Data processing agreement

This agreement is part of the terms of service between [company legal name] ("PWS", the processor) and the customer ("you", the controller). It applies whenever PWS processes personal data for you, and meets Article 28 of the UK GDPR and of the EU GDPR.

1. The processing

Subject matter and purpose	(a) Storing the encrypted copies of your payroll data when you turn on the cloud vault; (b) passing de-identified payroll figures to the AI provider when you ask for an AI explanation through PWS, and returning the answer; (c) reading support bundles you send us; (d) providing the related account features.
Duration	While your account is open, then until deletion under section 8.
Data subjects	Your employees, former employees, directors, pensioners and contractors; your staff who use PWS Payroll.
Personal data	Payroll records: names, addresses, dates of birth, National Insurance numbers, tax codes, pay, deductions, pensions, student loans, bank details, statutory payments and related records, which may include health information (sickness absence) and other special category data. In the cloud vault this is encrypted with your key, which PWS does not hold.
Nature	Storage, transmission, retrieval and deletion. PWS cannot read cloud-vault contents. AI requests are de-identified by the app before they leave your computer and are not stored by PWS.

2. PWS's obligations

• Process the data only on your documented instructions (these terms, and your use of the features), unless the law requires otherwise, in which case PWS will tell you first unless the law forbids it.
• Ensure that everyone authorised to process the data is bound by confidentiality.
• Take the security measures in section 9.
• Use sub-processors only as set out in section 5.
• Help you, taking into account the nature of the processing, to respond to data subjects' requests, and with security, breach notification, impact assessments and consultation with the regulator.
• At the end of the service, delete the data under section 8.
• Make available the information needed to show compliance with this agreement and allow audits under section 7.
• Tell you at once if an instruction appears to break data protection law.

3. Your obligations

You are responsible for having a lawful basis for the processing, for the instructions you give, for telling your employees how their data is processed (including that you use PWS), and for keeping your cloud-vault password and recovery key safe.

4. Personal data breaches

PWS will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your obligations, and will take reasonable steps to contain it. Breaches of encrypted cloud-vault data expose only ciphertext.

5. Sub-processors

You authorise the sub-processors listed at sub-processors. PWS will give at least 30 days' notice (by email and on that page) before adding or replacing one; you may object on reasonable data protection grounds, and if we cannot address the objection you may end the agreement. PWS imposes data protection terms on each sub-processor equivalent to these, and remains responsible for them.

6. International transfers

Cloud-vault data is stored in the European Union. Where a sub-processor processes data outside the UK or EEA, the transfer is made under the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or another lawful mechanism.

7. Audits

PWS will answer reasonable written questions about its compliance. Once a year, or after a breach, you (or an independent auditor bound by confidentiality) may audit compliance on 30 days' notice, during business hours, at your cost, without access to other customers' data.

8. Deletion

You can delete the cloud vault at any time in the app; every copy is deleted at once, and encrypted database backups roll off within 30 days. When your account closes, PWS deletes any remaining data within 30 days, unless the law requires it to be kept. Your data on your computers is under your control.

9. Security measures

• Cloud vault encrypted end to end: AES-256-GCM, keys derived from your password with scrypt; PWS stores ciphertext, wrapped keys it cannot unwrap, and hashes of access keys. Access needs both your PWS sign-in and proof of the vault password; repeated failures lock access.
• Data on your computer encrypted at rest while the vault is on; the app asks for the password when it opens.
• HTTPS with HSTS for all connections; servers reachable only through the web proxy; the database on an internal network.
• Separate least-privilege database logins for each part of the service; containers run with minimal privileges and read-only file systems.
• Staff access by password and authenticator app only; staff access is logged; erasure needs a recorded reason.
• Daily encrypted-at-source backups kept for 30 days; software updates signed and checked.
• No scripts or third-party content on PWS web pages; strict content security policy; rate limits on sign-in and APIs.

Questions: [contact email].