WINNER AI® Data Processing Agreement (DPA)

Last updated: January 2026

This Data Processing Agreement (“DPA”) forms part of the WINNER AI® Terms of Service and applies where Purpol Marketing Ltd processes personal data on behalf of another organisation in connection with the WINNER AI® platform.

This DPA is compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

 

  1. Parties & Scope

This DPA applies where WINNER AI® is used by or provided to:

  • Marketing, PR and communications agencies
  • White-label or reseller partners
  • Award organisers, business networks or accelerators

In these circumstances, personal data may be processed on behalf of a third party acting as Data Controller.

 

  1. Roles

2.1 Partner-Led Use

  • Controller: Partner organisation
  • Processor: Purpol Marketing Ltd

2.2 Individual Direct Use

Where WINNER AI® is accessed directly by an individual award entrant (not via a partner acting as Controller), Purpol Marketing Ltd acts as the Data Controller for that user’s account data, in accordance with the WINNER AI® Privacy Policy.

2.3 No Joint Controllership

Unless expressly agreed in writing, Purpol Marketing Ltd does not act as a Joint Controller with partner organisations. Each party is responsible for compliance with respect to the processing it controls.

 

  1. Subject Matter & Purpose

3.1 Subject Matter

Processing of personal and business data entered into WINNER AI® for the purpose of:

  • Award coaching
  • Content structuring and drafting
  • Account access, security and support

3.2 Nature of Processing

Processing includes collection, storage, structuring, analysis and generation of advisory outputs based on user-provided information.

 

  1. Processor Obligations

Where Purpol Marketing Ltd acts as Processor, it shall:

  • Process personal data only on documented instructions from the Controller
  • Ensure confidentiality of all personal data
  • Implement appropriate technical and organisational security measures
  • Assist Controllers with data subject rights requests where applicable
  • Notify the Controller without undue delay of any personal data breach
  • Not use personal data for purposes other than providing WINNER AI®

 

  1. Partner Warranty (Authority to Share Data)

The Controller warrants that it has obtained all necessary rights, permissions and lawful basis to provide personal data to WINNER AI® for processing under this DPA, including where data relates to clients, employees or third parties.

 

  1. Sub-Processors

Purpol Marketing Ltd may engage approved sub-processors (e.g. secure hosting, payment providers).

  • All sub-processors are GDPR-compliant
  • Sub-processors are bound by written agreements imposing equivalent data protection obligations

A current list of sub-processors is available on request.

 

  1. International Data Transfers

Where personal data is transferred outside the UK:

  • Transfers are safeguarded using UK adequacy regulations or
  • Standard Contractual Clauses (or equivalent protections) where required

WINNER AI® does not transfer personal data internationally without appropriate safeguards in place.

 

  1. Mixed Use: Individuals & Agencies

8.1 Individual to Agency Sharing

Where an individual chooses to share outputs, drafts or data with an agency (inside or outside WINNER AI®), the agency becomes Controller for that data upon receipt.

8.2 Agency-Provided Data

Where an agency inputs client data into WINNER AI®, the agency confirms it has authority to do so, and Purpol Marketing Ltd processes that data as Processor under this DPA.

8.3 Responsibility Split

Each party is responsible for compliance with respect to the processing it controls, including transparency notices, lawful basis and responding to rights requests.

 

  1. Audit & Compliance

Upon reasonable request, Purpol Marketing Ltd shall provide information necessary to demonstrate compliance with this DPA. Formal audits are subject to reasonable notice and confidentiality obligations.

 

  1. Termination

Upon termination of the relevant agreement:

  • Personal data will be deleted or returned in accordance with Controller instructions
  • Subject to applicable legal, regulatory or contractual retention requirements

 

  1. Precedence

In the event of conflict, this DPA shall prevail in relation to data protection obligations.

 

© 2026 Purpol Marketing Ltd | WINNER AI®