Data processing agreement
In short: you, or your client, decide what happens to the records; we only process them to build your evidence packs, on your instructions. People's names are replaced with labels before the AI sees anything, nothing is used to train AI, everything stays in the UK or EU, and source files are deleted within 30 days of you releasing a pack.
1. Roles
- For personal data in Client Data, the Client is the controller, or a processor acting for the End Client. Sprint Ready Ltd ("Processor") is the Client's processor, or sub-processor where the Client is itself a processor.
- Where the Client is a processor for the End Client, the Client confirms that the End Client has authorised the use of the Processor, and that the Client has passed on to the Processor the End Client's instructions that are relevant to the processing.
- This agreement applies for as long as the Processor processes personal data for the Client and takes precedence over the terms of service on data protection.
2. The processing
| Subject matter and purpose | Building evidence packs for R&D tax relief engagements: reading, grouping, extracting and checking evidence from engineering records, and storing the results for the Client. |
|---|---|
| Duration | The term of the Client's Account, plus the deletion periods in section 7. |
| Types of personal data | Names, work email addresses, usernames, job roles and other identifiers of people appearing in tickets, comments, commit messages and documents; the content of their work records. Contact details of Uploaders using an Upload Page. |
| Data subjects | Employees, contractors and other people working for or with the End Client; Uploaders; the Client's Authorised Users. |
| Nature of processing | Storage, parsing, pseudonymisation, automated analysis (including by AI models through Amazon Bedrock), verification, rendering of evidence packs, retrieval by Authorised Users, deletion. |
3. The Processor's obligations
- Process personal data only on the Client's documented instructions, which are these terms, the Client's use of the service's features, and any further written instructions the Client gives and the Processor agrees are compatible with the service. The Processor will tell the Client if it believes an instruction breaks data protection law.
- Ensure everyone authorised to process the personal data is bound by confidentiality.
- Take the technical and organisational security measures set out in the annex, and keep them appropriate to the risk.
- Pseudonymise before AI. Replace the names and email addresses of people in Client Data with labels (Person A, Person B…) before any content is sent to an AI model, and restore them only in the Client's own view and packs.
- No training. Not use Client Data to train or improve AI models, and use AI providers that are contractually prevented from doing so and from retaining prompts beyond what is needed to answer them.
- Help the Client, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights, and with security, breach notification, data protection impact assessments and consultation with the Information Commissioner, at the Client's reasonable cost where the help goes beyond normal use of the service.
- Make available the information reasonably needed to show compliance with Article 28, and allow audits as set out in section 8.
4. Sub-processors
- The Client gives general authorisation for the Processor to use the sub-processors below. The Processor will give at least 30 days' notice by email of any new sub-processor; the Client may object on reasonable data protection grounds, and if the objection can't be resolved, may end the affected part of the service without penalty and receive a refund of prepaid fees for the period after it ends.
- The Processor will impose data protection terms on each sub-processor that are no less protective than this agreement, and remains responsible to the Client for their performance.
| Sub-processor | What for | Where |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, storage and backups (encrypted); notification emails (Amazon SES); AI models through Amazon Bedrock, used without training or retention of content | EU (Stockholm, Sweden) |
| Hostinger International Ltd | Email: the ClaimEvidence support mailbox | EU |
Stripe processes payment details as an independent controller under its own terms, and receives no Client Data.
5. International transfers
Client Data is stored and processed in the UK or the European Economic Area, which the UK recognises as providing adequate protection. The Processor will not transfer it elsewhere without the Client's prior written consent and appropriate safeguards (such as the UK International Data Transfer Agreement).
6. Personal data breaches
The Processor will notify the Client without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Client Data, with the information reasonably available (what happened, the data and people affected, likely consequences and the measures taken or proposed), and will update the Client as more is known.
7. Deletion and return
- Source files (uploaded exports and documents) and intermediate files, including the pseudonymisation key, are deleted 30 days after the Client releases the evidence pack for an engagement, or sooner if the Client deletes the engagement or instructs deletion.
- Evidence packs and their run records are kept while the Client's Account is open so the Client can use them in a claim or enquiry, unless the Client deletes them.
- When the Account closes, the Processor will, at the Client's choice made within 30 days, return the evidence packs and then delete all Client Data, or delete it, unless the law requires it to be kept. Copies held in encrypted backups are deleted when those backups expire.
- Every deletion is logged and the log is available to the Client.
8. Audits
The Processor will answer reasonable written questions about its compliance and provide a summary of its security measures. If that is not enough to show compliance, the Client may, on 30 days' written notice and no more than once a year (or after a personal data breach), carry out a remote audit, or appoint an independent auditor bound by confidentiality, at the Client's cost and in a way that does not compromise other customers' data or security.
9. Liability
Each party's liability under this agreement is subject to the limits in the terms of service, except to the extent data protection law does not allow them.
Annex: security measures
- Encryption in transit (TLS 1.2 or higher) and at rest (encrypted disks and backups); secrets such as mailbox passwords encrypted separately.
- Each Client's data kept in its own engagement folders and database records, accessible only to its Authorised Users; Upload Pages write only to the Client that owns them.
- Two-factor authentication for all Authorised Users; account lockout after repeated failed logins; sessions that expire.
- Pseudonymisation of people's names before AI processing; the key is held separately and deleted with the source files.
- AI workflow configured not to store execution content; AI providers without training on, or retention of, content.
- Administrative access restricted to named Sprint Ready Ltd staff, using AWS-managed, logged access channels; when our staff open a Client's engagement through the service, the access is logged in its audit trail.
- Security updates applied promptly; uploads limited by type and size and parsed without running macros or scripts.
- Audit log of uploads, builds, releases, downloads and deletions per engagement.