Data Processing Agreement

• “Controller” means the customer organisation that determines the purposes and means of processing personal data via the Evidencee platform.
• “Processor” means EVIDENCEE DMCC Ltd, which processes personal data on behalf of the Controller.
• “Personal Data” has the meaning given in UK GDPR Article 4.
• “Processing” has the meaning given in UK GDPR Article 4.
• “Sub-processor” means any third party engaged by the Processor to process Personal Data on the Controller's behalf.

The Processor provides a compliance management platform. In connection with this, the Processor processes personal data to:

• Manage user accounts and workspace access
• Record and store compliance evidence events ingested from integrated platforms (Shopify, Stripe, GoCardless)
• Operate notice automation, cancellation management, and cooling-off case workflows
• Generate audit bundle exports
• Provide platform analytics and reporting to the Controller

Data subjects:

• The Controller's team members and users of the Evidencee platform
• The Controller's end-user subscribers (whose email addresses and subscription details reach Evidencee through platform webhooks and the hosted cancellation page)

Categories of personal data:

• Identity data: name, email address
• Authentication data: hashed passwords, session tokens
• Subscriber event data: keyed SHA-256 (HMAC) subscriber identifiers, subscription IDs, event timestamps, and event types
• Subscriber contact data: email addresses, stored encrypted (AES-256-GCM), where needed to send reminders, confirmations and cancellation links
• Hosted cancellation data: the IP address and browser user-agent of a subscriber who cancels through a hosted cancellation page
• Communication data: notice delivery logs

Note: in the Evidence Vault, subscribers are identified by a keyed hash, never by name or email address. Outside the vault, a subscriber's email address is stored only encrypted, and only where Evidencee needs it to send a reminder, a confirmation or a cancellation link.

The Processor shall process Personal Data only on documented instructions from the Controller, including those set out in this DPA and the Terms of Service. If the Processor is required by applicable law to process Personal Data beyond those instructions, it shall inform the Controller unless prohibited by law.

The Processor shall:

• Process Personal Data only for the purposes described in this DPA
• Ensure persons authorised to process Personal Data are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures (Article 32 UK GDPR)
• Assist the Controller in responding to data subject rights requests
• Assist with security obligations, breach notifications, DPIAs, and prior consultations
• Delete or return Personal Data upon termination per Section 9
• Make available all information necessary to demonstrate compliance

The Processor implements the following technical and organisational measures:

• Encryption in transit (HTTPS/TLS), provided by the hosting platform (Vercel), and encryption of the database at rest (AES-256), provided by the database host (Supabase)
• Field-level encryption by the Processor itself (AES-256-GCM) of subscriber email addresses, payment-platform access tokens and webhook secrets, and multi-factor authentication secrets
• SHA-256 payload hashing and a continuous hash chain for evidence integrity
• Role-based access control within workspaces
• Multi-factor authentication support
• Regular backups with point-in-time recovery
• Vulnerability scanning and penetration testing
• Incident response and breach notification procedures
• Employee security training and background checks

The Controller authorises the Processor to engage the following named sub-processors. Each sub-processor is bound by a written data-processing agreement that imposes obligations no less protective than those in this DPA.

The Processor will give the Controller at least 30 days' notice of any addition, removal, or replacement of a sub-processor. Controllers may subscribe to notifications by emailing privacy@evidencee.com. The Controller may object in writing within the notice period; if the objection cannot be resolved, either party may terminate the affected service.

The Processor shall notify the Controller without undue delay (and in any case within 72 hours of becoming aware) of a Personal Data breach affecting the Controller's data. The notification shall include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

Upon termination of the Terms of Service, the Processor shall, at the Controller's choice, delete or return all Personal Data and delete existing copies, unless applicable law requires storage of the Personal Data. The Controller may request a data export for 90 days following termination.

The Processor shall provide all information necessary to demonstrate compliance with this DPA and permit audits, including inspections, conducted by the Controller or its mandated auditors, subject to reasonable notice (minimum 30 days) and confidentiality obligations.

For data processing queries: privacy@evidencee.com