Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the inkscroll Employer Terms and Conditions (the “Terms”) between inkscroll Limited (“inkscroll”, “we”, “us”) and the Employer (“you”). It applies whenever we process personal data on your behalf in providing the App to you. Terms defined in the Terms have the same meaning in this DPA.

This DPA was most recently updated on: 25 September 2026

1. Roles

1.1 For the Employer Personal Data described in Schedule 1, you are the controller and we are your processor.

1.2 This DPA does not apply to personal data we control ourselves, including Members’ own accounts and the information in them, and the account and billing details of your users. We process that data as described in our Privacy Policy. Where a Member chooses to share information with your teams, you become a controller of the information you receive, as set out in Clause 6 of the Terms.

2. Definitions

“Data Protection Legislation” has the meaning given in Clause 6 of the Terms.

“Employer Personal Data” means the personal data described in Schedule 1 that we process on your behalf.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Employer Personal Data.

“Sub-processor” means any third party we engage to process Employer Personal Data.

“controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in the Data Protection Legislation.

3. Your instructions

3.1 We will process Employer Personal Data only on your documented instructions, unless the law requires otherwise. If it does, we will tell you before processing, unless the law prohibits us from doing so.

3.2 Your instructions are the Terms, this DPA, and your use and configuration of the App, including what you add, import, edit, share and delete. Any further instructions must be in writing and consistent with the Terms.

3.3 We will tell you promptly if we believe an instruction infringes the Data Protection Legislation.

4. Your obligations

4.1 You are responsible for:

  1. having a lawful basis for the Employer Personal Data you add to the App and for your instructions to us;
  2. giving data subjects any information the law requires, including that you use inkscroll;
  3. the accuracy of the Employer Personal Data; and
  4. not adding special category data (for example, health information or ethnicity) or criminal offence data to the App, unless a feature of the App is expressly designed for that data and you have a lawful basis for it.

5. Our obligations

5.1 Confidentiality. We will ensure that everyone we authorise to process Employer Personal Data is bound by a duty of confidentiality.

5.2 Security. We will take the technical and organisational measures set out in Schedule 2 to protect Employer Personal Data. We may update those measures, provided we do not reduce the overall level of protection.

5.3 Data subject requests. If we receive a request from a data subject about Employer Personal Data, we will pass it to you without undue delay and will not respond ourselves except to direct the data subject to you. Taking into account the nature of the processing, we will give you reasonable help to respond, including through the App’s own tools for viewing, editing, exporting and deleting data.

5.4 Other assistance. Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your obligations on security, Personal Data Breach notification, data protection impact assessments and prior consultation with a supervisory authority.

5.5 Personal Data Breaches. We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Employer Personal Data. We will give you the information you reasonably need to meet your own reporting obligations as it becomes available, and will take reasonable steps to contain and remedy the breach.

5.6 Records. We will keep the records of processing that the Data Protection Legislation requires of a processor.

6. Sub-processors

6.1 You give us general authorisation to engage Sub-processors. Our current Sub-processors are listed in Schedule 3.

6.2 We will give you at least 30 days’ notice of any new or replacement Sub-processor, by email to your account owner or by updating Schedule 3 and notifying you in the App. You may object on reasonable data protection grounds within that period. If we cannot reasonably address your objection, you may terminate the affected services by written notice, and we will refund any fees you have prepaid for the period after termination.

6.3 We will impose data protection obligations on each Sub-processor that are no less protective than those in this DPA. We remain liable to you for each Sub-processor’s performance of those obligations.

7. International transfers

7.1 Employer Personal Data is hosted in the United Kingdom. Some Sub-processors may process it outside the UK, as shown in Schedule 3.

7.2 We will only transfer Employer Personal Data outside the UK to a country covered by UK adequacy regulations, or where appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.

8. Deletion and return

8.1 While your Account is active, you can export and delete Employer Personal Data using the App.

8.2 Within 30 days after your Account or plan ends, we will delete the Employer Personal Data, unless the law requires us to keep it. You may ask us in writing, before your Account ends, to provide an export first.

8.3 Deleted data may remain in our encrypted backups for up to 35 days until those backups are overwritten in the normal cycle. During that time we will not restore or use it, except to recover from a system failure.

9. Audits

9.1 We will make available to you the information reasonably necessary to demonstrate our compliance with this DPA, including by answering a reasonable security questionnaire once a year.

9.2 Where that information is not enough to demonstrate compliance, or a supervisory authority requires it, we will allow an audit by you or an independent auditor you appoint. The auditor must be bound by confidentiality. You must give at least 30 days’ written notice, the audit must take place during business hours and no more than once a year, and it is at your cost.

10. General

10.1 Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except where the law does not allow liability to be limited.

10.2 This DPA lasts for as long as we process Employer Personal Data on your behalf.

10.3 If this DPA conflicts with the Terms on a matter of data protection, this DPA prevails.

10.4 This DPA is governed by the law of England and Wales, and the English courts have exclusive jurisdiction, as set out in the Terms.

Schedule 1: Details of processing

Subject matter and purpose: providing the App to you, including your company account, teams, staff list, development and reporting features, workforce planning, job listings and applications, hiring contacts and coaching features.

Duration: for as long as you use the App, and then as set out in Clause 8.

Nature of processing: storing, organising, displaying, matching, reporting on, sending emails about, backing up and deleting.

Data subjects:

  • your staff, volunteers and other workers;
  • people in your cohort and coaching teams;
  • hiring contacts and other people you name in the App; and
  • your users who are not otherwise Members.

Categories of personal data:

  • Staff list: name, work email, job title, department, division, group, manager, work base and country, employment type and employing entity, start and end dates, cost centre, position reference, status, and any notes you add.
  • Hiring contacts: name, job title, email, telephone and LinkedIn profile.
  • Notes, goals, actions and coaching session notes that you or your users write in the App about the people above.
  • Workforce planning records that name individuals.

Special category data: none intended (see Clause 4.1(d)).

Schedule 2: Security measures

  • Encryption of all data in transit (HTTPS with HSTS).
  • Hosting on a professionally managed cloud provider, with firewalled servers and regular security updates.
  • Role-based access in the App, so that company data is visible only to that company’s users with the right role.
  • Hashed passwords, login rate limiting and protection against automated abuse.
  • Staff access to production systems limited to named individuals who need it, using key-based authentication.
  • Regular encrypted backups.
  • Logging of administrative and security events.
  • A documented process for handling Personal Data Breaches.

Schedule 3: Sub-processors

Sub-processor Purpose Location
DigitalOcean, LLC Hosting, storage and backups United Kingdom (London), with a US parent company
Twilio Inc. (SendGrid) Sending emails United States