Data Processing Agreement

3.1 Roles and instructions

The Controller decides the purposes and means of processing the personal data in its account. The Processor processes that data only on the Controller's documented instructions, which are these terms and the Controller's use of the product features. If the Processor believes an instruction breaches data protection law, it will tell the Controller.

3.2 Processor obligations

The Processor will:

• (a) process personal data only on documented instructions, including regarding transfers, unless required by law, in which case it will inform the Controller first where lawful;
• (b) ensure that everyone authorised to process the data is bound by confidentiality;
• (c) take the security measures described in Annex II, as required by Article 32;
• (d) only engage sub-processors with the Controller's general authorisation, listed in Annex III, give notice of changes (see 3.4), and impose equivalent data protection terms on them. The Processor remains responsible for their performance;
• (e) help the Controller, by appropriate technical and organisational measures, to respond to requests from individuals exercising their rights;
• (f) help the Controller meet its obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing;
• (g) at the Controller's choice, delete or return personal data at the end of the services (see 3.6) and delete existing copies unless the law requires storage;
• (h) make available the information needed to show compliance with Article 28 and allow and contribute to audits (see 3.7);
• (i) keep records of processing carried out on the Controller's behalf as required by Article 30(2).

3.3 Controller obligations

The Controller confirms that it has a lawful basis, and any further condition needed for special category or criminal offence data, for the data it puts into the service, and has given individuals the required privacy information.

3.4 Sub-processors

The Controller gives general authorisation for the sub-processors in Annex III. The Processor will give at least 30 days' notice by email of any new or replacement sub-processor. The Controller may object on reasonable data protection grounds within that period; if the parties cannot resolve it, the Controller may close its account.

3.5 International transfers

The primary database is in the EEA (Stockholm). Where a sub-processor transfers personal data outside the UK or EEA, the Processor will ensure a valid transfer mechanism applies under UK GDPR (such as the UK International Data Transfer Addendum or an adequacy regulation).

3.6 Return and deletion

The Controller can delete records at any time in the product (permanent on deletion) and can close its account, which deletes its records and login. Remaining files (company logo, verification and mail files) are removed within 30 days of a closure request. Copies held by Stripe and Resend remain subject to those providers' retention periods. Backups roll off on the hosting provider's schedule. On request, the Processor will provide a copy of the Controller's data before deletion.

3.7 Audit

The Processor will answer reasonable written security and compliance questionnaires and, no more than once a year or after a confirmed incident, allow an audit on 30 days' notice, during business hours and subject to confidentiality, at the Controller's cost.

3.8 Personal data breach

The Processor will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's data, with the information then available (nature, categories and approximate numbers, likely consequences, measures taken). The Controller is responsible for deciding whether to notify the ICO (within 72 hours of becoming aware) and affected individuals.

3.9 Liability and term

Liability under this agreement is subject to the limits in the Terms of Service. This agreement lasts as long as the Processor processes personal data for the Controller.

Annex I: Details of processing

Annex II: Security measures

As at 10 October 2026. See the Security overview in our Trust Centre for the plain-language version.

• Encryption in transit (HTTPS) and the hosting provider's standard encryption at rest for database and file storage.
• Private file storage areas; no file is publicly accessible; files are opened only through links that expire after 5 minutes.
• Database-enforced account isolation: each account can only read and write its own data (tested with multiple accounts).
• Role-based access for staff; staff roles can only be granted through the database; staff file opens are recorded in a document access log.
• Change history of compliance items; activity log of staff actions.
• Invitation tokens stored only in hashed form; single-use; expire after 7 days.
• Uploads restricted to PDF, JPG and PNG up to 15 MB, validated on the server; logos validated by file content.
• Sign-in rate limiting at the sign-in service; Google sign-in available.
• Automatic daily database backups by the hosting provider.
• No analytics or advertising trackers; AI is used only in the optional policy tailoring tool and receives no personal data of staff, candidates or clients.

Annex III: Sub-processors

See our Sub-processors page at /sub-processors.

• Lovable AI (using OpenAI models): generating optional AI suggestions for policy wording and form drafts. Data: policy text and business profile details you enter, only when you use AI tailoring. Location depends on the provider's infrastructure; details available on request.
• Cloudflare Turnstile: spam and bot protection on public forms and sign-up. Data: technical data such as IP address and browser details. Location: global.