Data Processing Agreement

• You are in charge of your personal data, and we are not. You decide what is collected and why. We process it on your instructions and for nothing else.
• We never train anything on your data. Not your documents, not your answers, not data from your connected systems. Not aggregated, not anonymised, not ever.
• Your data stays in the UK or the European Economic Area. Hosting, analysis and support access included.
• If something goes wrong, we tell you within 24 hours. Your own 72-hour clock to the ICO starts when you find out, and you need the time.
• Nobody at BoxTick has standing access to your content. Analysts see your data only for the review work your plan includes, and every access is logged.
• You can take your data with you or have it deleted, and deletion is real. It removes the data, not a flag.

Terms defined in the UK GDPR, including controller, processor, personal data, processing, data subject, personal data breach, special category data and supervisory authority, have the same meaning here. Capitalised terms not defined below have the meaning given in the BoxTick platform terms.

• Client Personal Data means personal data that we process on your behalf under this agreement: personal data contained in Client Data, including documents you upload, answers you and your Authorised Users give, data obtained from Connected Systems, staff policy acceptance records, and the Reports and registers produced from them.
• Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any legislation replacing or amending them, as in force from time to time.
• Sub-processor means a processor we engage to process Client Personal Data.
• UK GDPR means the General Data Protection Regulation as it forms part of the law of England and Wales, Scotland and Northern Ireland, as amended, including by the Data (Use and Access) Act 2025.
• we, us and our mean The Programme Group Limited, trading as BoxTick. You and your mean the organisation named in the Order Form.

2.1 You are the controller and we are the processor for Client Personal Data. You decide the purposes and means of processing, and we act on your instructions.

2.2 We are a controller in our own right for three things, which are not Client Personal Data and are not covered by this agreement:

• (a) account and user data: the names, work email addresses, roles and sign-in data of your Authorised Users, and the audit log of what they did in the Platform;
• (b) billing and commercial records; and
• (c) our own marketing and business contact records.

Our privacy notice explains how we use these.

2.3 We will not become a controller of Client Personal Data and will not process it for our own purposes. Clause 5 prohibits this outright.

2.4 You confirm that you have a lawful basis for the processing you instruct, that you have given data subjects the information Data Protection Law requires (including your staff, where you connect systems that hold information about them), and that your instructions do not require us to break the law.

4.1 We process Client Personal Data only on your documented instructions, including on any transfer, unless the law requires us to process it. In that case we will tell you before processing, unless the law prevents us from telling you.

4.2 Your documented instructions are: this agreement, the platform terms, the plan and Services in your Order Form, the settings and Connected Systems you choose in the Platform, and any further written instruction you give us that we accept.

4.3 We will tell you immediately if, in our opinion, an instruction breaks Data Protection Law. We may pause that instruction while we resolve it with you.

5.1 We will not use Client Personal Data to train, fine-tune, evaluate or improve any AI model, ours or anyone else's. This applies to raw data, derived data, aggregated data and anonymised data.

5.2 We will not use Client Personal Data for our own purposes, including marketing, profiling, benchmarking individuals or developing other products. Aggregated statistics about compliance controls that contain no personal data, such as the share of clients with an AI policy in place, are not Client Personal Data and are covered by the platform terms.

5.3 We will not sell Client Personal Data or share it with anyone except our Sub-processors, under clause 9, or where the law requires it.

5.4 Every Sub-processor must accept the same prohibitions by contract, and we will not use one that will not.

5.5 These are contractual commitments. They are not platform settings and cannot be changed by changing a setting.

6.1 The Platform is not designed to process special category data (for example health, ethnicity, religion or trade union membership) or criminal offence data, and you agree not to upload it.

6.2 Some Connected Systems, such as HR systems, may hold this kind of data. We only request the information we need from them for the Services, such as names, roles and policy acceptance, and we configure connectors to avoid other fields where the system allows.

6.3 If special category or criminal offence data reaches us anyway, tell us straight away. We will delete it, record the deletion and confirm to you what was deleted and when. Telling us is not itself treated as a breach of the Acceptable Use Policy.

7.1 Everyone we authorise to process Client Personal Data is bound by a duty of confidence in their employment or engagement contract, which continues after it ends.

7.2 We limit access to those who need it to provide the Services, and we train them in data protection and security.

7.3 No standing access. Our analysts access your content only to carry out the review work in your plan, or to provide support you ask for. Every access to Client Data by our staff is recorded in the audit log, and you can ask to see who accessed what and when.

8.1 We take appropriate technical and organisational measures under Article 32 of the UK GDPR, taking into account the state of the art, the cost, and the risks to data subjects.

8.2 Our measures include:

8.3 We will not materially reduce the overall level of security during the term.

8.4 Certification. At the date of this version we are working towards Cyber Essentials. We will tell you when it is achieved and keep you informed of later certifications.

9.1 You give us general written authorisation to use Sub-processors, subject to this clause.

9.2 Our current Sub-processors are listed on our sub-processors page at boxtick.uk, showing what each does, what data it handles, where it processes it and the safeguard relied on.

9.3 Every Sub-processor must be bound by a written contract on terms no less protective than these, including the prohibitions in clause 5, processing only within the UK or the European Economic Area, and notifying us of breaches quickly enough for us to meet clause 10.

9.4 We remain fully liable to you for each Sub-processor's performance of its data protection obligations.

9.5 Changes. We will give you at least 30 days' notice before adding or replacing a Sub-processor that handles Client Personal Data. You may object on reasonable data protection grounds within that period, and we will work with you to resolve it. If we cannot, you may end the affected Services and we will refund any Fees paid in advance for the period after they end.

10.1 We will tell you within 24 hours of becoming aware of a personal data breach affecting Client Personal Data.

10.2 We will tell you, as far as we know at the time: what happened, the categories and approximate number of data subjects and records affected, the likely consequences, and what we have done or propose to do. If we do not yet have the full picture, we will tell you what we have and follow up as we learn more.

10.3 We will not notify the ICO or data subjects on your behalf unless you instruct us in writing. That decision is yours as controller.

10.4 We will help you meet your obligations under Articles 33 and 34 of the UK GDPR.

10.5 We record every personal data breach, whether or not it is reportable, with the facts, effects and action taken, and will share the record of any breach affecting you on request.

11.1 During the term, we keep Client Personal Data for as long as you keep it in the Platform. You can delete documents, disconnect Connected Systems and remove Authorised Users at any time. When you disconnect a Connected System, we stop collecting from it straight away and delete the data obtained from it within 30 days, unless you ask us to keep it as evidence.

11.2 When the agreement ends, you have 30 days to export your Client Data and Reports, or to ask us to send them to you in a commonly used format. We then delete Client Personal Data within 90 days. We will confirm deletion in writing if you ask.

11.3 Deletion is real. It removes the data from our live systems, not just a flag. Database backups use a rolling seven-day restore window. Deleted data ages out of database backups within that window, without extending the 30-day export period or the following 90-day deletion deadline. We do not restore deleted data from a backup, and if a backup is restored for another reason, deletions are applied again.

11.4 Our own records. Records we hold as a controller under clause 2.2, such as the audit log and records of agreement acceptance, are kept as described in our privacy notice and are not Client Personal Data.

11.5 We may keep Client Personal Data where the law requires it, for as long as the law requires, and we will tell you if that happens.

12.1 Data subject requests. We will help you respond to requests from people exercising their rights. If we receive a request about your data, we will pass it to you within 2 working days and will not respond ourselves unless you instruct us to.

12.2 Automated decisions. The Platform does not make decisions about individuals that have legal or similarly significant effects on them. Its outputs are about your organisation's compliance, and every Report released as reviewed has been approved by an analyst.

12.3 Impact assessments. We will help you with any data protection impact assessment and prior consultation with the ICO that relates to the Services, including by giving you a description of how the Platform processes data.

12.4 Your staff. Where you connect systems that hold information about your staff, or use the Platform to issue policies to them, you must tell them how their information is used. We provide a template staff privacy notice you can adapt.

12.5 Complaints. If we receive a data protection complaint about your data, we will pass it to you within 2 working days.

13.1 There are none. We and every Sub-processor process Client Personal Data only in the United Kingdom or the European Economic Area.

13.2 Transfers from the UK to the European Economic Area are covered by UK adequacy regulations and need no further safeguard.

13.3 Support access counts. Nobody outside the UK or the European Economic Area may access Client Personal Data, including by remote viewing for support.

13.4 We will not change this without your prior written agreement. Any change would be treated as a Sub-processor change under clause 9.5 and would require an approved transfer mechanism and transfer risk assessment to be in place first.

14.1 We will give you the information you reasonably need to show that we meet Article 28 of the UK GDPR.

14.2 Audit. You, or an independent auditor you appoint who is bound by confidentiality, may audit our processing of Client Personal Data on at least 30 days' notice, no more than once in any 12 months, unless the ICO requires it or after a personal data breach affecting you.

14.3 We may meet an audit request by providing a current certification, audit report or completed security questionnaire where that reasonably answers your questions. If it does not, the audit goes ahead.

14.4 Audits are carried out during business hours, at your cost, and in a way that does not disrupt our other clients or expose their data.

14.5 We will co-operate with the ICO and, where you are a regulated firm, with your regulator.

15.1 This agreement takes effect when you accept it and continues for as long as we process Client Personal Data.

15.2 If this agreement conflicts with any other agreement between us on a data protection matter, this agreement takes priority.

15.3 If a change in Data Protection Law requires a change to this agreement, we will make it and tell you. A material change requires you to accept the agreement again.

15.4 Liability under this agreement is as set out in the platform terms, including the separate limit for data protection claims. Nothing in this agreement limits liability that cannot lawfully be limited.

15.5 This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Data protection enquiries: hello@boxtick.uk

The Programme Group Limited, trading as BoxTick, International House, 10 Churchill Way, Cardiff CF10 2HE

ICO registration: ZC275135