Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer") and TrustRegister Limited ("TrustRegister") and governs the processing of personal data under the General Data Protection Regulation (GDPR) and applicable UK data protection laws.

2. Definitions

3. Data Controller Roles

Customer as Controller

Customer acts as data controller for:

• Company and officer data imported to the Service
• Invitation and communication data
• User account and access management data
• Decisions regarding verification requirements

TrustRegister as Processor

TrustRegister acts as data processor for Customer Data, processing it solely to provide the Service as instructed by Customer.

Joint Controllers

Customer and TrustRegister act as joint controllers for:

• Evidence pack generation and content
• 7-year retention of verification evidence
• Audit trail maintenance and integrity

4. Processing Details

Processing Purposes

• Facilitating Companies House identity verification compliance
• Orchestrating verification workflows and communications
• Generating and maintaining audit-grade evidence
• Providing compliance reporting and status tracking
• Ensuring 7-year evidence retention requirements

5. Legal Basis

6. Security Measures

Technical Safeguards

• End-to-end encryption (TLS 1.3 in transit, AES-256 at rest)
• Multi-factor authentication for all user accounts
• Role-based access controls with principle of least privilege
• Regular security assessments and penetration testing
• Automated backup and disaster recovery procedures
• Network segregation and monitoring

Organizational Measures

• Staff security training and background checks
• Incident response and breach notification procedures
• Regular security policy reviews and updates
• Third-party security assessments and certifications
• Data minimization and retention policies

7. Data Subject Rights

TrustRegister will assist Customer in responding to data subject requests, including:

8. Data Transfers

UK/EU Processing

All personal data is processed and stored exclusively within the UK and EU. No data transfers to third countries occur without adequate safeguards.

Sub-processors

Current sub-processors are listed in our Sub-processor Register. We provide 30 days notice before engaging new sub-processors.

9. Data Retention

10. Incident Management

Breach Notification

TrustRegister will notify Customer of any personal data breach within 24 hours of becoming aware, providing:

• Description of the breach and data involved
• Likely consequences and potential impact
• Measures taken or proposed to address the breach
• Contact details for further information

11. Audits and Compliance

Customer may conduct audits of TrustRegister's data protection practices:

• Annual audit rights with 30 days advance notice
• Access to relevant policies, procedures, and certifications
• Third-party audit reports available upon request
• Reasonable cooperation with regulatory investigations

12. Termination

Upon termination of services:

• Customer Data will be returned or deleted within 30 days
• Evidence Packs will be retained for the full 7-year period
• Customer may request certified deletion confirmation
• Sub-processor arrangements will be terminated where appropriate