Data Processing Agreement
Version 2026-10
Draft for review by a lawyer before launch. Replace the bracketed details with the operating company's.
Under this agreement your firm is the Data Fiduciary for your clients' personal data and [Company name] is the Data Processor.
We will
- process client data only on your instructions and to provide the service;
- keep each firm's data isolated, encrypted, and accessible only to people you authorise;
- access your workspace for support only with your consent, for a limited time, with every session logged;
- notify you without undue delay of any personal data breach affecting your data;
- use sub-processors only for hosting, email and WhatsApp delivery and payments: [list];
- return your data on request (full export) and delete it after the account closes.
You will
- have a lawful basis and, where needed, your clients' consent for the data you store and the messages you send;
- manage your staff's access and remove it when they leave.