Legal · Data processing

Data Processing Agreement

Draft for legal review · not yet in force

01Parties and scope

This agreement is between the customer organisation named in the order (“Controller”) and [LEGAL ENTITY NAME] (“Processor”). It applies to all personal data the Processor handles on the Controller's behalf through the FCRM platform, including special category data contained in sensitive cases.

It forms part of the Terms of Service and satisfies Article 28 GDPR. Where the Controller is subject to another data protection regime, this agreement is read to meet that regime where required.

02Definitions

“Personal data”, “processing”, “controller”, “processor”, “data subject”, “special category data”, “personal data breach” and “supervisory authority” have the meanings given in the GDPR. “Case content” means submissions, answers, attachments, notes and the accountability trace. “Sealed case” means a case classified as sensitive under the Controller's sensitivity policy.

03Our obligations

• Process personal data only on the Controller's documented instructions, including the configuration of forms, sensitivity policies, retention windows and access roles.
• Ensure that people authorised to process the data are bound by confidentiality.
• Implement the security measures in clause 07, appropriate to the risk of special category data.
• Assist the Controller in meeting its obligations under Articles 32–36.
• Notify the Controller of a personal data breach without undue delay and within 48 hours of becoming aware.
• Delete or return data at the end of the provision of services, and certify deletion.
• Make available the information necessary to demonstrate compliance.
• Not engage a sub-processor that processes case content without the Controller's prior authorisation under clause 05.
• Tell the Controller promptly if an instruction appears to infringe data protection law, and refrain from acting on it until confirmed.

04Your obligations

• Ensure a lawful basis for the processing, including an Article 9 condition for special category data.
• Decide and maintain the sensitivity policy, recipient list and retention windows.
• Inform data subjects appropriately where required — the platform supports notices on the public form, but the wording is yours.
• Manage your users, roles and multi-factor enrolment.
• Ensure that instructions are lawful and that exports and referrals are made lawfully.

05Sub-processors

The Controller authorises the sub-processors below. The Processor gives 30 days' notice before adding or replacing a sub-processor that processes case content; the Controller may object on reasonable data protection grounds, and where the objection cannot be resolved, terminate the affected service without penalty.

The Processor imposes data protection obligations on each sub-processor equivalent to those in this agreement, and remains liable to the Controller for their performance.

06International transfers

Case data is stored in the jurisdiction selected for the organisation, currently the European Union. Where personal data must be transferred outside the EEA — for example to a support engineer — the transfer relies on the European Commission's Standard Contractual Clauses (Module 2), supplemented by a transfer impact assessment and, where appropriate, additional technical measures such as encryption with keys held in the EEA.

07Security measures

Annex A — technical and organisational measures:

• Encryption: TLS 1.2+ in transit; encryption at rest for databases and object storage; envelope encryption of sealed case content with keys bound to the named recipient role.
• Access control: role-based permissions with a separate sensitivity layer; sensitive access requires a named person and a designated backup; mandatory multi-factor authentication; no shared accounts.
• Auditability: append-only, hash-chained event log with field-level before-and-after values, verified nightly and anchored externally; every read of a sensitive case is an event.
• Isolation: tenant data separated by client identifier with enforced query scoping; jurisdiction-pinned storage.
• Resilience: encrypted backups, restore testing, retention with automatic deletion and deletion certificates.
• Intake protection: rate limits and optional bot challenge on public forms; raw payloads stored before processing so accepted submissions are not lost.
• Personnel: confidentiality undertakings, least privilege, and logged operational access.

08Breach notification

The Processor notifies the Controller without undue delay and within 48 hours of becoming aware of a personal data breach affecting Controller data, describing what happened, the data and individuals affected so far as known, likely consequences, and measures taken or proposed. Where the information is incomplete, it is provided in phases. The Processor does not notify data subjects or authorities on the Controller's behalf unless instructed.

09Data subject rights and impact assessments

The platform gives Controllers self-service tooling for access, rectification, export and erasure, including redaction for exports and referrals. Where a request cannot be met through tooling, the Processor assists within 10 business days. The Processor provides reasonable assistance with data protection impact assessments and prior consultations, including the security documentation on the Security page.

10Audit

The Processor makes available the information needed to demonstrate compliance and allows for audits, including inspections, by the Controller or an auditor it mandates, subject to confidentiality, a scope agreed in advance, and reasonable notice so that operations and other tenants are not disrupted. Audit rights may be satisfied by current security documentation and a completed questionnaire for the first 12 months.

11Deletion and return

On termination, the Processor makes case data available for export for 30 days in open formats (CSV/XLSX/PDF plus attachments), then deletes it in line with the Controller's retention configuration and issues a deletion certificate. Audit chain anchors may be retained in hashed form, which does not permit reconstruction of case content.

12Liability and term

This agreement runs for as long as the Processor processes Controller data. Liability follows the Terms of Service. If a provision here conflicts with the Terms on data protection, this agreement prevails. It is governed by the law of [GOVERNING LAW].