Annex A to Schedule 1 - Documented Processing Instructions

This Annex forms part of Schedule 1 (Data processing) to the Buyer Perception Standard Terms of Business version 1.2, and is given by the Client under paragraph 4 of that Schedule for the purposes of Article 28(3)(a) of the UK GDPR. Buyer Perception Ltd ("BP") processes personal data only in accordance with this Annex, the Agreement, and any further written instruction from the Client.

The version of this Annex that applies to an engagement is the version identified in the Order Form. Terms defined in the Standard Terms have the same meaning here.

1. Nature and purpose. Contacting the Client's lost prospects and churned customers, conducting confidential research interviews with those who agree, and delivering pseudonymised findings to the Client.

2. Data subjects and data. Named individuals at the Client's lost or churned accounts. Name, job title, employer, work email address, work telephone number where supplied, and the deal or account context supplied by the Client. No special category data.

3. Instructed steps, in order.

3.1 The Client supplies the Contact Export in the format set out in clause 4.2.

3.2 BP verifies it and proposes a shortlist. The Client may remove contacts within 2 Business Days under clause 4.3.

3.3 The Client sends the introduction email to each approved contact, in accordance with clause 4.4: from a named senior sponsor, using wording agreed with BP, with BP copied and the reply-to address set to BP's, sent individually or by mail merge and never as a group email. It states that the research is carried out on the Client's behalf by BP, explains the purpose, says that BP will follow up directly, and links to the Client's privacy notice. If the Client cannot change the reply-to address, it forwards replies to BP the same Business Day.

3.4 BP manages all subsequent contact: no more than three follow-up emails and two telephone calls to any individual, and none once that individual objects or asks not to be contacted. UK landline numbers are screened against the TPS and CTPS registers before dialling. Objections and opt-outs are actioned immediately and reported to the Client.

3.5 Interviews are booked through BP's scheduling link and conducted remotely. BP sends its participant information notice to each Participant beforehand, and confirms consent to transcription verbally at the start of the call; a Participant who declines transcription is interviewed with written notes instead.

3.6 Participants are offered a charitable donation or, if they prefer, a thank-you payment, delivered through a third-party gifting platform. BP holds no Participant bank details.

3.7 Analysis is carried out on pseudonymised text, using the sub-processors listed in BP's privacy policy at buyerperception.com/legal/privacy.

3.8 Findings are delivered in thematic, pseudonymised form. No finding is reported in a way that could reasonably identify an individual Participant, including by combining role, sector, region and deal context. Quotes are edited to remove identifying detail, and no view is attributed to a named individual, account or sub-group.

3.9 Within 30 days of delivering the Deliverables, BP deletes or returns the Contact Export as the Client directs, and deletes all interview transcripts and notes under paragraph 6 of Schedule 1, certifying deletion in writing on request.

4. Benchmark Questions. BP asks a fixed set of Benchmark Questions at the end of every interview for its own independent research, as described in clause 9.2. BP is the controller of those answers. They are held separately from engagement content, are never linked to the Client or to a Participant's identity, and are used only in aggregate. This falls outside the Client's instruction and is disclosed in BP's participant information notice.

5. Client warranties. The Client warrants that it has a lawful basis for disclosing the Contact Export to BP and for BP to contact the individuals on it; that it has provided, or will provide at or before the introduction email, the information required by Articles 13 and 14 of the UK GDPR; that the Contact Export is accurate and excludes anyone who has objected to contact or asked to be erased; and that it will not instruct BP to act unlawfully.

6. Rights requests and incidents. BP forwards any data subject request it receives to the Client within 2 Business Days and assists the Client in responding. BP notifies the Client of any personal data breach in accordance with paragraph 5.3 of Schedule 1.

7. Changes. Any change to these instructions must be agreed in writing. BP will tell the Client if it considers an instruction to infringe data protection law.

Buyer Perception Ltd · 167–169 Great Portland Street, London W1W 5PF · No. 17336914 · VAT GB 525 7393 72