Data Processing Agreement

This page is the publishable version of ClauseClear’s standard DPA. It is legally binding when (a) executed by both parties via electronic signature, or (b) incorporated by reference into the Customer’s Master Services Agreement (MSA) or Order Form.

Self-serve customers (Starter / Pro tiers) accept this DPA by reference when they tick the consent box at /onboarding and accept the Terms of Service. Enterprise customers receive a counter-signed copy as part of their MSA package.

For a Word / PDF copy ready for your legal team to mark up, email hello@clauseclear.co.uk.

Processor: PJ Consulting Group Ltd, trading as ClauseClear, a company registered in England & Wales under company number 13298258; ICO data-protection fee registration number 00014050667 (“ClauseClear”, the “Processor”). The Processor’s registered office and full notice address will be inserted into the signed copy of this DPA when executed with a specific Customer.

Controller: The customer entity identified in the applicable Order Form, MSA, or self-serve account (the “Customer”, the “Controller”).

Unless otherwise defined here, capitalised terms have the meaning given to them in the UK GDPR and the UK Data Protection Act 2018 (together, the “Data Protection Laws”).

• “Affiliate” means an entity that controls, is controlled by, or is under common control with a party.
• “Customer Data” means Personal Data that ClauseClear processes on behalf of the Customer in connection with the Services.
• “Personal Data Breach” has the meaning given in Article 4(12) UK GDPR.
• “Services” means the ClauseClear platform, including Terms & Conditions audits, the Simpler Terms translator, the verified badge, change-detection monitoring, and any related functionality made available under the Customer’s subscription.
• “Subprocessor” means any third party engaged by ClauseClear to process Customer Data on its behalf.

The subject matter, duration, nature, purpose, types of Personal Data and categories of data subjects are described in Annex 1. ClauseClear will process Customer Data only:

• for the purposes set out in Annex 1 and in accordance with the documented instructions of the Customer (which include the MSA, Order Form, this DPA, and any subsequent written instructions); and
• where processing is required by UK or EU law applicable to ClauseClear, in which case ClauseClear will inform the Customer of that legal requirement before processing, unless the law prohibits such notification.

ClauseClear will ensure that any person it authorises to process the Customer Data (including employees, contractors and Subprocessors) is bound by an appropriate obligation of confidentiality, whether by contract or statutory duty.

ClauseClear will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including those specified in Annex 3. The current operational measures are also published at /security and may be updated from time to time, provided the level of protection is not materially decreased.

The majority of ClauseClear’s processing takes place within the UK and EEA. Where Customer Data is transferred outside the UK to a country not covered by an adequacy decision, ClauseClear ensures an appropriate transfer mechanism is in place, including:

• the UK International Data Transfer Agreement (IDTA) issued by the ICO; or
• the UK Addendum to the EU Standard Contractual Clauses; or
• another mechanism approved by the ICO from time to time.

The current Subprocessor that requires a transfer mechanism is Anthropic PBC (United States), used for AI inference. The IDTA between ClauseClear and Anthropic is on file and available on reasonable request.

ClauseClear will notify the Customer of any Personal Data Breach affecting Customer Data without undue delay, and in any event within 48 hours of becoming aware of it. The notification will include, to the extent then known:

• the nature of the breach, including categories and approximate numbers of data subjects and Personal Data records affected;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and mitigate its adverse effects; and
• contact details for further information.

ClauseClear will reasonably assist the Customer in fulfilling its own breach notification obligations to the ICO and to affected data subjects.

ClauseClear will, taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as practicable, in fulfilling the Customer’s obligation to respond to requests for the exercise of data subject rights under Chapter III UK GDPR.

Where ClauseClear receives a data-subject request that relates to Customer Data, ClauseClear will not respond to the data subject directly except to confirm that the request has been forwarded to the Customer. ClauseClear will forward the request to the Customer within 5 working days of receipt.

ClauseClear will, taking into account the nature of the processing and the information available to it, reasonably assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 UK GDPR (security, breach notification, data protection impact assessments, prior consultation).

On termination of the Services, the Customer may instruct ClauseClear, within 30 days, to either: (a) return all Customer Data in a commonly used machine-readable format; or (b) delete all Customer Data from ClauseClear’s active systems. In the absence of an instruction within that 30-day period, ClauseClear will delete the Customer Data.

Backups containing Customer Data will be deleted in the normal course of ClauseClear’s backup cycle, which is no longer than 90 days after deletion from active systems. ClauseClear may retain Customer Data to the extent required by law, in which case it will continue to apply the technical and organisational measures of this DPA for the period of retention.

The liability of each party under or in connection with this DPA is governed by the liability provisions of the MSA or, for self-serve customers, the Terms of Service. Nothing in this DPA limits or excludes any liability that cannot be limited or excluded by law (including liability for personal injury caused by negligence or fraud).

In the event of a conflict between this DPA and any other agreement between the parties, this DPA prevails to the extent of the conflict, in respect of the subject matter of this DPA. If any provision of this DPA is held unenforceable, the remainder will continue in full force and effect.

This DPA is governed by the laws of England and Wales. The English courts have exclusive jurisdiction over any dispute arising out of or in connection with this DPA, save that either party may seek injunctive or equitable relief in any court of competent jurisdiction to protect Personal Data or enforce its rights under this DPA.

The current list of Subprocessors is maintained at /subprocessors. As at the “Last updated” date of this DPA, the approved Subprocessors are:

• Vercel Inc. — web hosting, edge CDN, serverless function execution — EU primary, global edge.
• Supabase Inc. — database, authentication, RLS — Frankfurt, Germany.
• Anthropic PBC — AI inference for the Simpler Terms translator — United States and United Kingdom (UK IDTA in place).
• Resend Inc. — transactional email delivery — Ireland (EU).
• GoDaddy.com LLC — domain registrar and DNS hosting (no user data) — United Kingdom.
• Microsoft Corporation — inbound email at clauseclear.co.uk via Microsoft 365; SSO sign-in option — European Union.
• Google LLC — SSO sign-in option (Google OAuth) — global, with EU residency.

The full operational description of ClauseClear’s security measures is published at /security and is incorporated by reference. The minimum measures applied to Customer Data are:

• Encryption in transit: TLS 1.2 or higher on all public endpoints; HSTS enforced on the production domain.
• Encryption at rest: AES-256 on the production database and on backups; encryption-at-rest of secrets stored in the deployment platform.
• Access control: role-based access; named-allowlist for administrative access; per-tenant isolation enforced by Postgres row-level security.
• Authentication: SSO-only (Google or Microsoft) for administrative access; passwords are not stored by ClauseClear.
• Backup and recovery: daily automated database backups; recovery time objective ≤ 4 hours; recovery point objective ≤ 24 hours.
• Vulnerability management: automated dependency scanning on every deploy; critical patches applied within 24 hours of disclosure where practicable.
• Incident response: documented breach-notification procedure including ICO and affected-data-subject notification within statutory windows.
• Personnel: all ClauseClear personnel and authorised contractors are bound by written confidentiality obligations.

Additional or stricter measures may be agreed in the Order Form for Enterprise customers (e.g. dedicated VPC, customer-managed keys, named-individual access logging).

For Enterprise execution, this DPA is signed in counterpart by an authorised signatory of each party. For self-serve acceptance, the “I agree to Terms, Privacy Policy, and Cookie Policy” tickbox at /onboarding incorporates this DPA by reference and constitutes execution by the Customer.

For a counter-signable copy of this DPA in Word or PDF format, email hello@clauseclear.co.uk.