Data Processing Agreement

1. Definitions

Controller means the Customer, who determines the purposes and means of processing personal data through their use of Dolemai.

Processor means Lapunne Limited (trading as Dolemai).

Personal data, processing and special category data have the meanings given in UK GDPR. Special category data means the categories listed in Article 9(1).

UK GDPR means the UK General Data Protection Regulation as retained in UK law, together with the Data Protection Act 2018.

Sub-processor means any third party appointed by Lapunne Limited to process personal data in providing Dolemai.

2. Scope and purpose

2.1 This DPA applies to all personal data processed by Lapunne Limited in providing Dolemai to the Customer.

2.2 The personal data processed may include names, contact details, job titles and correspondence of project stakeholders, consultants, contractors and client representatives appearing in the documents, emails and project records the Customer connects to Dolemai.

2.3 Special category data. The Customer acknowledges that construction project records may contain special category data — for example health information within accident reports, RIDDOR notifications, occupational health referrals or absence records. Dolemai does not require special category data in order to function and does not seek it. Where such data is present in material the Customer connects, it is processed only because the Customer has placed it in scope.

2.4 The Customer must not connect material containing personal data relating to criminal convictions or offences.

2.5 The purpose of processing is to provide the Dolemai service as described in the Terms and Conditions.

2.6 The duration of processing is the duration of the Customer's active subscription, plus any retention period in this DPA or the Privacy Policy.

3. Dolemai's obligations as processor

Lapunne Limited shall:

3.1 Process personal data only on the Customer's documented instructions, and not for any other purpose.

3.2 Ensure all personnel authorised to process personal data are bound by confidentiality obligations, and restrict access to those who need it to provide support, investigate a fault or maintain security.

3.3 Implement appropriate technical and organisational measures, including encryption of connection credentials, row-level tenant isolation, multi-factor authentication, and access restricted on a need-to-know basis. These are described at dolemai.com/security.

3.4 Not transfer personal data outside the United Kingdom without appropriate safeguards as described in clause 6.

3.5 Assist the Customer in responding to data subject rights requests so far as technically possible.

3.6 Notify the Customer without undue delay on becoming aware of a personal data breach affecting the Customer's data.

3.7 Delete or return all personal data on termination, at the Customer's choice.

3.8 Provide the Customer with the information necessary to demonstrate compliance with this DPA, and cooperate with reasonable audits on reasonable notice.

3.9 Not use the Customer's project data, documents or personal data to train artificial intelligence models, and appoint only AI sub-processors who are contractually prohibited from doing so.

3.10 Not carry out automated decision-making producing legal or similarly significant effects. All Dolemai outputs are advisory drafts requiring the Customer's professional review before use.

4. Customer's obligations as controller

The Customer shall:

4.1 Ensure it has a lawful basis under Article 6 for processing the personal data it connects to Dolemai and for sharing it with Lapunne Limited.

4.2 Where special category data is present, ensure a condition under Article 9(2) and, where applicable, a condition under Schedule 1 of the Data Protection Act 2018 is met, and maintain an appropriate policy document where required.

4.3 Ensure data subjects whose personal data appears in connected material have been given the privacy information required by UK GDPR.

4.4 Decide which folders and mail channels are in scope, and exclude any that are not appropriate. Dolemai provides folder-level exclusion controls for this purpose. Scope changes apply to future processing; information already extracted remains in the Customer's registers until the Customer removes it.

4.5 Provide clear instructions regarding the processing of personal data.

5. Sub-processors

5.1 The Customer provides general authorisation for Lapunne Limited to engage sub-processors.

5.2 The current list is published at dolemai.com/sub-processors.

5.3 Lapunne Limited will give at least 30 days' notice by email before a new sub-processor takes effect, and will update the published list.

5.4 If the Customer does not accept a change, the Customer may terminate the affected project subscription before the change takes effect and receive a pro-rata refund of any prepaid fees.

6. International transfers

6.1 Some sub-processors are located outside the United Kingdom. Transfers are protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, the UK extension to the EU–US Data Privacy Framework, or another approved mechanism, as set out at dolemai.com/sub-processors.

7. Document processing and data minimisation

7.1 Documents and emails the Customer connects are retrieved, processed, and discarded. They are not written to disk or stored in Lapunne Limited's database. Only the structured intelligence extracted is retained.

7.2 Processing those documents requires transmitting their content to Anthropic's Claude API. Anthropic retains inputs and outputs for up to 30 days for safety and security purposes and is contractually prohibited from using them for model training.

7.3 No document content, register content or personal data is transmitted to OpenAI. Only the project's RIBA stage and construction contract type are used to search public legislation.

8. Retention and deletion

8.1 Personal data is retained while the relevant project exists in the Customer's account.

8.2 When the Customer deletes a project, all project data, registers and reports are deleted immediately and permanently. There is no retention window and no recovery.

8.3 Discarded report content is deleted immediately.

8.4 Ask Dolemai responses are retained for a maximum of 30 days.

8.5 Billing records are held by Stripe for six years as required for UK financial record-keeping.

8.6 Dolemai does not delete any project automatically. Inactive projects are flagged and the Customer is prompted by email; deletion is always the Customer's decision.

8.7 The Customer may delete their account at any time from Account Settings, which erases all their personal and project data. On termination or written request, Lapunne Limited will delete the Customer's personal data within 30 days except where retention is required by law.

9. Governing law

England and Wales.

10. Contact

Data protection contact: privacy@dolemai.com — Lapunne Limited — ICO registration ZB111903.

Countersigned copies. If your organisation requires a countersigned DPA, email privacy@dolemai.com with your organisation name and registered address. We will respond within 5 business days.