Data processing agreement
Effective
This data processing agreement ("DPA") forms part of the terms between ("Processor") and a business customer ("Controller") that uses . It applies where we process personal data on the customer's behalf, and to the extent UK GDPR or EU GDPR applies.
1. Scope
Configurations are out of scope. Firewall configurations are processed only in the Controller's own browsers and are never received by the Processor. The personal data the Processor handles for the Controller is limited to:
- Data subjects: the Controller's authorised users and people they invite.
- Data: names, business email addresses, roles, sign-in records, usage metadata (time, action, platform, rule count, score, grade, standard) and company details.
- Purpose: providing the Service under the terms.
- Duration: the term of the agreement, then deletion as set out below.
2. Processor obligations
The Processor will:
- process personal data only on the Controller's documented instructions (the terms and this DPA), unless the law requires otherwise;
- make sure people authorised to process the data are bound by confidentiality;
- keep appropriate technical and organisational security measures, including encryption in transit and at rest, role-based access, row-level isolation between companies, and two-factor sign-in;
- help the Controller respond to data subject requests and meet its security, breach notification and impact assessment obligations, taking into account the nature of the processing;
- notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Controller's data;
- delete or return the personal data at the end of the service (within 30 days, and from backups within 90 days), unless the law requires it to be kept;
- make available the information needed to show compliance with this DPA, and allow reasonable audits on 30 days' notice, no more than once a year, at the Controller's cost.
3. Sub-processors
The Controller gives general authorisation for the sub-processors below. The Processor will give at least 30 days' notice of new sub-processors by email, during which the Controller may object on reasonable grounds and, if no solution is found, terminate the affected service with a pro-rata refund. The Processor stays responsible for its sub-processors.
| Provider | What they do for us | Data | Location |
|---|---|---|---|
| Supabase Inc. | Login, database and server functions | Account, company, membership, plan and usage metadata | Hosted in |
| Cloudflare Inc. | Website hosting and content delivery | IP address and browser details in short-lived logs | Global network |
| Paddle.com Market Ltd | Reseller and merchant of record: checkout, payments, tax, invoices | Billing name, email, address, VAT number, payment details (we never see card numbers) | UK, with processing in the EU and US |
| Resend Inc. (if enabled) | Sending invitation emails | Invitee email address and company name | US / EU |
Paddle acts as an independent controller (merchant of record) for payment data, not as a sub-processor.
4. International transfers
Where personal data is transferred outside the UK or EEA, the Processor will rely on adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses.
5. Liability and precedence
Liability under this DPA is subject to the limits in the terms. If this DPA conflicts with the terms about personal data, this DPA prevails.
6. Signing
This DPA applies automatically to business customers. If you need a signed copy, email .