Data processing agreement

We process personal data only to provide the DORA workbench: accounts and workspaces, register of information records, Article 30 contract schedules, ICT incident logs, vendor passports and account email. Processing lasts for as long as your workspace exists, plus the deletion period in clause 9.

Data subjects: your staff who hold accounts, and the named business contacts you enter for ICT third-party providers and internal incident handlers. Categories: names, work email addresses, job roles, workspace role, and any content you type into a compliance record. No special category data is required by the service, and you should not enter any.

We process personal data only on your documented instructions, which are the terms of service, this agreement and your use of the product features. We tell you if we believe an instruction breaches data protection law. We do not sell personal data, use it for advertising or profiling, or use it to train AI models.

Everyone we authorise to process your data is bound by confidentiality obligations and gets access only where it is needed to run or support the service.

TLS 1.2+ in transit and AES-256 at rest; database row-level security isolating every record to its owning workspace; role-based access inside the workspace; enforced password strength with breached-password screening; server-side authorisation on every module; in-browser parsing so register spreadsheets are not transmitted unless saved; daily backups with point-in-time recovery; continuous automated dependency and platform scanning. The current detail is published on our security page.

You give general authorisation for the sub-processors below. Each is bound by data protection terms no less protective than these. We will notify account holders by email before adding or replacing a sub-processor that handles personal data, and you may object on reasonable data protection grounds; if we cannot resolve the objection you may terminate the affected subscription and receive a pro-rata refund.

Application data is stored in the European Union. Where a sub-processor processes data outside the EEA or UK, transfers rely on the European Commission's standard contractual clauses and the UK international data transfer addendum, together with a transfer risk assessment.

The product lets you access, correct, export and delete records yourself. If a data subject contacts us directly we refer them to you and do not respond substantively. We assist you with data protection impact assessments, supervisory authority engagement and Article 32 to 36 obligations, taking account of the information available to us.

We notify you without undue delay after becoming aware of a personal data breach affecting your data, and in any event within 72 hours of confirming that a breach has occurred. Because the full picture is rarely clear at first, the notification may be provided in phases: it contains the facts known at the time — the nature of the breach, the categories and approximate number of records concerned, the likely consequences and the measures taken or proposed — with follow-up updates as more is established. You remain responsible for notifying your supervisory authority and, where required, affected individuals.

You can delete any record at any time. On termination we delete your workspace data within 30 days, except where law requires retention, and confirm deletion on request. Backups age out within 35 days.

We make available the information needed to demonstrate compliance with this agreement, including our security page, sub-processor list and the pre-answered supplier questionnaire, and we will complete your own questionnaire on request. Where your regulator or DORA contractual audit rights require more, we will agree a proportionate audit at your cost, once in any twelve-month period, on 30 days' notice, subject to confidentiality and without disrupting the service.

Liability under this agreement is subject to the limits in the terms of service. If this agreement conflicts with the terms of service on the processing of personal data, this agreement prevails.