Draft, not legal advice. Product-specific wording to merge into the FSB member templates before launch (see README.md). Last updated: 20 October 2026 (draft)

PaidStraight data processing agreement

This agreement is between the business that uses PaidStraight ("you", the controller) and [OPERATOR LEGAL NAME], [REGISTERED ADDRESS] ("we", the processor). It forms part of the PaidStraight terms of service and applies automatically when you accept them. It meets the requirements of Article 28 of the UK GDPR.

If this agreement and the terms of service conflict on data protection, this agreement wins.

1. Definitions

Words such as "controller", "processor", "personal data", "personal data breach", "processing" and "data subject" have the meanings in the UK GDPR and the Data Protection Act 2018 ("data protection law"). "Client data" means the personal data described in section 2 that you put into PaidStraight.

2. Details of the processing

Subject matter	Sending reminders and preparing letter templates about unpaid invoices, on your instructions, through PaidStraight.
Duration	While your account is active, plus up to 90 days after your trial or subscription ends, plus up to 8 weeks in backups (see section 11).
Nature	Collecting (by your entry or CSV import), storing, organising, encrypting, displaying, using to fill templates, sending by email, generating PDFs, exporting and deleting.
Purpose	Helping you get paid for your own invoices by sending messages and preparing documents in your business name.
Data subjects	Your clients and their contacts: sole traders, partners, directors, staff and other individuals at your client businesses, and consumer clients you chase with polite reminders.
Categories of data	Name; business name; email address; postal address; phone number; invoice numbers, dates, amounts and status; payment history you record; the content, date and delivery status of emails sent; notes you add; replies your clients send to reminders; letter templates generated.
Special category or criminal data	None intended. You must not add it. Free-text notes must not contain health, criminal or other special category data.

3. Your instructions

1. We process client data only on your documented instructions. These terms, your settings and your actions in PaidStraight (for example, starting a sequence or approving a letter) are your instructions.
2. If the law requires us to process client data in another way, we will tell you first, unless the law forbids that.
3. We will tell you if we think an instruction breaks data protection law.

4. Your responsibilities

You confirm that:

• you have a lawful basis to give us the client data and for us to process it for you;
• you have told your clients, in your own privacy information, how you use their data, including that you use software providers to send reminders;
• the client data is accurate, and you will correct it when it changes;
• you will not ask us to process data in a way that breaks data protection law, PECR or our acceptable use policy.

5. Our obligations

We will:

1. keep client data confidential, and make sure everyone we authorise to process it is under a duty of confidence;
2. take the security measures in section 7;
3. only use sub-processors as set out in section 8;
4. help you, as far as reasonably possible, to respond to requests from data subjects (section 9);
5. help you meet your duties on security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the nature of the processing and the information we have;
6. delete or return client data at the end, as set out in section 11;
7. give you the information you reasonably need to show you and we are meeting Article 28, and allow audits (section 12);
8. not use client data for our own purposes, including marketing. We will never email your clients about PaidStraight.

6. Confidentiality of staff

Only the operator, and any staff or contractors who need access to run or support the service, can access client data. Each is bound by confidentiality. Support access to an account's data is only used to fix a problem you have reported, or to investigate abuse or a security incident.

7. Security measures

Taking into account the risks, we will keep at least these measures in place:

• Encryption at rest. Client names, email addresses, postal addresses and phone numbers are encrypted at field level in our database. The database and backups also sit on encrypted managed storage.
• Encryption in transit. All connections to PaidStraight, to our database and to our email provider use TLS.
• Access control. Each account sees only its own data; every query is scoped to the signed-in user's organisation. Production access is limited to the operator, uses strong unique credentials and multi-factor authentication where the provider supports it. Secrets are stored encrypted, not in source code.
• Backups and recovery. Daily backups with point-in-time recovery over 7 days, plus weekly encrypted backups kept for 8 weeks. We test a restore at least every quarter.
• Application security. Passwords are stored as salted hashes. Forms are protected against cross-site request forgery. Error reports are configured not to send personal data where possible.
• Sending controls. Non-production systems cannot send to real addresses. Bounces and complaints are recorded and stop further sending to that address.
• Review. We review these measures at least once a year and after any incident.

[OWNER TO CONFIRM each measure is in place before launch, especially MFA on all provider accounts and quarterly restore tests.]

8. Sub-processors

You give general authorisation for us to use these sub-processors:

Sub-processor	Service	Location of client data
DigitalOcean, LLC	Hosting and managed database	London, UK
Amazon Web Services (Amazon SES)	Email delivery	London, UK
Functional Software, Inc. (Sentry)	Error monitoring; client data only if it appears in an error	EU (Frankfurt)

Paddle is not a sub-processor for client data. It never receives your clients' data.

We will:

• impose data protection terms on each sub-processor that give the same protection as this agreement;
• remain responsible to you for each sub-processor's work;
• give you at least 30 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data protection grounds, we will discuss it with you. If we cannot resolve it, you may cancel and we will refund any prepaid fees for the period after cancellation.

9. Data subject requests

If one of your clients contacts us to use their data protection rights, we will pass the request to you within 5 working days and will not respond to it ourselves, except to say we have passed it on. You can answer most requests yourself in PaidStraight: view, correct, export or delete the client and their invoices. If you need more help, for example a search of email logs, we will provide it within a reasonable time.

10. Personal data breaches

1. If we become aware of a personal data breach affecting client data, we will tell you without undue delay and in any case within 48 hours.
2. We will tell you what we know: what happened, the data and approximate number of people affected, likely consequences, and what we have done or plan to do. If we do not know everything yet, we will send what we have and update you as we learn more.
3. We will help you decide whether to notify the ICO (within 72 hours of you becoming aware) and the people affected, and we will take reasonable steps to contain the breach.
4. Telling you about a breach is not an admission of fault.

11. Deletion or return at the end

• You can export client data as CSV at any time.
• After your trial or subscription ends, we keep client data for 90 days so you can export it or come back. Then we delete it from the live system.
• Copies in backups are overwritten within 8 weeks after that. We will not restore them except to recover from a fault, and if that happens we will delete the restored client data again.
• If you ask us to delete your account sooner, we will do so within 30 days.
• We may keep client data longer only if the law requires it. In that case this agreement continues to protect it.

12. Information and audits

We will give you the information you reasonably need to show compliance with Article 28. This will usually be a written answer to a reasonable questionnaire, once a year. If that is not enough, or the ICO requires it, you may audit us, or appoint an independent auditor bound by confidentiality, with at least 30 days' notice, during working hours, at your cost, and no more than once a year unless there has been a breach.

13. International transfers

We store and process client data in the UK. Sentry error reports are stored in the EU, which the UK treats as adequate. Some providers are owned by US companies and could access data from outside the UK, for example for support. Where any transfer of client data outside the UK takes place, we will make sure it is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified) or by the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with a transfer risk assessment.

[OWNER TO CONFIRM: each provider's DPA and its transfer safeguard. Solicitor to confirm: whether the Data (Use and Access) Act 2025 changes to UK transfer rules need any change to this wording.]

14. Liability

Each party's liability under this agreement is subject to the limits in the terms of service, except where data protection law does not allow liability to be limited. [Solicitor to confirm: whether the general cap should apply to data protection claims.]

15. Term

This agreement lasts as long as we process client data for you, including the retention periods in section 11.

16. Governing law

As in the terms of service.