Home › Legal › Data processing agreement
Data processing agreement
Incorporated into the terms automatically — you do not have to ask for it, chase it, or sign a separate copy. If your procurement team needs a countersigned PDF, we will send one.
We sell a product that exists because sub-processor notice clauses are often weak. It would be indefensible for ours to be weak, so it is not: 30 days, notified by email rather than by page, with a right to object and to terminate with a refund if we cannot resolve it.
01 Roles
You are the controller. We are the processor. Where you are yourself a processor for your own customers, we are a sub-processor and this agreement operates accordingly.
02 Scope and duration
| Item | Detail |
|---|---|
| Subject matter | Discovery, publication and monitoring of sub-processor information |
| Duration | For as long as your subscription is active, plus the retention periods in the privacy notice |
| Nature and purpose | Reading public sources and material you supply; producing dated records |
| Personal data | Business contact details of your users; names appearing in contracts you upload |
| Data subjects | Your personnel and, where present in uploaded documents, your vendors’ personnel |
| Special categories | None. Do not upload documents containing them |
03 Our instructions
We process only on your documented instructions, which include your use of the service and anything you configure in it. If we believe an instruction breaches data protection law we will tell you and may pause that processing. We will tell you if we are legally compelled to process otherwise, unless we are prohibited from telling you.
04 Sub-processors
You give general authorisation for the sub-processors listed at /legal/sub-processors, which is current at all times.
- We give 30 days’ notice by email before a new sub-processor begins processing. Notice is sent to you directly; publishing it on a page is not sufficient and we do not treat it as such.
- You may object on reasonable grounds within that period.
- If we cannot avoid the sub-processor or offer an alternative, you may terminate the affected part of the service and receive a pro-rata refund of fees paid in advance.
- We remain fully liable for our sub-processors’ performance.
- Each is bound by written terms no less protective than these.
05 Security
We maintain the measures described at /legal/security, including encryption in transit and at rest, least-privilege access with hardware keys for administration, logged access to uploaded contracts, and tested backups. Personnel are bound by confidentiality.
06 Personal data breach
We notify you without undue delay and in any event within 48 hours of becoming aware, with what we know at the time rather than waiting for a complete picture, and we update you as the position develops. We assist you with your own notification obligations.
07 Data subject requests
If a request reaches us that relates to your data, we forward it to you and do not respond substantively ourselves. We assist you in answering it, at no charge.
08 Audit
We make available the information needed to demonstrate compliance, and will complete a reasonable security questionnaire once per year at no charge. On-site audits are available where a supervisory authority requires one, or once per year on 30 days’ notice at your cost.
Much of what an audit would ask for is already public: our sub-processor list, our security page including its gaps, and a ledger anyone can verify without our cooperation.
09 International transfers
Where personal data is transferred outside the UK or EEA, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and the UK International Data Transfer Addendum apply and are incorporated by reference, with this agreement supplying the required annexes.
10 Return and deletion
On termination you may export everything, in full, including the verification manifest. We delete your personal data within 30 days of your instruction, except where retention is legally required, in which case it remains protected by this agreement for as long as we hold it.