Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Analyst One Terms of Service between Felix Research Limited ("Felix", "we", "us") and the organisation or business customer that uses the Analyst One service ("Customer", "you"). It is incorporated into the Terms by reference. You do not need to sign it separately: by accepting the Terms you accept this DPA.

If you require a signed instrument, we will counter-sign this DPA, unchanged, on request — contact privacy@felixresearch.com. Requests for bespoke DPA terms are considered case by case.

1.1 Definitions

"Applicable Data Protection Law" means the UK GDPR, the Data Protection Act 2018, and PECR 2003; and where the processing is subject to it, Regulation (EU) 2016/679 (the "EU GDPR").

"Customer Data" means the documents, files, URLs, text, prompts, chat messages, generated outputs and associated metadata that you or your users submit to, or generate within, the Service.

"Personal Data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the UK GDPR. "Customer Personal Data" means Personal Data contained in Customer Data. "Sub-processor" means a processor engaged by Felix to process Customer Personal Data.

1.2 Felix as processor

For Customer Personal Data, you are the controller and Felix is the processor. This applies to: documents and files you upload; URLs you supply for import and the content retrieved from them; text you type into chat, prompts and workflow instructions; text, layout data, entities, graphs, embeddings and reports the Service derives from the above; and the metadata describing them, including filenames, page counts and workspace names.

1.3 Felix as independent controller

Felix is an independent controller — not your processor — for the following. This processing is described in the Privacy Policy, and this DPA's processor obligations do not apply to it.

One point of honesty about this split: the usage ledger currently records the filename of each document processed, linked to the account that processed it. A filename is Customer-supplied content and can itself contain Personal Data. To the extent that it does, Felix treats it as Customer Personal Data under this DPA even though the ledger as a whole is controller-side processing. See clause 11.4.

1.4 Where you are not the controller

If you are yourself a processor for a third party in respect of Customer Personal Data, you confirm that you have that third party's authority to appoint Felix as a sub-processor on these terms.

1.5 Felix's details

Felix Research Limited, a company registered in England and Wales, company number 16434274, registered office 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. ICO registration number ZB904139.

Felix is not required to appoint, and has not appointed, a Data Protection Officer. The individual accountable for data protection at Felix is its founder; the contact address for all data protection matters is privacy@felixresearch.com.

2.1 Subject matter

The processing of Customer Personal Data contained in the documents, URLs, prompts and outputs you submit to or generate within Analyst One, for the purpose of providing the Service.

2.2 Duration

The term of the Terms, plus the retention periods at clause 11. Individual categories have shorter, technically enforced lifetimes.

2.3 Nature of the processing

1. Receipt and transport. Your browser transmits the file to a Felix-operated interface over an encrypted connection. Traffic transits a CDN in flight.
2. Temporary storage for processing. The file is written to the receiving server's local storage and then to Felix-operated object storage in the EU. For Office formats, the original is stored in addition to a converted PDF.
3. Rendering. Felix-operated compute renders each page to an image.
4. OCR and layout recovery. Page images are sent to a third-party GPU platform running an open-weights model Felix has deployed there.
5. Text clean-up, figure description and enrichment. Extracted text and page images are sent to third-party LLMs through a model gateway.
6. Entity and relationship extraction. Extracted text is sent to third-party LLMs through the same gateway to build a knowledge graph.
7. Embedding. Text chunks are sent to a third-party GPU platform and converted to numeric vectors.
8. Retrieval, chat and report generation. Assembled prompts containing document excerpts, your chat messages, and your self-reported role and industry are sent to third-party LLMs through the gateway.
9. Evidence ranking and request classification. To rank search results, a search query and the candidate document passages retrieved for it are sent to a third-party classification model. To decide how much reasoning an answer needs, your chat message and the text of the previous answer are sent to the same model. These requests go to the model provider directly, not through the gateway.
10. Web retrieval, when you ask for it. URLs you supply, and pages the assistant opens while answering, are fetched server-side through a third-party scraping service or a controlled direct fetch. Search queries derived from your input go to a third-party search service.
11. Storage and retrieval of your workspace, where the Service stores Customer Data on Felix infrastructure.
12. Deletion, per clause 11.
13. Logging, monitoring and error reporting, and the security operations at clause 6.

2.4 Purpose

To provide, operate, secure, support and maintain the Service, and for no other purpose.

Felix does not use Customer Data to train, fine-tune or evaluate machine learning models, whether its own or a third party's. Prompt logging and model training on Felix's traffic are disabled at the model gateway account level, routing is restricted to model providers that do not retain, store or train on request content, and Felix does not permit the Sub-processors it sends Customer Data to for inference to use it for training. The classification model provider at step 9 is engaged directly rather than through the gateway: it does not train on Customer Data, and its retention is described in its row at 7.4.

2.5 Note — two kinds of workflow, two storage locations

This note is material. Read it.

The Service offers two kinds of workflow, and where your Customer Data lives at rest depends on which you use:

Private workflows are stored in your own browser's local storage on your own device. Documents, extracted text, chats, knowledge graphs and reports in a private workflow are held by Felix's servers only transiently while processing runs — see clause 11.2, where object-storage lifetime is one day and extracted-text lifetime is six hours. The practical consequences: Felix cannot restore a private workflow if you clear your browser storage or change device; deletion and export of private workflow content is performed by you, in the application; and Felix's ability to assist with data subject requests in respect of that content is limited to the transient copies at 11.2 and the account-level records at 11.3.

Organisation workflows are stored durably on Felix infrastructure, in the EU (AWS, Ireland): a PostgreSQL database dedicated to your organisation, object storage for source files, page renders and graph material, and vector storage for embeddings. Organisation workflows are cross-device and shared with the members of your organisation. The clauses of this DPA written as "where the Service stores Customer Data on Felix infrastructure" apply to them, including deletion and return under clause 11. Server-side persistence of organisation workflow content is being rolled out feature by feature; at any given time, content the rollout has not yet reached behaves as private-workflow content does.

All statements in this DPA about who receives your data, where it goes in processing, and what security applies are true for both kinds of workflow — the processing pipeline at 2.3 is identical; only the durable store differs.

3.1 The core problem: Felix cannot predict what is in your documents

Analyst One is a document analysis tool. You choose what to upload. Felix has no advance knowledge of, and no practical means of determining in advance, what Personal Data a document contains.

A document may contain Personal Data about you; your colleagues; your clients, counterparties, suppliers and their staff; and named individuals discussed in the document, including individuals with no relationship to you at all — directors named in a company filing, or people named in correspondence, board minutes, contracts, court documents or news reports.

It may also contain special category data (Article 9 UK GDPR) or criminal offence data (Article 10).

Felix does not filter, classify or screen document content for Personal Data, and makes no claim to do so.

3.2 Your responsibilities

You are the controller. Accordingly you are responsible for:

1. having a lawful basis under Article 6, and where relevant a condition under Articles 9 or 10, for every processing operation you instruct;
2. providing transparency information required by Articles 13 and 14, including where data reaches Felix without the data subject's knowledge;
3. carrying out a DPIA where required, taking account of the sub-processing and transfers at clauses 7 and 12;
4. assessing whether the security measures at clause 6 are appropriate to the data you choose to upload, before you upload it;
5. not uploading data your own agreements, professional obligations or applicable law prevent you from disclosing to a third-party processor.

Felix does not prohibit special category or criminal offence data: you may submit it where you have satisfied yourself of the conditions above, and the responsibility for that assessment is yours.

Documents subject to legal professional privilege. Analyst One is built for confidential business documents, and Felix's confidentiality and security obligations apply to privileged material exactly as to any other Customer Data. Nothing in this DPA requires you to submit privileged material; whether uploading it is compatible with your professional obligations is your assessment to make.

3.3 Categories of data subjects

3.4 Categories of personal data

Processed by Felix as processor (Customer Personal Data):

Processed by Felix as independent controller (clause 1.3, and the Privacy Policy): identity (user id, email, first/last/display name) · organisation (id, name, membership) · self-reported profile (company, role, industry, free text up to 1,000 characters) · preferences and consents with timestamps · session data · usage records including document filename (see 11.4) · billing · IP address (transient, rate limiting) · telemetry keyed to a pseudonymous identifier.

4.1 Processing on instruction only

Felix processes Customer Personal Data only on your documented instructions, including in respect of transfers to a third country, unless required otherwise by law to which Felix is subject. Where law requires it, Felix will inform you before processing, unless the law prohibits it on important grounds of public interest.

4.2 What counts as your instructions

(1) this DPA and the Terms; (2) your and your users' use of the features of the Service — uploading a document, running a workflow, sending a chat message, importing a URL, generating a report, and deleting content are each instructions to perform the corresponding processing; (3) the configuration choices available to you; (4) any further written instruction Felix accepts in writing.

4.3 Additional instructions

Felix will consider written instructions outside clause 4.2, may charge for the work of following them, and may decline any that is technically infeasible, would require a change to the Service, or would put Felix in breach of law or a third-party agreement. Felix will say if it declines and why.

4.4 Unlawful instructions

Felix will inform you if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend performance until it is withdrawn, amended or confirmed. Felix is not obliged to give legal advice, and its failure to identify an infringing instruction does not transfer your responsibility for it.

4.5 No independent use

Felix does not sell Customer Personal Data, does not share it for cross-context behavioural advertising, and does not use it for its own purposes. In particular, Felix does not use Customer Data to develop, train, fine-tune, benchmark or evaluate machine learning models (clause 2.4).

5.1 Commitment

Felix ensures that any person authorised to process Customer Personal Data is subject to an appropriate contractual or statutory duty of confidentiality that survives the end of their engagement.

5.2 Need to know

Access to production systems is limited to Felix's founding team — currently two named individuals, each bound by duties of confidentiality — and only to the extent needed to provide, support, secure or maintain the Service. Two supporting facts, verifiable in the infrastructure configuration: administrative shell access to production hosts is restricted at the network level to a single specified address; production database access is limited to systems inside the private network and the database is not publicly reachable.

6.1 General obligation

Felix implements and maintains appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 UK GDPR. Felix may change them, but will not make a change that materially reduces the overall level of security.

6.2 Technical measures in force

Encryption in transit — all browser traffic over HTTPS; the load balancer accepts TLS 1.2 and 1.3 only under a current AWS security policy; traffic to Sub-processors over HTTPS.

Encryption at rest — production database storage-level encryption; object storage buckets holding uploaded documents, usage audit events and archived logs use SSE-AES-256; server disk volumes encrypted; credentials and API keys stored as encrypted parameters with scoped decryption permissions.

Network isolation — all processing infrastructure runs inside a private virtual network; the database runs in private subnets and is not publicly accessible; the in-memory cache holding extracted text is reachable only from inside the private network; administrative shell access restricted to a single specified address; the analytics platform's read-only database connection restricted to three specified addresses, with the key constrained to port-forwarding to the database host only.

Application and edge protection — a managed WAF with a request-path allowlist, logs retained; per-address rate limiting; uploads capped at 200 MB per file; server-side retrieval of user-supplied URLs protected against SSRF — private and reserved ranges blocked after DNS resolution (which prevents DNS rebinding), domains validated, content type and file signature checked, size and timeout limits enforced.

Access control and least privilege — authentication and session management by a specialist identity provider; session cookies HTTP-only, same-site restricted, secure in production; each processing component runs under its own identity with only the permissions it needs (the page-rendering component, for example, has no permission to delete objects from storage).

Data minimisation and pseudonymisation — requests to the model gateway carry a keyed hash of the user identifier, not a name or email; product analytics events constrained by an enforced rule to identifiers, counts, durations and enumerated values, and must not carry document content, chat text or email addresses; analytics identity is a pseudonymous internal identifier; session recording and autocapture are disabled in the Analyst One application.

Resilience, backup and deletion — automated database backups with a 7-day retention window in production and deletion protection enabled; object storage lifecycle rules expire processing artefacts after one day; extracted text expires after six hours; the usage audit archive is versioned.

6.3 Organisational measures

Infrastructure is defined as code and changed through version control and CI, giving a reviewable change history. Production deployment uses short-lived federated credentials rather than long-lived keys. Production access is limited as described at 5.2. Felix maintains an incident response plan (clause 9) and a security contact with a published vulnerability disclosure route (clause 9.6).

Felix does not currently hold ISO/IEC 27001, SOC 2 or Cyber Essentials certification, and no independent penetration test has yet been performed. Clause 10 describes what Felix offers instead.

6.4 Current limitations

Felix states the following openly. They are known, they are being addressed, and a customer assessing whether these measures are appropriate to its data should take them into account.

1. Traffic to the in-memory processing cache is not encrypted in transit. The cache holds extracted document text for up to six hours. It sits inside the private network and is password-protected, but the connection itself is not TLS-encrypted. Network isolation is the operative control.
2. Client-side error reports are not fully content-scrubbed. An error message embedding a filename would be transmitted with it. A scrubbing pass is in progress.
3. Service logs are not centrally redacted. Certain processing events currently log document filenames. Logs are retained 90 days, archive 365 days. A redaction pass is in progress.
4. The usage ledger retains document filenames, linked to the account. See clause 11.4.
5. Self-service account deletion is not yet available. Deletion is performed by Felix on request, on the timescales at clause 11.5.
6. The region in which GPU inference runs is not currently constrained in production. See clause 12.4.

7.1 General authorisation

You give Felix general authorisation to engage Sub-processors. Felix (1) enters into a written contract with each imposing data protection obligations no less protective than those in this DPA; (2) remains fully liable to you for each Sub-processor's performance; (3) maintains the list at 7.4 and updates it per 7.2.

7.2 Change notification

Felix will give at least 14 days' notice before a new Sub-processor begins processing, or before an existing one's role materially changes. Notice is given by email to the product-updates list — every account holder can subscribe — and by updating the list at 7.4 on this page.

You may object on reasonable data protection grounds within the notice period. If Felix cannot address the objection within a reasonable period, you may terminate the affected part of the Service without penalty, and Felix will refund prepaid fees covering the period after termination.

7.3 How to read the table

Contingent rows receive data only when a user takes a specific action. Planned rows are not yet in the data path. Entity names are the names the services trade under; locations describe where the listed processing takes place.

7.4 Sub-processor list

Infrastructure and processing

Identity, billing and communications

Observability and analytics

Contingent — engaged only when a user takes a specific action

Controller-side, listed for transparency — not Sub-processors of Customer Personal Data

7.5 Vendors that do not process Customer Personal Data

Felix uses further vendors for source control, CI, infrastructure state, package distribution and project tracking. These do not receive Customer Personal Data in ordinary operation and are not listed as Sub-processors. Felix's support practice is not to copy Customer Data into its project tracker; where you include content in a support request, it is handled under clause 5.

8.1 Technical and organisational measures

Taking into account the nature of the processing, Felix assists you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to Chapter III requests — access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making.

8.2 Self-service

Where the Service lets you access, correct, export or delete Customer Data directly, you are expected to use it. While the browser-local architecture at 2.5 remains in operation, export and deletion of workspace content are performed by you, in the application. Felix does not hold a durable copy to act on.

8.3 Requests received by Felix

Felix will not respond directly to a data subject request relating to Customer Personal Data, except to acknowledge receipt and direct the individual to you, unless you instruct otherwise or the law requires. Felix will notify you without undue delay.

8.4 Timescales and cost

Felix will respond in time for you to meet your statutory deadline, provided you give at least 10 working days' notice. Reasonable assistance is free; Felix may charge for repetitive or excessive requests, or work beyond retrieving data the Service already exposes, and will say so before incurring cost.

8.5 Erasure and export of account-level data

Deletion and export of the account-level records Felix holds (clause 11.3) are performed by Felix on request. Requests go to privacy@felixresearch.com from the account's registered email address; Felix acknowledges within 3 working days and completes within 14 days, and in any event within one month. The process is currently operated manually by Felix personnel; a self-service path is planned. What deletion covers, and what is lawfully retained afterwards, is set out at clause 11.5.

8.6 Assistance with Articles 32 to 36

Security of processing (Art. 32) — by maintaining clause 6 and answering questions about it. Breach notification (Arts. 33–34) — see clause 9. DPIAs (Art. 35) — by providing information only Felix holds. Prior consultation (Art. 36).

9.1 Notification to you

Felix notifies you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and in any event within 48 hours.

"Becoming aware" means when Felix has a reasonable degree of certainty that a security incident has occurred leading to destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

9.2 Content of the notification

Nature of the breach, including where possible categories and approximate numbers of data subjects and records; likely consequences; measures taken or proposed; and a contact point. An initial notification will not be delayed for want of complete information.

9.3 Cooperation

Felix will cooperate and take reasonable steps as you direct to assist investigation, mitigation and remediation, and will preserve relevant evidence.

9.4 No admission

Felix's notification is not an acknowledgement of fault or liability.

9.5 Notification to authorities and data subjects

You are responsible for notifying the supervisory authority and affected data subjects where required. Felix will not do so on your behalf, and will not make a public statement identifying you in connection with a breach, without your prior written agreement, unless required by law.

9.6 Reporting a suspected breach to Felix

If you — or a security researcher — believe Customer Personal Data has been or may be compromised, or have found a vulnerability, contact security@felixresearch.com. The mailbox is monitored by the accountable individuals directly; reports are acknowledged within 3 working days and handled under Felix's incident response plan. Good-faith security research that respects user data will not be met with legal action.

10.1 Information

Felix makes available the information necessary to demonstrate Article 28 compliance: this DPA including the sub-processor list and security description; the Privacy Policy; and written answers to reasonable data protection and security questions, including a completed security questionnaire, once per twelve-month period.

10.2 Audits

Felix supports audits primarily through the information at 10.1 and remote review: written responses, documentation, configuration evidence, and screen-shared walkthroughs with the personnel at 5.2. An on-premises inspection is available only where a supervisory authority requires it, or following a personal data breach affecting your data — in which case: 30 days' written notice; during business hours, without unreasonable disruption, and without compromising other customers' data; your auditor must not be a competitor and must sign a confidentiality undertaking; Felix may satisfy the right with an independent third-party report where one exists covering the scope. You bear your own costs; Felix may charge reasonable costs, agreed in advance, for audit support beyond 10.1. Felix need not give access where doing so would breach a duty to a third party.

10.3 Findings

Audit findings are jointly confidential. You will share findings relevant to Felix's compliance, and Felix will remediate confirmed non-compliance at its own cost within a reasonable period.

11.1 On termination

On termination or expiry, Felix will at your choice delete or return the Customer Personal Data it holds, and delete existing copies, unless law requires retention. You must choose within 30 days; if you do not, Felix will delete. Where the Service holds Customer Data on Felix infrastructure, Felix will complete deletion within 30 days of your choice (or of the deadline passing), with backup copies rotating out within a further 7 days (11.6). Return means export of the data Felix actually holds (clause 11.3), in a structured machine-readable format (JSON); Felix cannot return workspace content held only in your browser, which you export from the application.

11.2 Automatic deletion during normal operation

Enforced by the infrastructure, irrespective of termination.

The processing cache holds no persistent storage; its contents do not survive a restart.

The rows above describe transient processing copies. For organisation workflows, the uploaded file and page renders are additionally retained as part of the durable workspace under 11.3, until the workflow or workspace is deleted.

11.3 Data retained beyond processing

11.4 Document filenames in the usage ledger

Felix records the filename of each document processed, against the account that processed it, for billing, fair-use metering and cost attribution. Because a filename is content you supply, it may itself contain Personal Data. Felix is working to remove the filename from these records, since billing needs a count and an identifier, not a name. Until that change ships: filenames are removed from a user's usage records when the account is deleted (11.5), and usage records themselves are deleted or fully anonymised no more than 24 months after account closure.

11.5 Account deletion

Account deletion is performed by Felix on request to privacy@felixresearch.com, on the timescales at 8.5. Deletion covers: the identity and authentication record, the account profile and contact preferences, the analytics person profile and its events, email contacts, and the link between the usage ledger and the account — usage records are detached from the identity, their filenames removed, and the remainder retained for no more than 24 months for accounting, metering-integrity and abuse-prevention purposes. Billing records (invoices and payments) are retained for 6 years under accounting law. A self-service deletion path is planned; this clause describes the operated process it will replace.

11.6 Backups and archives

Data deleted from live systems persists in encrypted database backups until they rotate out, currently within 7 days. Felix does not restore deleted data from backup except in disaster recovery, in which case deletions are re-applied. Archived logs and the usage audit archive are retained for the fixed periods at 11.3 under Felix's legal obligations and legitimate interests in security and accounting integrity; they are technically inaccessible for individual amendment, are not restored to live systems, and expire on their own schedule.

11.7 Legal retention

Felix may retain Customer Personal Data to the extent required by law, keeping it confidential, protected under clause 6, and processed only for the purpose requiring its retention.

12.1 Where processing happens

Felix's own infrastructure — servers, database, object storage, queues and logs — is located in the European Union, in AWS's Ireland region. Felix is established in the United Kingdom; EEA→UK transfers are covered by the European Commission's adequacy decision for the UK.

12.2 Transfers to Sub-processors

Where Felix transfers Customer Personal Data outside the UK or EEA, it does so on the basis of an adequacy regulation or decision; the recipient's certification under the EU–US Data Privacy Framework and its UK Extension; the International Data Transfer Agreement or the UK Addendum to the SCCs, together with the SCCs at the appropriate module; or another Article 46 mechanism. Felix carries out a transfer risk assessment where required and applies supplementary measures where needed.

You instruct Felix to make these transfers, and to enter into the relevant transfer mechanism with each Sub-processor on your behalf where the mechanism requires the controller to be a party.

12.3 The specific flows you should know about

These are not incidental transfers of metadata; they carry document content.

(a) Model inference. All LLM traffic, except the classification requests at (f), passes through a gateway established in the United States. This carries extracted document text, page images, your chat messages, generated report text, and your self-reported role and industry. At the gateway account level: prompt logging and training on Felix's traffic are disabled, routing is restricted to providers that do not retain, store or train on request content, and model endpoints are restricted to EU hosting. The gateway operator itself remains a US-established company, and clause 12.2 is the transfer basis for that flow. Felix may in future offer alternative routing regions at a customer's request; any such change follows clause 7.2.

(b) GPU inference. OCR and embedding run on a third-party serverless GPU platform, carrying page images and text chunks. See 12.4.

(c) Web retrieval, when you ask for it. URLs you supply, pages the assistant opens while answering, and content retrieved from them are processed by a US-based scraping service. Search queries go to a US-based search service.

(d) Identity, billing and email. Processed by US-based providers.

(e) Analytics and error monitoring. Both ingest and host in the EU. Their parent companies are US-established, and onward access from the US is possible under their own terms.

(f) Evidence ranking and request classification. Search queries, candidate document passages, chat messages and the text of the previous answer are sent directly to a US-based classification model provider, not through the gateway, and are processed in the United States. The gateway's EU routing constraints do not apply to this flow; clause 12.2 is its transfer basis.

12.4 EU residency cannot currently be asserted for GPU processing

This is a known gap and Felix states it plainly.

The staging environment pins GPU inference to the EU region. The production environment does not. In production, no region constraint is applied, and page images and text chunks are therefore processed in whatever region the GPU platform schedules them — which may be outside the UK and EEA.

Until this is fixed, Felix does not assert EU residency for GPU inference, and clause 12.2 is the operative basis for that flow.

12.5 Government access

On a legally binding request from a public authority, Felix will notify you before disclosing unless legally prohibited; where prohibited, use reasonable efforts to obtain a waiver and challenge the prohibition; challenge the request where there are reasonable grounds to consider it unlawful; disclose only the minimum necessary; and document the request and provide the information to you to the extent permitted.

13.1 Liability

Each party's liability under this DPA is subject to the exclusions and limitations in the Terms, including the aggregate cap at Terms §10. Nothing limits or excludes either party's liability to a data subject under Article 82 UK GDPR; for an administrative fine imposed on it, which each party bears to the extent of its own responsibility; for death or personal injury caused by negligence; for fraud; or for any other liability that cannot be limited by law.

13.2 Order of precedence

Highest first: (1) any separate written DPA signed by both parties; (2) this DPA; (3) the Terms of Service; (4) the Privacy Policy; (5) any other document referenced by the Terms. This DPA prevails over the Terms only on matters of data protection.

13.3 Changes to this DPA

Felix may update this DPA to reflect a change in the Service, its Sub-processors, or applicable law, giving notice of a material change at least 14 days before it takes effect, by the same channel as 7.2. If a material change materially reduces your rights or Felix's obligations, you may terminate the affected part of the Service before it takes effect, without penalty, and Felix will refund prepaid fees covering the period after termination.

13.4 Severance

If a provision is held invalid or unenforceable, it is severed and the remainder continues in force.

13.5 Governing law and jurisdiction

This DPA is governed by the laws of England and Wales, whose courts have exclusive jurisdiction (Terms §13).

13.6 Contact

Data protection: privacy@felixresearch.com · Security: security@felixresearch.com · General: hello@felixresearch.com