Data Processing Addendum

This Addendum forms part of the Terms of Service between you (Controller) and 99 Developers Ltd, a company registered in England and Wales (company number 17257492), which owns and operates 99 Data Rooms (Processor), where you process personal data subject to UK GDPR or EU GDPR via the Service.

Subject matter

Provision of the document sharing Service described in the Terms.

Nature and purpose of processing

Hosting, transmission, access control, and analytics for documents you upload and share.

Types of data and data subjects

Personal data contained in your uploaded documents and identifiers of recipients you grant access to (typically business contacts and prospects).

Sub-processors

You authorise us to engage the sub-processors listed in our sub-processor register, which forms part of this Addendum and names every one of them, what it does, and where it runs. We remain responsible to you for their performance.

We will give you at least 30 days' notice before a new sub-processor begins processing your personal data, or before we replace an existing one, by updating that register and emailing your account owner. You may object on reasonable data protection grounds within the notice period; if we cannot resolve your objection, you may terminate the affected part of the Service and we will refund prepaid fees for the unused period. Where a sub-processor must be replaced urgently for security or continuity reasons we may act first and notify you immediately afterwards.

AI assistant access, and your own AI provider

If a member of your organisation connects an AI assistant to a room, that assistant reads the documents it is given access to and sends their contents to your own AI provider, under your own agreement with that provider. We are not a party to it, and it is not one of our sub-processors: the instruction to send that data is yours, not ours.

One consequence is easy to miss, so we state it plainly rather than leave you to find it later. A zero data retention agreement you hold with your AI provider may not cover this path. Anthropic, for example, documents that "data processed by third-party tools, MCP servers, or other external integrations is not covered by ZDR", and that its zero data retention applies only to a defined set of its own products. If your retention terms matter to you, confirm with your provider that they extend to assistant connections of this kind before you enable one.

Security measures

See our security page. We notify you without undue delay, and in any event within 72 hours of becoming aware, of any confirmed personal data breach affecting your data, with the information you need to meet your own notification duties.

International transfers

Your documents are stored in the United Kingdom. Where personal data is transferred outside the UK, we rely on the UK's adequacy regulations for transfers to the European Economic Area, and on Standard Contractual Clauses with the UK International Data Transfer Addendum for transfers elsewhere. The mechanism relied on for each sub-processor is recorded against it in the register.

Assistance with your obligations

We assist you in responding to data subject requests, and in carrying out data protection impact assessments and prior consultations, so far as the Service allows. You can export your own data at any time from your account settings without needing to ask us.

Term and deletion

On termination of the Service we delete or return personal data within 30 days, subject to legal retention requirements.

Need a signed DPA for your records? Email legal@99developer.com.