Data Processing Agreement.

Headline terms

• Roles. Your firm is the data controller. ParaplanAI is the data processor.
• Purpose limitation. We process client personal data only to provide the calculator + audit-trail service you have subscribed to. No client-data analytics, no AI training, no resale.
• Sub-processors. The current list is in /privacy §4. We notify you 30 days before adding any new sub-processor; you can object.
• Security. AES-256 at rest, encrypted in transit (TLS 1.2 or higher), RLS on every tenant-scoped table. See /security.
• Retention. Uploaded source PDFs are scheduled for deletion after 24 hours; hourly cleanup retries failed removals. Unconfirmed extracted content has a 90-day window, raw extraction responses a 30-day window, and confirmed content follows your firm's retention window from confirmation. As controller, you set how long filed calculations and their annexes are kept (six years by default). Client and calculation deletion require confirmation and the appropriate access; policies can be archived while preserving history. Unfiled calculations have a 90-day window, and draft PDF copies normally have a 30-day window. See /data-minimisation.
• International transfers. We do not transfer client personal data outside the UK / EU. Document extraction and PDF rendering are processed in-region; only billing data reaches our international payments processor. Our hosting provider (Vercel, /privacy §4) runs the application in London, but its global edge network routes each request, and serves static files, from the edge location nearest the visitor, so a request made from outside the UK / EU passes through an edge location outside it. Vercel stores no client data at rest. See /privacy §2.3 + §5.
• Breach notification. As processor, we notify the affected controller without undue delay and support its Article 33 assessment. For account data where we are controller, we notify the ICO within 72 hours where legally required.
• Information and audits. We will give you the information needed to assess our compliance with Article 28 and cooperate with audits and inspections, carried out at the firm's cost, by the relevant controller or its appointed auditor. Where you act as a processor, we will support those rights through the agreed controller–processor chain. We may first provide relevant existing assurance material, such as a completed security questionnaire and our sub-processors' DPAs and certifications, but it does not replace an audit where further work is needed. Reasonable arrangements for notice, confidentiality, security and other customers' data must not prevent the exercise of these rights or urgent regulatory requests. We will tell you promptly if we consider an instruction unlawful under applicable data-protection law.
• Return / deletion on termination. We return or delete your firm's client data on your instruction (UK GDPR Art 28), as Terms §11 sets out — you decide. The firm owner can export the calculation audit trail (JSON Lines) from firm settings at any time, and can delete the whole firm from Settings → Firm → Danger zone. Client records are removed when that request is accepted and uploaded and annex files are queued for erasure. Policy records, including their encrypted plan numbers and beneficiary names, are removed at the same time, including policies not linked to a client. Calculation audit records, which identify a client only by an anonymised reference, are not removed by that request: finalised calculations follow your firm's retention window and unfinalised drafts are deleted 90 days after they were created. Until you instruct us, nothing is deleted because a subscription ends: your firm's records stay in its account on the Free plan and the retention schedule below keeps applying, so finalised calculations are deleted at the end of your firm's retention window (six years by default). See /privacy §6.

Retention schedule

The numbers below are the operative retention horizons for personal data your firm passes to ParaplanAI. They are the same numbers documented in /privacy §6 and /data-minimisation — single source of truth across the three pages.

See the data-minimisation page → /data-minimisation.

Execution copy

The execution copy is being held from launch until solicitor review is complete and the operator’s legal name and service address are included. To request the approved version when available, email info@paraplanai.co.uk with your firm name and primary contact. Do not treat this summary as a signed contract or begin uploading identifiable client data in the meantime.

If your firm requires our DPA to be cross-signed onto your standard supplier contract instead, reply to the email above with your template attached and we'll review within 5 business days.

See also

• /privacy → — controller-side personal data, retention, sub-processors
• /data-minimisation → — what we hold and why, what the calc engine never reads, and how long for
• /terms → — commercial terms, liability cap, billing
• /security → — controls + breach-notification commitment