Data processing agreement

This agreement (the “DPA”) is part of the Guardy terms of service between the Customer (the controller) and [Legal name of the business, e.g. "Your Name, trading as Guardy" or "Guardy Ltd (company no. …)"] (the processor, “we”). It sets out the terms required by Article 28(3) of the UK GDPR. If this DPA and the terms of service conflict on data protection, this DPA wins. Words such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in the UK GDPR.

1. Scope

This DPA covers the personal data that the Customer or its users put into Guardy, or that Guardy creates on the Customer’s behalf (“Customer Personal Data”). Annex 1 describes that processing.

2. Instructions

• We process Customer Personal Data only on the Customer’s documented instructions, unless UK law requires otherwise. The Customer’s instructions are these terms, this DPA and the Customer’s use of Guardy’s features. If UK law requires us to process data in another way, we will tell the Customer first, unless that law prohibits it.
• If we think an instruction breaks data protection law, we will tell the Customer straight away.
• The Customer is responsible for having a lawful basis for the data, for providing privacy information to its own clients, and for the accuracy of what it enters. Where Customer Personal Data includes criminal offence data, such as suspicion reports, the Customer is responsible for meeting the conditions in Schedule 1 of the Data Protection Act 2018.

3. Confidentiality and tipping off

• Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality. They may access it only when needed to provide, support or secure the Service.
• We understand that suspicion reports and related records are sensitive under the Proceeds of Crime Act 2002. We will never disclose them to the Customer’s clients or to anyone else, except where the law requires it.
• If a public authority asks us for Customer Personal Data, we will refer it to the Customer where we can. We will disclose data only where the law requires us to, and we will tell the Customer unless the law prohibits it.

4. Security

We keep appropriate technical and organisational measures in place to protect Customer Personal Data, as required by Article 32 of the UK GDPR. Annex 2 describes them. We may update these measures as long as overall protection does not get worse.

5. Subprocessors

• The Customer gives general authorisation for us to use subprocessors. Annex 3 lists the current subprocessors.
• We will give account owners at least 30 days’ notice by email before we add or replace a subprocessor. If the Customer objects on reasonable data protection grounds, the Customer can end the contract before the change takes effect, and we will refund any fees paid for the period after that date.
• We bind each subprocessor to data protection terms that give at least the protection in this DPA. We remain responsible to the Customer for each subprocessor’s performance.

6. International transfers

We transfer Customer Personal Data outside the UK only where UK adequacy regulations apply or appropriate safeguards are in place under Article 46 of the UK GDPR. Examples of safeguards are the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or certification under the UK Extension to the EU–US Data Privacy Framework.

7. Helping the Customer

• Data subject requests. Guardy lets the Customer find, export, correct and delete client records itself. If a data subject contacts us directly, we will pass the request to the Customer without undue delay and will not respond ourselves except to redirect them. We will help further where that is reasonable.
• Compliance. We will give reasonable help with the Customer’s obligations under Articles 32 to 36 of the UK GDPR, which cover security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to us.

8. Personal data breaches

We will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include what we know at the time: the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the steps taken or proposed. We will send further details as we learn them. Notifying the ICO and data subjects is the Customer’s decision, and we will help the Customer with it.

9. Deletion at the end of the contract

• While the account exists, the Customer can export its records and delete individual client records itself. Guardy reminds the Customer when a client’s five-year retention period ends.
• When the Customer asks us to close its account, we delete Customer Personal Data within 30 days, and from backups within a further 35 days, unless UK law requires us to keep it. The Customer is responsible for exporting anything it needs to keep first. The Money Laundering Regulations normally require records to be kept for five years.
• The audit log is deleted with the rest of the account.

10. Audits

We will make available the information reasonably needed to show that we comply with this DPA. On at least 30 days’ written notice, no more than once in any 12 months (or after a personal data breach), we will allow and contribute to an audit. The audit can be by the Customer or by an independent auditor bound by confidentiality, and the Customer pays for it. We will first try to answer through written information, such as security questionnaires, where that is enough.

11. Duration

This DPA lasts for as long as we process Customer Personal Data for the Customer.

Annex 1: Description of the processing

Annex 2: Security measures

• Encryption in transit: all connections use TLS (HTTPS only, with secure cookies).
• Authentication: passwords of at least 10 characters, hashed with bcrypt. Optional TOTP two-factor authentication, with encrypted secrets (AES-256-GCM) and single-use recovery codes. Accounts lock after repeated failed sign-ins. Password reset links expire and work only once.
• Sessions: signing out revokes the session on the server, and a password reset ends every session of that user.
• Access control: each customer’s data is kept apart from every other customer’s. Roles (owner, nominated officer, staff) limit who can decide suspicion reports, override risk ratings and change account settings.
• Audit trail: significant actions are logged with the user, time and IP address. The database rejects edits and deletions of log entries.
• Document collection: client upload links are unguessable, expire, can be revoked, and stop working when the relationship ends.
• Screening data: sanctions lists are downloaded and matched on our own servers, so no client data is sent to list providers.
• Infrastructure: servers are reachable only through the TLS proxy. Software dependencies are monitored for known vulnerabilities and patched.
• Personnel: only the operator has administrative access, and only for running and supporting the Service.

Annex 3: Subprocessors