1. Parties and scope
This DPA forms part of the agreement with COMPLYCLOCK LIMITED, incorporated in England and Wales with company number 17474503. Our registered office is 255-259 2nd Floor West Wing Commercial Road, London, United Kingdom, E1 2BT. Contact us at hello@complyclock.uk.
The Customer within this DPA is the business identified in the workspace acceptance receipt, including a sole trader or accounting practice, where it is a controller or a processor acting for clients and ComplyClock processes on its documented instructions. ComplyClock acts as processor or sub-processor accordingly. The Customer confirms authority from its controller where needed to appoint us and give instructions. This DPA applies to that processing in the Service, including Free plans. It does not apply to our controller processing, including personal Self Assessment workspaces, described in the Privacy Notice. Accepting this DPA where applicable does not declare that personal-only users represent a business or are controllers.
Applicable Data Protection Law means the UK GDPR, Data Protection Act 2018 and applicable UK data-protection legislation as amended. Controller, processor, personal data, personal data breach, processing and data subject have their statutory meanings.
2. Processing schedule
Subject matter and purpose: hosting and operating the Customer’s compliance workspace, tracking dates, reminders and workflow, storing and sharing requested documents, public-record integration, exports, customer-requested AI assistance, support and security of that processing.
Duration: while the workspace exists and for the limited return/deletion and backup-expiry period afterwards. Nature: collection, organisation, retrieval, consultation, calculation, generation, storage, transmission, restricted sharing, export, correction and deletion on documented instructions.
Data subjects: the Customer’s users, staff, officers, sole traders, professional advisers, business contacts and clients, and other adults whose data the Customer lawfully includes. Data types: names, business contact details, company/public registry facts, tax registrations and identifiers where necessary, financial/deadline/filing information, assignments, correspondence, document content, audit/reminder records, AI inputs/outputs and related technical identifiers.
Restricted data: health and other special-category personal data, criminal-offence data and children’s personal data are not authorised unless ComplyClock expressly agrees appropriate purposes, lawful conditions and safeguards in writing before processing. The Customer must minimise uploads and use the Service only for its authorised purposes in tracking UK compliance. Customers may be based outside the UK; this does not change the required lawful basis, instructions or applicable transfer safeguards.
3. Instructions and Customer obligations
We process Customer personal data only on documented instructions, including for international transfers, unless UK law requires otherwise. This agreement, plan configuration, authorised user actions and written support instructions are the initial instructions. We tell the Customer before legally compelled processing unless prohibited by law on important public-interest grounds. We immediately inform the Customer if we consider an instruction infringes applicable data-protection law and may suspend that instruction while it is resolved.
The Customer determines lawful purposes and bases, gives required notices, manages authorisations and fulfils controller duties, or obtains the necessary instructions and permissions from its controller. It remains responsible for the lawfulness and accuracy of Customer Data and for reviewing AI outputs. Neither party’s duties remove the other’s own statutory responsibilities.
4. Confidentiality and access
We ensure people authorised to process Customer personal data are bound by confidentiality obligations or an appropriate statutory duty. Access is limited by role and operational need. We review privileged access and revoke it when no longer needed. Suppliers are subject to written data-protection and confidentiality obligations.
5. Security measures
Taking account of the state of the art, costs, nature, scope, context and purposes of processing and risk to individuals, we implement appropriate technical and organisational measures under Article 32. These include tenant-scoped access and role permissions, secure session and multi-factor controls, password hashing and breach screening, TLS for web transport, private S3 storage with server-side encryption and short-lived authorised download links, secret management, filtered monitoring, security updates, backups and recovery procedures.
We maintain procedures for incident response, access review, restoration and testing of controls. RDS and document backups are access restricted and hosted in Ireland. RDS backup retention is 30 days and noncurrent S3 document retention is 35 days before asynchronous expiry. No particular uptime or recovery-time target is guaranteed. Measures may evolve provided the overall protection is not materially reduced; evidence and material risks are available through the audit process.
6. Sub-processors
The Customer gives general written authorisation to use the direct sub-processors described on the versioned Sub-processors page for Customer personal data. Before appointing an addition or replacement, we give workspace managers at least 30 days’ advance email notice of its identity, function, location and transfer safeguards. The Customer may object within that period on reasonable data-protection grounds; we seek an alternative or mitigation in good faith.
If an objection cannot reasonably be resolved, the Customer may stop the affected processing and terminate the affected Service before the change, with a refund of unused affected prepaid fees. Where law or an urgent security incident requires a faster change, we give as much advance notice as possible, prompt explanation and the same opportunity to raise concerns and terminate affected use.
We impose written obligations providing at least the protections required by Article 28 for the relevant processing, including security and assistance, and remain fully responsible to the Customer for our sub-processors’ performance of those obligations. Provider downstream sub-processors operate under those contractual arrangements; we monitor their notices and raise material concerns.
7. International transfers
The AWS application, database, S3 and SES region is Ireland, an EEA location covered by applicable UK adequacy arrangements. OpenAI’s standard international API, Honeybadger and other suppliers can involve processing outside the UK and EEA. Hosting in Ireland does not mean all processing occurs there.
Before a restricted transfer, we establish a lawful safeguard, normally supplier standard contractual clauses with the UK Addendum or an applicable UK International Data Transfer Agreement, assess the transfer risk and necessary supplementary measures, and make relevant information available to the Customer. We rely on an adequacy framework only where the recipient and service are covered. We do not represent that an EU AI region or zero-retention arrangement has been agreed.
8. Rights and controller assistance
Taking account of the nature of processing, we assist through appropriate technical and organisational measures with data-subject rights requests, including access, correction, export, restriction and deletion. We promptly refer direct requests concerning Customer Data to the Customer unless law requires our own response and do not decide the Customer’s lawful basis or rights exceptions for it.
Taking account of the nature of processing and information available to us, we assist with security, breach assessment and notifications, data-protection impact assessments and prior consultation with the ICO. If the Customer is a processor, assistance is provided to it for onward fulfilment of its controller’s duties. Standard assistance and available self-service tools are included. Exceptional, clearly scoped work may require an agreed reasonable fee; no unagreed charge or commercial dispute will delay time-critical legally required assistance.
9. Personal data breaches
We notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data. We provide, as available, the nature of the breach, affected categories and approximate numbers of individuals and records, a contact for further information, likely consequences and measures taken or proposed, including mitigation.
We investigate, contain and remedy the breach, preserve relevant evidence and provide updates as information becomes available, without waiting for a complete investigation before initial notice. The Customer decides and makes its controller notifications, or promptly informs its controller, and we provide reasonable assistance. We do not notify individuals or regulators on the Customer’s behalf without instructions unless law requires it.
10. Information and audits
We make available information needed to demonstrate compliance with this DPA and Article 28, and allow and contribute to audits, including inspections, by the Customer or an independent auditor mandated by it. Begin with available security information, records and remote review where these can answer the request.
Ordinary audits should use reasonable notice, normally 10 business days, during business hours, with proportionate scope and confidentiality safeguards protecting other tenants, security and trade secrets. A routine audit is normally no more than annually; suspected breaches, material non-compliance, regulator requirements or a relevant incident justify additional or urgent audits and shorter notice. These arrangements do not prevent a legally required audit or hide material evidence.
Standard compliance information is included. Exceptional audit work or on-site costs require an agreed reasonable fee. The Customer normally pays its auditor’s own fees; we bear our reasonable remediation costs for established non-compliance.
11. Return and deletion
At the Customer’s choice, we return or delete Customer personal data when the processing service ends, and delete existing copies unless UK law requires retention. Owners can export the workspace and download documents before requesting permanent deletion; downloadable export archives last seven days. Contact hello@complyclock.uk for assistance or a different lawful return/deletion instruction. Cancelling billing alone retains the workspace and does not end all processing.
Permanent deletion removes live workspace records and schedules file purging; it is not a reversible closure with a guaranteed recovery window. Access-restricted RDS backups expire under the 30-day policy, and noncurrent S3 documents become eligible for expiry after 35 days with asynchronous deletion. Isolated backups are not restored to ordinary use without reapplying deletion and expiry decisions. We instruct relevant suppliers to delete or return data under their agreements and can confirm completion and remaining backup/legal exceptions on request.
Data required by law is isolated and processed only for that duty. Minimal contract, billing or substantive dispute evidence that we retain as controller is described in the Privacy Notice; it does not authorise retaining an entire deleted workspace.
12. Communications and complaints
Use hello@complyclock.uk for instructions, assistance, breaches and privacy complaints, giving the workspace identity without sending credentials. Keep manager contact details current. We acknowledge privacy complaints within 30 days, investigate without undue delay and communicate progress and outcome. We cooperate with the ICO as required.
13. Liability and precedence
The Terms’ business liability provisions apply to the processing within this DPA’s scope, including the confidentiality/data-protection cap of the greater of twice the relevant preceding 12 months’ fees and £2,000, subject to mandatory law. Nothing restricts consumer rights where applicable, data subjects’ statutory compensation rights, regulators’ powers, or responsibility that cannot lawfully be limited. This DPA takes priority over conflicting Terms for processing within its scope.
14. Duration and changes
This DPA applies from the recorded workspace acceptance and continues for the processing and deletion period. It binds successors subject to the Terms. Material DPA changes follow the Terms’ notice and express-acceptance procedure; direct sub-processor changes follow section 6. Archived versions and acceptance receipts identify the agreed wording. English law and the jurisdiction provisions of the Terms apply, subject to mandatory data-protection law.