recipients, including by using the sharing or export features of the Platform or by giving Controller Recipients access to the Platform. Each such disclosure is made on Controller’s documented instructions. Controller Recipients are not Sub-processors of Processor. Controller is responsible for: (a) having (or, for an agency or adviser engaged by an End Client, ensuring that the End Client has) a written agreement with each Controller Recipient (other than an End Client that is itself a controller of the Personal Data) that meets the requirements of Data Protection Laws, including confidentiality and a prohibition on using Personal Data to train artificial intelligence or machine-learning models; (b) any safeguards required for transfers of Personal Data to Controller Recipients outside the UK/EEA; (c) ensuring each Controller Recipient deletes or returns the Personal Data when its work ends and in any event by the end of the Retention Period; and (d) the acts and omissions of Controller Recipients. Processor has no liability for the Processing of Personal Data by a Controller Recipient after it has been disclosed under this clause.
2.5 Customer acting for an End Client.
Where Customer commissions research on behalf of an End Client, Customer confirms that it has the End Client’s authority to engage Processor and to give instructions on the End Client’s behalf, and Processor may rely on Customer’s instructions as the End Client’s. Processor’s obligations under this DPA are owed to Customer, who is responsible for the End Client’s compliance with it. Making Personal Data available to the End Client is a disclosure under Section 2.4. Customer shall pass on to the End Client any notice Processor gives under this DPA, including notice of Sub-processor changes under Section 3.2.
3. Sub-processors
3.1 Authorized Sub-processors
Controller acknowledges and agrees that Processor may engage Sub-processors in the following categories to deliver the Services:
Cloud infrastructure and hosting providers
Specific Sub-processors within these categories are listed at www.motives.ai/subprocessors.
3.2 Sub-processor Changes
Processor maintains a current list of Sub-processors at www.motives.ai/subprocessors and offers a mechanism for Controller to subscribe to notifications of changes. Processor shall give Controller at least 30 days' prior notice of the addition or replacement of any Sub-processor (including within the authorized categories) by updating that list and notifying subscribed Controllers. For Sub-processors in categories not listed in Section 3.1, Processor shall give at least 30 days' prior notice. Controller may object to a new Sub-processor on reasonable data-protection grounds within 14 days of notice, and the parties shall work in good faith to resolve the objection; where it cannot be resolved, Controller may terminate the affected Services.
3.3 Sub-processor Obligations
Processor shall ensure Sub-processors are bound by data protection obligations no less protective than this DPA. Where a Sub-processor fails to fulfill its data protection obligations, Processor shall remain fully liable to Controller for the performance of that Sub-processor's obligations.
4. Security and Breach Notification
- Artificial intelligence and machine learning services
- Video conferencing and recording platforms
- Transcription and speech-to-text services
- Analytics and data visualization tools
- Customer relationship management systems
- Communication and support tools
4.1 Security Measures
Processor maintains security measures including:
- Encryption at rest and in transit
- Access controls and least privilege
- Multi-factor authentication
- Logging and monitoring
- Vulnerability management
- Regular penetration testing
- Employee security awareness training
- Disaster recovery and backups
Further detail is set out in Annex B (Technical and Organizational Measures).
4.2 Personal Data Breach
Processor shall notify Controller without undue delay, and in any event within 72 hours where feasible, after becoming aware of a Personal Data Breach affecting Controller's Personal Data. The notification shall describe, to the extent known, the nature of the breach (including the categories and approximate number of data subjects and records concerned), the likely consequences, and the measures taken or proposed to address it, and shall provide sufficient information for Controller to meet its regulatory obligations.
5. Audit Rights
Processor will make available to Controller the information reasonably necessary to demonstrate compliance with this DPA and with Article 28 UK GDPR. In addition to such documentation, Controller (or an independent auditor mandated by Controller and reasonably acceptable to Processor) may conduct an audit, including an on-site inspection, no more than once in any twelve-month period, on at least 30 days' prior written notice, during normal business hours and without unreasonable disruption to Processor's operations. Further audits may be conducted where required by a supervisory authority or following a Personal Data Breach affecting Controller's Personal Data. Controller shall bear its own audit costs and Processor's reasonable costs (including professional services time) for audits requiring significant resources beyond standard compliance documentation.
6. Data Subject Rights
Taking into account the nature of the processing, Processor shall assist Controller in responding to data subject requests by:
- Providing tools for data export and deletion where technically feasible
- Responding promptly to Controller's requests for assistance
- Forwarding any data subject requests to Controller without undue delay
Controller is responsible for passing data subject requests on to any Controller Recipients that hold the Personal Data.
7. Liability and Indemnification
Liability under this DPA is subject to the limitation of liability provisions in the Terms of Use. Each party shall indemnify the other against regulatory fines or third-party claims resulting from the indemnifying party's breach of Data Protection Laws.
Controller is liable for the acts and omissions of Controller Recipients as if they were its own.
8. International Transfers
Where Personal Data is transferred outside the UK/EEA, Processor shall ensure appropriate safeguards are in place, including as applicable:
- the EU Standard Contractual Clauses (Module Two: controller-to-processor) for transfers subject to EU GDPR;
- the UK International Data Transfer Addendum to the EU SCCs, or the UK IDTA, for transfers subject to UK GDPR;
- an adequacy decision covering the destination country; or
- another transfer mechanism approved under Data Protection Laws.
Controller's authorization of the Sub-processors under Section 3 constitutes its consent to the related transfers, subject to these safeguards.
Where the EU Standard Contractual Clauses or UK IDTA/Addendum apply, their annexes shall be deemed completed with the processing details set out in Section 2.1, the Sub-processor list referenced in Section 3, and the technical and organizational measures set out in Annex B.
This Section 8 does not apply to disclosures to Controller Recipients under Section 2.4.
9. Term and Termination
This DPA continues for as long as the Agreement is in force and, after that, for as long as Processor holds Personal Data. Obligations regarding security, confidentiality, and return/deletion of Personal Data survive termination.
10. Order of Precedence
In the event of any conflict between this DPA and the Terms of Use or any Service Agreement, this DPA shall prevail with respect to the Processing of Personal Data and matters of data protection.
11. Governing Law
This DPA is governed by the same law, and subject to the same jurisdiction provisions, as the Terms of Use.
Current Sub-processors: Available at www.motives.ai/subprocessors
Contact for Data Protection Matters: privacy@motives.ai
Annex B — Technical and Organizational Measures
Processor implements and maintains the following technical and organizational measures to protect Personal Data:
1. Encryption. Personal Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
2. Access control. Role-based access controls on a least-privilege basis; access to Personal Data is limited to personnel who require it to provide the Services. Multi-factor authentication is enforced for systems processing Personal Data.
3. Logging and monitoring. Access to production systems is logged and monitored for anomalous activity.
4. Vulnerability management. Regular vulnerability scanning and patching; penetration testing conducted at least annually.
5. Personnel. All personnel with access to Personal Data are bound by confidentiality obligations and receive security awareness training.
6. Data minimization and segregation. Customer data is logically segregated; Personal Data is retained for the Retention Period and in accordance with Section 2.2(f).
7. Business continuity. Documented disaster recovery and backup procedures, tested periodically.
8. Sub-processor security. Sub-processors are assessed for security posture before engagement and bound by obligations per Section 3.3.
Annex A — US State Privacy Laws Addendum
This Annex applies where Motives Inc. is the contracting entity for a Controller subject to US state privacy laws, including the California Consumer Privacy Act as amended by the CPRA ("US State Privacy Laws"). Terms such as "business," "service provider," "sell," "share," and "personal information" have the meanings given under the applicable US State Privacy Laws.
1. Roles. Controller (or, where Customer acts for an End Client, the End Client) is the “business” and Processor is a “service provider” processing personal information solely to provide the Services.
2. Restrictions on use. Processor shall not: (a) sell or share personal information; (b) retain, use, or disclose personal information for any purpose other than performing the Services, or as otherwise permitted by US State Privacy Laws; (c) retain, use, or disclose personal information outside the direct business relationship between the parties; or (d) combine personal information with information received from other sources, except as permitted under US State Privacy Laws.
2A. Disclosures that Processor makes to Controller Recipients at Controller’s direction are made on Controller’s behalf. They are not a sale or sharing of personal information by Processor.
3. Certification. Processor certifies that it understands and will comply with these restrictions.
4. Assistance. Processor shall assist Controller in responding to verifiable consumer requests (access, deletion, correction, and opt-out) to the extent required by US State Privacy Laws.
5. Sub-processors. Processor shall impose these obligations on any Sub-processor that processes personal information on Controller's behalf.
6. Compliance. Processor shall comply with US State Privacy Laws, provide the same level of privacy protection as they require of Controller, and notify Controller within five business days if it can no longer meet its obligations under them.
7. Controller rights. Controller may take reasonable steps (including under Section 5) to ensure Processor uses personal information consistently with this Annex and, on notice, to stop and remediate unauthorized use.
8. Specified purposes. The business purposes are those in Section 2.1 (Purpose) of this DPA.
