Welcome to Custodian Labs! We provide a cloud-based platform (Platform) where you can build and deploy AI-powered chatbots and anonymise sensitive data before it is processed by large language models.
In these Terms, when we say you or your, we mean both you and any entity you are authorised to represent (such as your employer). When we say we, us, or our, we mean Custodian Labs Limited (New Zealand Company Number 9398102).
These Terms form our contract with you, and set out our obligations as a service provider and your obligations as a customer. You cannot use our Services unless you agree to these Terms.
Some capitalised words in these Terms have defined meanings, and each time that word is used in these Terms it has the same meaning. You can find a list of the defined words and their meaning at the end of these Terms.
For questions about these Terms, or to get in touch with us, please email: support@custodianlabs.io
These Terms were last updated on 14 July 2026.
1. Engagement and Term
- These Terms apply from when you sign up for an Account, until the date on which your Account is terminated in accordance with these Terms. We grant you a right to use our Services for this period of time only (which may be suspended or revoked in accordance with these Terms).
- You must be at least 16 years old to use our Platform.
- Variations: We may amend these Terms at any time, by providing written notice to you. By clicking "I accept" or continuing to use our Platform after the notice or 30 days after notification (whichever date is earlier), you agree to the amended Terms. If you do not agree to the amendment, you may close your Account and cancel your Subscription with effect from the date of the change in these Terms by providing written notice to us. If you cancel your Subscription:
- you will no longer be able to access our Services (including our Platform) on and from the date of cancellation; and
- if you have paid Subscription Fees upfront, you will be issued a pro-rata refund based on the portion of the Subscription Period remaining.
2. Our Services
- We provide the following services to you:
- access to our Platform, including:
- access to our AI chatbot development tools;
- access to our data anonymisation and privacy transformation tool; and
- access to our troubleshooting support (Support Services), and
- (collectively, our Services).
- access to our Platform, including:
- If you require Support Services, you may request these by getting in touch with us through our Platform.
- Unless we agree otherwise, Support Services cannot be used to support any other products or services, and does not include training, installation of software or hardware, software development or the modification, deletion or recovery of data or any on-site services.
- Use of Artificial Intelligence: Our Platform incorporates artificial intelligence and machine learning technologies, including large language model integrations. You acknowledge that:
- outputs generated by or through AI components of our Platform are probabilistic in nature and may not always be accurate, complete, or suitable for your intended purpose; and
- you are responsible for reviewing and validating any AI-generated outputs before relying on them.
- Data Anonymisation Tool: Our Platform includes a data anonymisation and privacy transformation tool that allows you to redact or mask sensitive information prior to processing by large language models. You are solely responsible for ensuring that all sensitive information has been appropriately redacted or masked from any output from the Platform before submitting data for processing, and we will not be liable for any loss or damage arising from your reliance on any output where sensitive information has not been fully redacted.
- Our Services do not constitute, and are not a substitute for, financial, legal or risk management advice.
- We will not be responsible for any other services unless expressly set out in these Terms or on our Platform.
- Additional Services: If you require additional services, we may, in our sole discretion, provide such additional services (to be scoped and priced in a separate contract provided by us).
- Beta Services: If we provide you with access to any new or beta services, you acknowledge that because of the developmental nature of such services, you use them at your own risk and we have no obligation to maintain or provide error corrections. Any new or beta services we provide you with access to are for evaluation purposes only and not for production use, and we may discontinue those services at any time at our sole discretion.
- Third Party Products or Services: Where you engage third parties to operate alongside our Services (for example, any third-party software systems you wish to integrate with our Platform), those third parties are independent of us and you are responsible for (meaning we will not be liable for) the goods or services they provide, unless we expressly agree otherwise under clause 2.8.
3. Sensitive Information
- Our Platform may be used to process sensitive information (including special categories of personal data as defined under the UK GDPR and Data Protection Act 2018). You acknowledge that:
- you are solely responsible for ensuring that any sensitive information uploaded to our Platform is handled in accordance with all applicable laws, including the United Kingdom Data Protection Regulation (UK GDPR), the Data Protection Act and any other applicable data protection laws;
- you must have all necessary consents, authorities or other legal basis to upload and process any sensitive information through our Platform; and
- we are not a health information custodian and our Platform is not a health records system and we do not have any medical regulatory expertise. We will not be liable for any loss or damage arising from your use of our Platform to process sensitive information.
4. Account
- You must sign up for an Account in order to access and use our Platform.
- While you have an Account with us, you agree to:
- keep your information up-to-date (and ensure it remains true, accurate and complete);
- keep usernames and passwords secure and confidential, and protect them from misuse or being stolen; and
- notify us if you become aware of, or have reason to suspect, any unauthorised access to your Account or any logins linked to your Account.
- We may suspend your access to our Services where we reasonably believe there has been any unauthorised access to or use of our Services (such as the unauthorised sharing of login details for our Platform). If we suspend your access to our Services, we will let you know within a reasonable time of doing so, and we will work with you to resolve the matter, or if it cannot be resolved, then we may terminate your Account and your access to our Services will end.
5. Subscriptions
- Once you have created your Account, you may choose a Subscription.
- Free Tier: If you are on the Free Tier, you acknowledge that:
- your usage is subject to the limits set out on our Platform;
- we may at our sole discretion modify, suspend, or discontinue the Free Tier at any time on reasonable notice; and
- certain features available to paid Subscription tiers may not be available to Free Tier users.
- The Subscriptions we offer will be set out on our Platform, including details of each Subscription's features and limitations, Subscription Fees and Subscription Periods. Our current Subscription tiers include a Free Tier, a paid Insider Tier, and a paid Custom Enterprise option (available on application). Pricing for each tier, including any applicable overage charges, is set out on our Platform and may be updated from time to time.
- During the Subscription Period, you will be billed for the Subscription Fees on a recurring basis, as set out on our Platform (Billing Cycle).
- Overage Charges: If your usage exceeds the limits applicable to your Subscription tier, we may charge overage fees at the rates set out on our Platform. Current overage rates are published on our Platform and are subject to change from time to time.
- Subscriptions can be upgraded or downgraded at any time through your Account. Any upgrades to your Subscription will take effect immediately (and you will be charged on a pro-rata basis). Any downgrades to your Subscription will take effect from the beginning of the next Billing Cycle.
- You will be billed for any Subscription Fees due at the beginning of each Billing Cycle. Our payment methods will be set out on our Platform. If you choose to pay your Subscription Fees using one of our third-party payment processors, you may need to accept their terms and conditions (if this is the case, these will be set out on our Platform).
- You must not pay, or attempt to pay, any Subscription Fees by fraudulent or unlawful means. If you make payment by debit or credit card, you must be the authorised card holder. If payment is made by direct debit, by providing your bank account details and accepting these Terms, you authorise our nominated third-party payment processor to debit your bank account in accordance with your chosen Subscription, and you confirm that you are either the holder or an authorised signatory of that bank account.
- Cancellation: Your Subscription continues for the Subscription Period, and at the end of each Subscription Period, provided you have paid all Subscription Fees owing, your Subscription will be automatically renewed for the same Subscription Period. If you wish to cancel your Subscription, you may do so by providing 30 days' written notice through your Account, with cancellation taking effect at the end of your immediately following Billing Cycle. No refunds will be provided for any unused portion of the Subscription Period. If you are on an annual Subscription, we will provide you with a renewal reminder at least 30 days prior to your Subscription renewing.
- Late Payments: If any Subscription Fees are not paid on time, we may:
- suspend your access to our Services (including access to our Platform); and
- charge interest on any overdue payments at a rate equal to the Bank of England's base rate, from time to time, plus 4% per annum, calculated daily and compounding monthly.
- Taxes: All amounts payable by you under these Terms are exclusive of amounts in respect of value added tax (VAT), unless otherwise stated. Where any taxable supply for VAT purposes is made under these Terms by us to you, you agree, on receipt of a valid VAT invoice from us, to pay to us such additional amounts in respect of VAT as are chargeable on the supply of the Services at the same time as payment is due for the supply of the Services.
If any withholding or deduction is required by law from any payment under these Terms, you agree to increase the payment amount to ensure that we receive the full sum due as if no such withholding or deduction had been made.
6. Platform Licence
- While you have an Account, we grant you a right to use our Platform (which may be suspended or revoked in accordance with these Terms). This right cannot be passed on or transferred to any other person and, if you have a Subscription, will also be subject to the conditions of your Subscription (as set out on our Platform or in your Account).
- You must not:
- access or use our Platform in any way that is improper or breaches any laws, infringes any person's rights (for example, intellectual property rights and privacy rights), or gives rise to any civil or criminal liability;
- interfere with or interrupt the supply of our Platform, or any other person's access to or use of our Platform;
- introduce any viruses or other malicious software code into our Platform;
- use any unauthorised or modified version of our Platform, including but not limited to for the purpose of building similar or competitive software or for the purpose of obtaining unauthorised access to our Platform;
- attempt to access any data or log into any server or account that you are not expressly authorised to access;
- use our Platform in any way that involves service bureau use, outsourcing, renting, reselling, sublicensing, concurrent use of a single user login, or time-sharing;
- circumvent user authentication or security of any of our networks, accounts or hosts or those of any third party; or
- access or use our Platform to transmit, publish or communicate material that is defamatory, offensive, abusive, indecent, menacing, harassing or unwanted.
7. Availability, Disruption and Downtime
- While we strive to always make our Services available to you, we do not make any promises that these will be available 100% of the time. Our Services may be disrupted during certain periods, including, for example, as a result of scheduled or emergency maintenance.
- Our Services (including our Platform) may interact with, or be reliant on, products or services provided by third parties, such as cloud hosting service providers. To the maximum extent permitted by law, we are not liable for disruptions or downtime caused or contributed to by these third parties.
- We will try to provide you with reasonable notice, where possible, of any disruptions to your access to our Services.
8. Intellectual Property and Data
- We own all intellectual property rights in our Services (including our Platform). This includes how our Platform looks and functions, as well as our copyrighted works, trademarks, inventions, designs and other intellectual property. You agree not to copy or otherwise misuse our intellectual property without our written permission (for example, to reverse engineer or discover the source code of our intellectual property), and you must not alter or remove any confidentiality, copyright or other ownership notice placed on our Platform.
- We may use any feedback or suggestions that you give us in any manner which we see fit (for example, to develop new features), and no benefit will be owed to you as a result of any use by us of your feedback or suggestions.
- Your Data: We do not own any of Your Data, but when you enter or upload any of Your Data into our Platform, you grant us the right to access, analyse, backup, copy, store, transmit, and otherwise use Your Data while you have an Account with us (and for a reasonable period of time afterwards). We may use Your Data (or disclose it to third party service providers) to:
- supply our Services to you (for example, to enable you to access and use our Services), and otherwise perform our obligations under these Terms;
- diagnose problems with our Services;
- improve, develop and protect our Services;
- send you information we think may be of interest to you based on your marketing preferences;
- perform analytics for the purpose of remedying bugs or issues with our Platform; or
- perform our obligations under these Terms (as reasonably required).
- You acknowledge and agree that because of the nature of the internet, the processing and transmission of Your Data by us may occur over various networks, and may be transferred unencrypted.
- You are responsible for (meaning we are not liable for):
- the integrity of Your Data on your systems, networks or any device controlled by you; and
- backing up Your Data.
- When you use our Services, we may create anonymised statistical data from Your Data and usage of our Services (for example, through aggregation). Once anonymised, we own that data and may use it for our own purposes, such as to provide and improve our Services, to develop new services or product offerings, to identify business trends, and for other uses we communicate to you. This may include making such anonymised data publicly available, provided it is not compiled using a sample size small enough to make underlying portions of Your Data identifiable.
- If you do not provide Your Data to us, it may impact your ability to receive our Services.
- You represent, warrant, acknowledge and agree that you have all necessary rights to provide Your Data to us, and that our use of it as contemplated by this Agreement will not violate any Laws or third-party rights, including intellectual property, privacy, or publicity rights.
- If you (if you are an individual) or any of your Personnel have any Moral Rights in any material provided, used or prepared in connection with this Agreement, you agree to (and will procure that your Personnel) consent to our use or infringement of those Moral Rights.
- This clause 8 will survive termination or expiry of this Agreement.
9. Confidential Information and Personal Data
- While using our Services, you may share confidential information with us, and you may become aware of confidential information about us. You agree not to use our confidential information, and to take reasonable steps to protect our confidential information from being disclosed without our permission, and we agree to do the same for your confidential information. This also means making sure that any employees, contractors, professional advisors or agents of ours or yours only have access to confidential information on a 'need-to-know basis' (in other words, the disclosure is absolutely necessary), and that they also agree to not misuse or disclose such confidential information.
- However, either you or we may share confidential information with legal or regulatory authorities if required by law to do so.
- We collect, hold, disclose and use any personal data you provide to us in accordance with our privacy policy, available here, the UK GDPR, the Data Protection Act 2018 and any other applicable data protection laws.
- You must only disclose Personal Data to us if you have the right to do so (such as having the individual's express consent).
- As between you and us, you are the data controller in respect of any Personal Data processed through our Platform, and we process such information solely as a data processor acting on your instructions. You are solely responsible for determining the purposes and means of processing, ensuring you have a lawful basis for doing so, and complying with all applicable privacy laws in respect of that processing.
- We may need to disclose Personal Data to third parties, such as our related companies or our service providers (for example, IT and administrative service providers and our professional advisors).
- The Data Processing Addendum attached to these Terms forms part of these Terms and governs our processing of Personal Data on your behalf. To the extent of any inconsistency between these Terms and the Data Processing Addendum in respect of data processing or other privacy rights, the Data Processing Addendum will prevail.
10. Liability
- To the maximum extent permitted by law, we will not be liable for, and you release us from liability for, any Liability caused or contributed to by, arising from or in connection with these Terms (including the Data Processing Addendum) and:
- your computing environment (for example, your hardware, software, information technology and telecommunications services and systems);
- any use of our Services by a person or entity other than you;
- any loss or damage arising from your failure to comply with the laws of the jurisdiction applicable to you or your End Users, including any applicable privacy, data protection, or sensitive information laws, regardless of where you access our Platform;
- any loss or damage arising from your uploading, inputting or processing of sensitive, personal, or health information through our Platform, including any failure by you to obtain necessary consents or authorisations from individuals whose data is processed;
- any re-identification, inference, or reconstruction of anonymised data that occurs as a result of information you provide, combine, or make available outside of our Platform; or
- any loss or damage arising from the outputs, responses, or decisions made by AI models or chatbots built or deployed using our Services, including any reliance placed on those outputs by you or your End Users.
- Nothing in these Terms or Data Processing Addendum limits any Liability which cannot legally be limited; including liability for:
- death or personal injury caused by negligence; and
- fraud or fraudulent misrepresentation.
- Regardless of whatever else is stated in these Terms or Data Processing Addendum, to the maximum extent permitted by law:
- neither we nor you are liable for any Consequential Loss;
- a party's liability for any Liability under these Terms will be reduced proportionately to the extent the relevant Liability was caused or contributed to by the actions (or inactions) of the other party, including any failure by the other party to mitigate its loss; and
- our aggregate liability to you for any Liability arising from or in connection with these Terms and Data Processing Addendum will be limited to the amount of any Subscription Fees paid by you to us in the preceding 6 months in respect of the supply of the relevant Services to which the Liability relates, or if you do not have a Subscription, to £500.
11. Termination
- We may terminate these Terms (meaning you will lose access to our Services, including access to your Account, and any Subscription will be cancelled) if:
- you fail to pay your Subscription Fees when they are due;
- you breach these Terms and do not remedy that breach within 14 days of us notifying you of that breach;
- you breach these Terms and that breach cannot be remedied; or
- (to the extent permitted by law) any step is taken to enter into any arrangement between you and your creditors, any step is taken to appoint a receiver, a receiver and manager, an administrator, a liquidator, or like person of the whole or any part of your assets or business, you are bankrupt, or you are unable to pay your debts as they fall due.
- You may terminate these Terms if:
- we breach these Terms and do not remedy that breach within 14 days of you notifying us of that breach; or
- we breach these Terms and that breach cannot be remedied,
- You may also terminate these Terms at any time by notifying us through your Account or to our email for notices (as set out in clause 12.9), and if you have a Subscription, termination will take effect at the end of your current Subscription Period.
- Upon termination of these Terms, we will retain Your Data (including copies) as required by law or regulatory requirements.
- Termination of these Terms will not affect any other rights or liabilities that we or you may have.
12. General
- Assignment: You may not transfer or assign these Terms (including any benefits or obligations you have under these Terms) to any third party without our prior written consent. We may assign or transfer these Terms to a third party, or transfer any debt owed by you to us to a debt collector or other third party.
- Contracts (Rights of Third Parties) Act 1999: Despite any other provision of these Terms, nothing in these Terms confers or is intended to confer any right to enforce any of its terms on any person who is not a party to it.
- Disputes: Neither we nor you may commence court proceedings relating to any dispute, controversy or claim arising from, or in connection with, these Terms (including any question regarding its existence, validity or termination) (Dispute) unless we and you first meet (in good faith) to resolve the Dispute. Nothing in this clause will operate to prevent us or you from seeking urgent injunctive or equitable relief from a court of appropriate jurisdiction.
If the Dispute is not resolved at that initial meeting, either Party may refer the matter to a mediator. If the Parties cannot agree on who the mediator should be, either Party may refer the Dispute to mediation administered by The Centre for Effective Dispute Resolution. Nothing in this clause will operate to prevent a Party from seeking urgent injunctive or equitable relief from a court of appropriate jurisdiction. - Events Outside Our Control: We will not be liable for any delay or failure to perform our obligations (including our Services), if such delay or failure is caused or contributed to by an event or circumstance beyond our reasonable control.
- Governing law: These Terms are governed by the laws of England and Wales and any matter relating to these Terms is to be determined exclusively by the courts of England and Wales and any courts entitled to hear appeals from those courts.
- Illegal Requests: We reserve the right to refuse any request for or in relation to our Services that we deem inappropriate, unethical, unreasonable, illegal or otherwise non-compliant with these Terms.
- Marketing: You agree that we may send you electronic communications about our products and services in accordance with the Privacy and Electronic Communications (EC Directive) Regulations 2003 and applicable data protection laws. You may opt-out at any time by using the unsubscribe function in our electronic communications.
- Nature of Legal Relationship: These Terms do not create, and should not be interpreted so as to create, a partnership, joint venture, employment or agency relationship between us and you.
- Notices: Any notice you send to us must be sent to support@custodianlabs.io. Any notice we send to you will be sent to the email address registered against your Account.
- Publicity: You agree that, subject to your prior written consent, we may advertise or publicise the fact you are a customer of ours, for example on our website or in our promotional material, and you grant us a right to display and use your logo and branding solely for that purpose.
- Survival: Clauses 8 to 11 will survive the termination or expiry of these Terms.
- Third Party Sites: Our Platform may contain links to websites operated by third parties. Unless we tell you otherwise, we do not control, endorse or approve, and are not responsible for, the content on those websites. We recommend that you make your own investigations in relation to the suitability of those websites. If you purchase goods or services from a third party website linked from our Platform, those goods or services are being provided by that third party, not us. We may receive a benefit (which may include a referral fee or a commission) should you visit certain third party websites through a link on our Platform, or for featuring certain goods or services on our Platform. We will make it clear by notice to you which (if any) goods or services, or website links, we receive a benefit from by featuring them on our Platform.
13. Definitions
In these Terms:
- Account
- means an account accessible to the individual or entity who signed up to our Services.
- Consequential Loss
- includes any consequential loss, special or indirect loss, real or anticipated loss of profit, loss of benefit, loss of revenue, loss of business, loss of goodwill, loss of opportunity, loss of savings, loss of reputation, loss of use and/or loss or corruption of data, and any regulatory fines, penalties, or costs arising from a notifiable data breach under the UK GDPR and/or by the Information Commissioner's Office, whether under statute, contract, equity, tort (including negligence), indemnity or otherwise. However, your obligation to pay us any amounts for access to or use of our Services (including our Platform) will not constitute "Consequential Loss".
- Custom Enterprise
- means the bespoke Subscription tier available on application, the features, limitations and pricing of which are agreed between us and you separately.
- End Users
- means any person who interacts with a chatbot or application built or deployed by you using our Services.
- Free Tier
- means the no-cost Subscription tier subject to the usage limits set out on our Platform.
- Insider Tier
- means the paid Subscription tier as described on our Platform.
- Liability
- means any expense, cost, liability, loss, damage, claim, notice, entitlement, investigation, demand, proceeding or judgment (whether under statute, contract, equity, tort (including negligence), indemnity or otherwise), howsoever arising, whether direct or indirect and/or whether present, unascertained, future or contingent and whether involving a third party or us or you or otherwise.
- Moral Rights
- has the meaning given in Chapter IV of the Copyright, Designs and Patent Act 1988 and includes any similar rights in any jurisdiction in the world.
- Personal Data
- has the meaning given to "personal data" in the UK GDPR and the Data Protection Act 2018.
- Platform
- means our cloud-based platform, available here and via GitHub.
- Services
- means the services we provide to you, as detailed in clause 2.1.
- Subscription
- means the Subscription plan you have chosen through our Platform, which you use to access certain features and benefits.
- Subscription Fees
- means the fees you pay to us to access your chosen Subscription.
- Subscription Period
- means the duration of your Subscription (such as monthly, annually, or as otherwise set out on our Platform).
- Your Data
- means the information, materials, logos, documents, qualifications and other intellectual property or data supplied by you when receiving our Services or stored by or generated by your use of our Services, including any Personal Data collected, used, disclosed, stored or otherwise handled in connection with our Services. Your Data does not include any data or information that is generated as a result of your usage of our Services that is a back-end or internal output or an output otherwise generally not available to users of our Services.
Data Processing Addendum (DPA)
1. Roles of the Parties
- In connection with the Services, we are processing Personal Data on your behalf.
- Each Party agrees to comply with the Data Protection Law in the Processing of Transferred Data.
2. Processing of Personal Data
- You instruct us to process Transferred Data in accordance with this Data Processing Addendum (including in accordance with Attachment A).
- We agree not to process Transferred Data other than on your documented instructions.
- We agree to take reasonable steps to ensure the reliability of any of our Personnel who may have access to the Transferred Data, ensuring in each case that:
- access is strictly limited to those Personnel who need to know or access the relevant Transferred Data, as strictly necessary in connection with the Services; and
- the relevant Personnel are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
3. Security
- Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we agree to implement appropriate technical and organisational measures in relation to the Transferred Data to ensure a level of security appropriate to that risk in accordance with the Data Protection Law.
- In assessing the appropriate level of security, we agree to take into account the risks that are presented by Processing, in particular from a Personal Data Breach.
4. Sub-Processing
- You authorise our engagement of the Sub-Processors already engaged by us at the Commencement Date, which are set out in Attachment B.
- Where we wish to engage a new Sub-Processor, we agree to provide written notice to you of the details of the engagement of the Sub-Processor at least 14 days' prior to engaging the new Sub-Processor (including details of the processing it will perform). You may object in writing to our appointment of a new Sub-Processor within 7 days of such notice, provided that such objection is based on reasonable grounds relating to data protection. In such event, the Parties will discuss such concerns in good faith with a view to achieving resolution. If the Parties are not able to achieve resolution, we may, at our election:
- not appoint the proposed Sub-Processor;
- not disclose any Transferred Data we process on your behalf to the proposed Sub-Processor; or
- terminate the Services (and the Agreement) for convenience, in which case, clause 11.4 of the Agreement will apply.
- You agree that the remedies described above are the only outcomes available if you object to our engagement of any proposed Sub-Processor.
- Where we engage a Sub-Processor to process Transferred Data, we agree to enter into a written agreement with the Sub-Processor containing data protection obligations no less protective that those in this Data Processing Addendum with respect to the Transferred Data, and to remain responsible to you for the performance of such Sub-Processor's data protection obligations under such terms.
- Where the transfer of Transferred Data from us to a Sub-Processor is a Restricted Transfer, it will be subject to the UK Transfer Mechanism (and documents or legislation referred to within it), which shall be deemed to be incorporated into this Data Processing Addendum, and the UK Transfer Mechanism is considered an appropriate safeguard.
5. Data Subject Rights
- Taking into account the nature of the Processing, we agree to assist you by implementing appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of your obligations, as reasonably understood by you, to respond to requests from Data Subject to exercise their rights under the Data Protection Law.
- We agree to:
- promptly notify you if we receive a request from a Data Subject under the Data Protection Law in respect of Transferred Data; and
- ensure that we do not respond to that request except on your documented instructions or as required by the Data Protection Law, in which case we shall, to the extent permitted by the Data Protection Law, inform you of that legal requirement before we (or our Sub-Processor) respond to the request.
6. Personal Data Breach
- We agree to notify you without undue delay upon becoming aware of a Personal Data Breach affecting Transferred Data, and to provide you with sufficient information to allow you to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Law.
- We agree to co-operate with you and take reasonable commercial steps as directed by you to assist in the investigation, mitigation and remediation of each such Personal Data Breach.
- If you decide to notify a Supervisory Authority, Data Subjects or the public of a Personal Data Breach, you agree to provide us with advance copies of the proposed notices and, subject to the Data Protection Law (including any mandated deadlines under it), allow us an opportunity to provide any clarifications or corrections to those notices.
7. Data Protection Impact Assessment and Prior Consultation
- We agree to provide reasonable assistance to you, at your cost (to be charged on a reasonable time and materials basis), with any data protection impact assessments, and prior consultations with Supervisory Authorities or other competent data privacy authorities, which you reasonably consider to be required by the Data Protection Law or any other data protection laws.
8. Deletion or Return of Personal Data
- Subject to any document retention requirements at law, we agree to promptly and in any event within 30 business days of the date of cessation of any Services involving the Processing of Transferred Data, delete and procure the deletion of all copies of those Transferred Data.
9. Audit Rights
- Subject to this clause 9, where required by the Data Protection Law, we shall make available to you on request all information reasonably necessary to demonstrate compliance with this Data Processing Addendum, and shall allow for and contribute to audits, including inspections, by you or an auditor mandated by you in relation to the Processing of Transferred Personal Data by us.
- Where clause 9.1 applies, any audit (or inspection):
- must be conducted during our regular business hours, with reasonable advance notice (which shall not be less than 30 business days);
- will be subject to our reasonable confidentiality procedures;
- must be limited in scope to matters specific to you and agreed in advance with us;
- must not require us to disclose to you any information that could cause us to breach any of our obligations under the Data Protection Law;
- to the extent we need to expend time to assist you with the audit (or inspection), this will be funded by you, in accordance with pre-agreed rates; and
- may only be requested by you a maximum of one time per year, except where required by a competent Supervisory Authority or where there has been a Personal Data Breach in relation to Transferred Personal Data, caused by us.
10. Definitions
- In this Data Processing Addendum, capitalised terms have the meaning given to them in the main body of the Terms, and as follows:
- Data Protection Law
- means the United Kingdom Data Protection Act 2018 and the EU GDPR as incorporated into United Kingdom law by virtue of Section 3 of the United Kingdom's European Union (Withdrawal) Act 2018.
- Restricted Transfer
- means a transfer of Personal Data from the United Kingdom to any other country which is not subject to adequacy regulations pursuant to the Data Protection Law.
- Transferred Data
- means any Personal Data that is Processed by us on your behalf in connection with the Services.
- UK Transfer Mechanism
- means the legal methods and safeguards permitted under the Data Protection Law for dealing with Restricted Transfers, including adequacy decisions, standard contractual clauses, binding corporate rules, and other appropriate safeguards as recognised under the Data Protection Law.
- The terms, "Data Subject", "Personal Data", "Personal Data Breach", "Processing" (including "Processed") and "Sub-Processor" shall have the same meaning as in the Data Protection Law.
Attachment A — Description of Transfer
Select all that apply:
Other: _______________________________________________
Select one:
Select all that apply:
Other: _______________________________
Attachment B — List of sub-processors
List of Sub-Processors
| Sub-Processor Name | Location | Purpose/Services | Website & Contact Details |
|---|---|---|---|
| Stripe, Inc. | United States | Provide payment processing |
https://support.stripe.com/ privacy@stripe.com |
| Supabase Pte. Ltd. | Singapore | Cloud database hosting |
https://supabase.com/privacy privacy@supabase.com |
| Amazon Web Services | United States | Cloud service provider |
https://aws.amazon.com/privacy/ https://console.aws.amazon.com/support/home |
| Google LLC (Google Analytics) | United States | Website traffic measurement, usage analytics and performance reporting |
https://policies.google.com/privacy https://support.google.com/analytics/ |
| Webflow, Inc. | United States | Website hosting, content management and website infrastructure |
https://webflow.com/legal/privacy privacy@webflow.com |