Data Processing Agreement

1. This agreement

1.1 This Data Processing Agreement (“DPA”) forms part of, and is incorporated into, the Effective Clerking Terms of Service (the “Agreement”) between Effective Clerking Ltd (company number 17445060, registered office 17 Wheatfield Road, Bedford, MK45 3QF) (“Processor”, “we”, “us”), and the customer identified in the Agreement (“Customer”, “you”).

1.2 No separate signature is required. Accepting the Agreement accepts this DPA. If your organisation requires a signed copy for its records, email support@effectiveclerking.co.uk and we will provide one.

1.3 If there is a conflict between this DPA and the rest of the Agreement, this DPA prevails in relation to the processing of personal data.

1.4 Which Part applies to you.

Part A applies where you are the controller of the personal data in your Customer Content — typically where you are a school, academy trust, local authority or other organisation using the Service for your own governance records.

Part B applies in addition where you are yourself a processor acting for another organisation — typically where you are an independent clerk or clerking practice, and the school or trust you serve is the controller. In that case you are the controller’s processor and we are its sub-processor.

If you are not sure which applies to you, Part B almost certainly does if you clerk for organisations that are not your own.

2. Definitions

2.1 “Data Protection Law” means the UK GDPR and the Data Protection Act 2018, as amended or replaced — including the amendments made by the Data (Use and Access) Act 2025. The Service is offered only to customers established in the United Kingdom. References below to the EU Standard Contractual Clauses are references to those clauses as modified by the UK Addendum, which is the transfer instrument approved by the Information Commissioner for UK restricted transfers; they do not imply that Regulation (EU) 2016/679 applies to this processing.

2.2 “UK GDPR”, “controller”, “processor”, “data subject”, “personal data”, “personal data breach”, “special category data” and “processing” have the meanings given in Data Protection Law.

2.3 “Customer Content” has the meaning given in the Agreement.

2.4 “Customer Personal Data” means personal data contained in Customer Content, which we process on your behalf.

2.5 “Sub-processor” means any third party we engage to process Customer Personal Data.

2.6 “Restricted Transfer” means a transfer of personal data to a country outside the United Kingdom (or, where EU law applies, outside the European Economic Area) that is not the subject of adequacy regulations.

2.7 “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the Information Commissioner. “IDTA” means the International Data Transfer Agreement issued by the Information Commissioner. “EU SCCs” means the standard contractual clauses in Commission Implementing Decision (EU) 2021/914.

PART A — Where you are the controller

3. Roles and scope

3.1 In relation to Customer Personal Data, you are the controller and we are the processor.

3.2 In relation to the personal data described in Part A of our Privacy Policy — your account, billing, support, service logs, security records and marketing — we are a controller in our own right, and this DPA does not apply to it. We say this expressly because it is the point the ICO found most providers get wrong.

3.3 Annex I sets out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject, as required by Article 28(3).

4. Our obligations as processor

We will:

4.1 Process only on your instructions. We will process Customer Personal Data only on your documented instructions, including in relation to Restricted Transfers, unless required to do otherwise by law to which we are subject — in which case we will inform you of that requirement before processing, unless the law prohibits it on important grounds of public interest.

Your instructions are: (a) the Agreement and this DPA; (b) your use of the features of the Service and the configuration settings you choose; and (c) any further written instruction you give us that we accept. We will tell you promptly if, in our opinion, an instruction infringes Data Protection Law.

4.2 Impose confidentiality. We will ensure that every person authorised to process Customer Personal Data is subject to a binding duty of confidentiality that survives the end of their engagement, and is trained appropriately.

4.3 Secure the data. We will implement and maintain the technical and organisational measures set out in Annex II, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as required by Article 32. We may update those measures provided the level of protection is not reduced.

4.4 Control sub-processors. We will engage Sub-processors only in accordance with clause 5.

4.5 Assist with data subject rights. Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures — insofar as this is possible — in fulfilling your obligation to respond to requests to exercise data subject rights.

In practice: the Service gives you direct access to search, export, correct and delete Customer Content yourself, which will usually be sufficient. Where it is not, we will help. If a data subject contacts us directly about Customer Personal Data, we will not respond substantively; we will pass the request to you without undue delay and tell the individual we have done so.

4.6 Assist with your wider obligations. Taking into account the nature of processing and the information available to us, we will assist you in complying with your obligations under Articles 32 to 36 — security, breach notification to the supervisory authority and to data subjects, data protection impact assessments, and prior consultation.

To make that practical, we publish a completed data protection impact assessment for the Service, a security statement, a sub-processor list and a transfer position, all of which you may use as inputs to your own DPIA.

4.7 Notify breaches. We will notify you of any personal data breach affecting Customer Personal Data without undue delay after becoming aware of it, and in any event within 24 hours. The notification will include, to the extent known and as it becomes available: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point.

We will provide reasonable further information and assistance to enable you to meet your own 72-hour obligation to the supervisory authority under Article 33, and we will not delay notifying you in order to complete our own investigation.

4.8 Delete or return. At the end of the provision of the Services, we will, at your choice, delete or return Customer Personal Data, and delete existing copies, unless law requires us to keep it. Clause 10 sets out how this works in practice.

4.9 Demonstrate compliance and permit audit. We will make available to you the information reasonably necessary to demonstrate compliance with Article 28, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. Clause 8 sets out how.

5. Sub-processors

5.1 General authorisation. You give us general written authorisation to engage Sub-processors, subject to this clause.

5.2 Current Sub-processors are listed in Annex III and published, and kept current, at https://www.effectiveclerking.co.uk/security.

5.3 Notice of change. We will give at least 30 days’ notice before adding or replacing a Sub-processor that will process Customer Personal Data, by email to your registered contact and by updating the published list. You may subscribe to change notifications at support@effectiveclerking.co.uk

5.4 Objection. You may object to a new Sub-processor within 30days of notice, on reasonable grounds relating to data protection. If you do, we will use reasonable efforts to make available a change to the Service, or a workaround, that avoids the processing by the objected-to Sub-processor. If we cannot do so within a reasonable time, either of us may terminate the affected part of the Service on written notice, and we will refund fees for the unused period. We will not engage an objected-to Sub-processor for your Customer Personal Data while an objection is being considered, unless doing so is necessary to continue providing the Service, in which case we will tell you and you may terminate.

5.5 Flow-down and liability. We will impose on each Sub-processor, by written contract, data protection obligations that are in substance no less protective than those in this DPA. We remain fully liable to you for the performance of each Sub-processor’s obligations.

5.6 AI providers specifically. Our AI provider is a Sub-processor and is subject to this clause 5 in full. In addition, we will not engage any AI provider unless it meets the minimum requirements published in section 3.3 of our AI Transparency & Limitations Notice — including an Article 28(3)-compliant data processing agreement, a contractual prohibition on training models on Customer Personal Data, a published retention position, a lawful Chapter V transfer mechanism where processing is outside the UK, current published independent security certification, and a published sub-processor list. This applies to a replacement provider and to any additional or contingency provider.

5.7 Emergency changes. Where a Sub-processor change is required urgently for security or continuity reasons, we may make it before the notice period expires and will tell you as soon as practicable, with the reason. Your right to object under clause 5.4 still applies.

6. International transfers

6.1 Annex III identifies, for each Sub-processor, the country of processing and the transfer mechanism relied on.

6.2 Where a Restricted Transfer takes place, we will ensure it is covered by an appropriate safeguard under Chapter V of the UK GDPR — the IDTA, the EU SCCs with the UK Addendum, or a valid adequacy mechanism including, where applicable, the UK Extension to the EU-US Data Privacy Framework.

6.3 Where the EU SCCs as modified by the UK Addendum are relied on, Module Two (controller to processor) or Module Three (processor to processor) applies as appropriate, and this DPA constitutes the parties’ agreement to them. Acceptance of the Agreement has the same effect as signature.

6.4 Transfer risk assessments. We maintain a documented transfer risk assessment for each Restricted Transfer, reviewed at least annually and on any material legal development. A summary is available to you on request.

6.5 Change of mechanism. If a transfer mechanism we rely on is invalidated, or ceases to be available, we will without undue delay implement an alternative lawful mechanism or cease the affected transfer. We will tell you what we have done.

6.6 Plain statement of where processing happens. For the avoidance of doubt, and because vagueness on this point is unhelpful to your own compliance:

your project database is hosted in the United Kingdom (West Europe, London);

AI drafting is processed and stored in the United States by our AI provider — currently Anthropic, with whom we contract through its Irish entity. Any change of AI provider is notified under clause 5;

application hosting, routing and backups are not confined to the United Kingdom;

transactional email delivery is processed in the United States

payment processing takes place in Ireland, the United Kingdom and the United States.

7. Special category and criminal offence data

7.1 We recognise that governance minutes may contain special category data within Article 9 — for example information about a person’s health, religion or ethnic origin — and personal data relating to criminal convictions and offences within Article 10, for example where an allegation, exclusion or investigation is recorded.

7.2 You confirm that you have identified an Article 9 condition and, where relevant, an Article 10 basis and a Schedule 1 Data Protection Act 2018 condition for such processing, and that you maintain an appropriate policy document where one is required.

7.3 We apply the additional measures set out in Annex II, section 8, to Customer Personal Data of these kinds, and we maintain our own appropriate policy document in respect of the processing we carry out.

7.4 The Service provides features intended to help you manage this material — confidential annexe handling, role-based access restriction, and redaction of material excluded from documents made available for inspection. Their correct use is your responsibility.

8. Audit and information

8.1 On written request, and no more than once in any 12-month period unless required by a supervisory authority or following a personal data breach affecting your Customer Personal Data, we will provide:

our current Security Statement and Annex II measures;

our sub-processor list and transfer position;

a completed copy of our standard supplier due diligence pack;

any current third-party certification or audit report we hold, or a summary where the full report is subject to confidentiality;

written responses to a reasonable data protection questionnaire.

8.2 Where the information in clause 8.1 is not sufficient to demonstrate compliance, you may conduct an audit or inspection, on at least 30 days’ written notice, during business hours, subject to reasonable confidentiality undertakings, conducted so as to minimise disruption, and no more than once in any 12-month period unless required by a supervisory authority or following a breach.

8.3 You will bear your own costs and our reasonable costs of an audit under clause 8.2, unless the audit reveals a material breach of this DPA by us, in which case we bear our own costs.

8.4 You will not have access to any other customer’s data, or to information whose disclosure would compromise the security of the Service or another customer.

9. Our access to Customer Personal Data

9.1 We access Customer Personal Data only where necessary: to provide support you have requested; to investigate, prevent or resolve a security incident or a suspected serious breach of our Acceptable Use Policy; to maintain or repair the Service where the fault cannot otherwise be diagnosed; or where legally compelled.

9.2 Every such access is logged, attributed to a named individual, and available to you on request.

9.3 Government and law enforcement requests. If we receive a legally binding request from a public authority for Customer Personal Data, we will: review it for validity and challenge it where there are reasonable grounds; disclose only the minimum required; and notify you before disclosure, unless legally prohibited — in which case we will use reasonable efforts to obtain a waiver and will notify you as soon as we lawfully can.

10. Deletion and return

10.1 During the subscription you may export Customer Content at any time using the export features in the Service.

10.2 Export Customer Content before termination or expiry, using the export features in the Service — access ends immediately once the Agreement ends. For 30 days after that you may ask us to reopen the account, which restores full access including export.

10.3 If you do not ask us to reopen the account within that 30 days, we permanently delete Customer Personal Data from live systems at the end of the period, and any remaining copies are overwritten as our database backups cycle out — currently within 7 days. We will certify deletion in writing on request.

10.4 We may retain Customer Personal Data where required by law, and any retained copy remains subject to this DPA.

10.5 We may retain aggregated or anonymised data that cannot reasonably be used to identify you or any individual.

11. Liability

11.1 The limitations and exclusions of liability in the Agreement apply to claims under this DPA, except to the extent Data Protection Law prohibits it.

11.2 Nothing in this DPA limits a data subject’s rights against either party under Data Protection Law, or either party’s liability to a supervisory authority.

11.3 Where both parties are found responsible for the same damage, each is liable for the share attributable to its own responsibility.

12. Term

This DPA takes effect when the Agreement takes effect, and continues until we have deleted or returned all Customer Personal Data in accordance with clause 10. Clauses 4.2, 8, 9, 10 and 11 survive.

PART B — Where you are yourself a processor (clerking practices)

This Part applies in addition to Part A where you use the Service to provide clerking or governance services to organisations other than your own. In that arrangement the school, academy trust or local authority is the controller, you are its processor, and we are its sub-processor.

13. Your position and warranties

13.1 You warrant that:

you have a written contract with each controller you act for, containing the terms required by Article 28(3) UK GDPR;

that contract gives you either a general written authorisation to engage sub-processors, or the controller’s specific written authorisation to engage us;

you have given, or will give, that controller the information about us that its own authorisation and record-keeping requires — including our identity, the location of processing, our sub-processors and our transfer mechanisms; and

you have authority to give us the instructions you give.

13.2 You will not put Customer Content into the Service that you are not authorised by the relevant controller to process, or to have processed by a sub-processor.

13.3 You will indemnify us against losses, costs and reasonable legal fees we incur as a result of a breach of clause 13.1 or 13.2. This clause does not apply where you are a consumer.

14. Flow-down and the controller’s rights

14.1 Our obligations in Part A are owed to you, and — where required by Article 28(4) — operate for the benefit of the controller you act for.

14.2 We will assist you in responding to a controller’s request for information, audit or assurance about our processing, on the terms in clause 8, treating the controller’s request as if it were yours.

14.3 We will provide, on request and for you to give to your controllers: our Security Statement, sub-processor list, transfer position, DPIA and due diligence pack. These are drafted for that purpose and are not confidential to you.

15. Instructions and conflicts

15.1 We take instructions from you, not from the controller. If a controller contacts us directly with an instruction, a data subject request, or a request to delete or return data, we will not act on it. We will pass it to you without undue delay and tell the controller we have done so, unless we are legally required to act otherwise.

15.2 Where you tell us that a controller has instructed something and you pass that instruction on, we will treat it as your instruction.

15.3 If you cease to act for a controller, or a dispute arises about entitlement to data, we will maintain the data unchanged pending resolution and will not delete it during that period unless legally required to, notwithstanding clause 10. Resolving entitlement is between you and the controller; we are not the arbiter of it. Where we are given conflicting instructions by you and a person claiming to act for a controller, we may suspend processing of the affected data and require written confirmation before proceeding.

15.4 You should ensure your own contracts with controllers set out what happens to the data if your engagement ends, so that clause 15.3 is not needed.

16. Onward sub-processing

16.1 Our Sub-processors are, in this arrangement, sub-processors of the controller as well as of you. The notice and objection procedure in clause 5 applies to you, and you must pass notices on to your controllers so they can exercise any right of objection they have under their contract with you.

ANNEX I — Details of processing (Article 28(3))

A. List of parties

B. Subject matter of the processing

Provision of a software service that stores governance records and produces drafted meeting agendas, minutes, action records and invoices from information supplied by the Customer, with AI assistance and an explicit human approval step.

C. Duration

For the term of the Agreement, plus the deletion periods in clause 10.

D. Nature and purpose of the processing

Collection, recording, organisation, structuring, storage, retrieval, consultation, use by means of automated drafting, disclosure by transmission to recipients the Customer designates, erasure and destruction — all for the purpose of enabling the Customer to prepare, review, approve, distribute and retain governance documents, and to track actions and issue invoices arising from them.

E. Types of personal data

F. Categories of data subject

Governors and trustees; members; headteachers, senior leaders and other school or trust staff; clerks and governance professionals; local authority officers; external advisers and auditors; and — incidentally, where a board discussed a matter concerning them — pupils, parents and members of the public.

G. Frequency of transfer

Continuous, on a transactional basis, for the duration of the Agreement.

H. Retention

As set out in clause 10 and the Customer’s own configured retention settings.

I. Sensitive data — additional measures

See Annex II, section 8.

ANNEX II — Technical and organisational measures (Article 32)

1. Access control and identity

Individual named accounts; no shared logins.

Multi-factor authentication available to all users and enforced on all administrative and production accounts, including our own accounts with Supabase, Vercel, Stripe, Anthropic and GitHub.

Role-based access control within each customer tenancy.

Least-privilege access to production systems, granted to named individuals, reviewed at least 6 months

Immediate revocation on role change or departure.

Password storage using industry-standard salted hashing; no plaintext credential storage anywhere.

2. Tenant isolation

Every record is scoped to an organisation identifier.

Isolation is enforced at the database layer by row-level security policies, not only in application code.

No cross-tenant sharing, no public links, and no cross-tenant search.

3. Encryption

TLS 1.2 or higher for all data in transit.

Encryption at rest for the database, file storage and backups, using the encryption provided by our infrastructure providers.

Secrets and API keys held in the hosting provider’s environment variable store, never in source control; pre-commit secret scanning in the code repository.

4. Logging, monitoring and audit

An immutable, per-document audit log recording creation, editing, AI reformatting, flag dismissal, approval, sending, status change and voiding, with actor and timestamp, keyed to a permanent reference number.

Authentication and administrative access logging.

Logging of every access by our personnel to Customer Content, attributed to a named individual.

Automated alerting on anomalous authentication activity

5. Software security

Dependencies kept current; security patches for high and critical vulnerabilities applied within 14 days of availability.

Lint, type-check and build checks on every change before merge.

Automated dependency vulnerability scanning via GitHub Dependabot, enabled on the code repository.

A white-box security assessment (code and infrastructure configuration review) was completed on 2 September 2026, with all findings remediated the same day bar one open dashboard setting. We plan to repeat an assessment of this kind at least annually.

6. Backup and recovery

Automated daily backups of the database, retained for 7 days. Point-in-time recovery is not currently enabled.

Recovery procedures documented and tested at least annually.

Target recovery point objective 24 hours; target recovery time objective 24 hours.

7. Organisational measures

Confidentiality obligations binding on every person with access, surviving the end of engagement.

Data protection and security awareness training on engagement and at least annually.

Documented incident response plan with defined roles and notification timescales.

Supplier due diligence before engaging any sub-processor, and annual review thereafter.

Documented retention and deletion schedule.

Data protection impact assessment maintained and reviewed.

8. Additional measures for special category and criminal offence data

Confidential annexe handling, so that Part 2 or confidential business can be held and controlled separately from the main record.

Restriction of confidential annexe content by role within the customer’s tenancy.

Redaction support for producing versions of documents made available for public inspection, reflecting the exclusions permitted by regulation 15(3) of the School Governance (Roles, Procedures and Allowances) (England) Regulations 2013.

Access to such content by our personnel only where strictly necessary, always logged.

An appropriate policy document maintained in accordance with Schedule 1, Part 4 of the Data Protection Act 2018.

9. AI-specific measures

Only the text necessary for the requested drafting task is transmitted to the AI provider.

The AI provider is contractually prohibited from training models on the content transmitted.

No AI output is finalised or sent without an explicit human approval action.

AI-assisted output is identified as such.

ANNEX III — Sub-processors

Current as at 07/09/2026. The live list is published at https://www.effectiveclerking.co.uk/security.

Notes for customers

Stripe acts as an independent controller as well as our processor, for fraud prevention and anti-money-laundering purposes. For that processing Stripe determines its own purposes and means and its own privacy policy applies.

Our AI provider does not train on your content. Under Anthropic’s Commercial Terms of Service, Anthropic may not train models on customer content from the API. Its published retention position is deletion within 30 days of receipt or generation, save that content flagged by automated trust and safety systems may be retained for up to 2 years and classification scores for up to 7 years.

Some of our sub-processors engage their own sub-processors, including AI providers we did not select. Supabase names OpenAI, LLC among its sub-processors. Resend names Anthropic PBC and RunPod among its sub-processors — include if using Resend.We monitor those lists and will notify you of changes that materially affect Customer Personal Data.

Our infrastructure providers’ own published sub-processor lists are at supabase.com/legal/customer-resources/subprocessor-list, security.vercel.com, trust.anthropic.com/subprocessors, stripe.com/legal/service-providers and resend.com/legal/subprocessors.