Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Customer Terms of Service between VectisFlow Limited and the Customer. It governs VectisFlow's processing of Customer Data as a processor on behalf of the Customer as controller, under UK GDPR, the Data Protection Act 2018, and applicable data protection laws.

1. Subject matter, duration, nature, and purpose

2. Categories of data subjects

• Agency staff (Authorised Users of the Customer)
• Contractors (end-users submitting timesheets)
• Clients and approvers of the Customer

3. Categories of personal data

• Identity data (name, email, phone number, date of birth)
• Authentication metadata
• Employment / engagement data (timesheet content, National Insurance numbers where supplied, engagement references, IR35 and AWR records)
• Gender and home address, for contractors engaged outside PAYE whose details the Customer must report to HMRC under the Employment Intermediaries Regulations
• Unique Taxpayer Reference, for contractors engaged as a self-employed sole trader or partner whose details the Customer must report to HMRC under the Employment Intermediaries Regulations
• Business data for contractors who invoice through a company or are VAT-registered (company name and number, VAT registration number, business address)
• Financial data (pay and charge rates, invoice line items)
• Approval and audit records
• Documents uploaded to the document vault

4. Roles of the parties

The Customer is the controller of Customer Data. VectisFlow Limited is the processor.

5. Processor obligations (Art. 28 UK GDPR)

VectisFlow will:

• Process Customer Data only on the documented instructions of the Customer, including in relation to international transfers, unless required to do so by law (in which case VectisFlow will inform the Customer unless the law prohibits);
• Ensure personnel processing Customer Data are subject to appropriate confidentiality obligations;
• Implement the technical and organisational measures described in Annex B;
• Engage sub-processors only in accordance with section 6;
• Taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures to respond to data subject rights requests;
• Assist the Customer with security, data protection impact assessments, and prior consultations;
• Notify the Customer without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Customer Data, so that the Customer can meet its own 72-hour notification obligation to the ICO under Art. 33 UK GDPR;
• At the Customer's choice, return or delete Customer Data on termination, subject to retention obligations set out in this DPA;
• Make available to the Customer all information necessary to demonstrate compliance with Art. 28 obligations.

6. Sub-processing

The Customer grants general written authorisation for VectisFlow to engage sub-processors, subject to:

• The list in Annex A remaining current;
• Written notice of any intended addition or replacement, at least 30 days in advance;
• The Customer's right to reasonably object to a proposed change, in which case the parties will discuss in good faith and, failing agreement, the Customer may terminate the affected parts of the Service.

VectisFlow will impose data protection obligations on each sub-processor that are equivalent to those in this DPA.

7. International transfers and data location

7.1 Where Customer Data is stored

Contractor and payroll data — timesheets, contracts, invoices, uploaded documents and identity fields — is stored in the United Kingdom and the European Economic Area:

7.2 Where processing occurs outside the UK/EEA

Most processing takes place in the United Kingdom and the European Economic Area, as set out in section 7.1. The main exceptions are:

• Clerk Inc. (United States) authenticates agency staff only. Contractors do not use Clerk; they sign in with a single-use link sent to their email address, so Clerk processes no contractor timesheets, pay rates, National Insurance numbers or documents.
• Inngest Inc. (United States) runs background jobs. Job data is encrypted before it leaves VectisFlow's systems, with a key held only by VectisFlow, so Inngest cannot read it. Job data is limited to internal record identifiers wherever the processing allows.
• Vercel AI Gateway (United States) and its model hosts (the United States; DeepInfra may also use Canada) process questions sent to the in-app AI support assistant — an optional, feature-flagged tool for signed-in agency staff only, grounded solely in Templio's own published help content. Routing is restricted to zero-data-retention providers outside mainland China; no prompt or response is used to train a model, and the assistant is never used for account-specific data, billing, or legal, tax, IR35 or AWR advice.
• Xero (outside the United Kingdom, primarily the United States) receives invoice data, including contractor and client names, when the Customer connects Xero. The transfer relies on the safeguards in Xero's data processing terms.

The other sub-processors that operate outside the UK and EEA receive only the limited data described against them in Annex A, such as a billing contact, a device push endpoint or an internal identifier.

Uploaded documents are stored only in the United Kingdom and are accessed only by the Customer's authorised users. The controls that apply to them are set out in Annex B.

7.3 Transfer mechanism

Where a sub-processor is located outside the United Kingdom and the transfer is not otherwise lawful under UK data protection law, transfers are made under the UK International Data Transfer Agreement ("IDTA") or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum. Where a sub-processor additionally certifies under the EU-U.S. Data Privacy Framework and its UK Extension, VectisFlow relies on the IDTA or SCCs as the operative mechanism, so that the transfer remains lawful if that framework is invalidated. The specific mechanism for each sub-processor is set out in Annex A.

Where a sub-processor's own data processing terms set the transfer mechanism, that mechanism applies instead. For Xero, the transfer relies on the safeguards in Xero's data processing terms, and VectisFlow does not rely on the IDTA or the UK Addendum for Xero.

7.4 Scope of the residency statement

The statement in section 7.1 covers the data listed there. Internal record identifiers, such as an organisation, user or request identifier, are sent to sub-processors outside the UK and EEA in the course of the processing described in this section. They remain personal data because VectisFlow can link them to an individual. Apart from those identifiers, personal data leaves the UK and EEA only as described in section 7.2 and Annex A.

Where a sub-processor's own data processing terms name a different contracting entity from the one shown in Annex A, the entity named in those terms is the operative one.

8. Security

See Annex B.

9. Assistance, DSARs, and breach notification

VectisFlow will:

• Acknowledge requests for assistance with data subject rights within five business days;
• Provide reasonable support for DPIAs and prior consultations on request;
• Notify the Customer of personal data breaches affecting Customer Data within 48 hours of becoming aware, with the detail then available, and supplement it as more becomes known, so that the Customer can meet its own notification obligations.

10. Audits

The Customer has the right, not more than annually and on reasonable written notice of at least 30 days, to audit VectisFlow's compliance with this DPA. VectisFlow will first make available the measures described in Annex B and any further written evidence it reasonably can, such as answers to a security questionnaire. VectisFlow does not currently hold a third-party certification such as SOC 2 or ISO/IEC 27001; if it obtains one, it will make the report available for this purpose.

If that evidence does not reasonably satisfy the Customer, the Customer may carry out an audit itself or through an independent auditor bound by confidentiality, on reasonable notice, during business hours and without disrupting the Service for other customers. Audits are at the Customer's cost unless the audit identifies a material breach of this DPA, in which case VectisFlow bears its reasonable costs of the audit.

11. Return or deletion on termination

On termination of the Customer's subscription VectisFlow will, on the Customer's written request within 30 days:

• Provide Customer Data in a commonly used, machine-readable format; and
• Delete all production copies of Customer Data within 30 days of the request, subject to:
  • Backups that are overwritten in the ordinary course within 90 days;
  • The append-only audit log, which is retained for six years from the date each entry is written, then deleted. It is kept as evidence that VectisFlow and the Customer have met their legal obligations, and for the establishment, exercise or defence of legal claims. An erasure request under Art. 17 UK GDPR does not delete it, and the two kinds of entry are treated differently:
    • Entries recorded against the erased person's own account are pseudonymised, not deleted, by a nightly job once 90 days have passed since the erasure. The job removes the email address and IP address recorded against each entry, together with any names, email addresses, free-text notes and reasons, file names, payment references, National Insurance numbers and dates of birth in its details. The internal record identifiers that keep the history linked are retained.
    • All other entries that name the person, whether written by the Customer's agency staff, by client approvers or by scheduled jobs (such as a contractor's name or email address in the details of an entry recorded against a staff member's account), are not changed by that job. They are retained as written until the six years end, as part of the same record of legal obligations and defence of legal claims.
    • Both kinds of entry stay subject to UK GDPR for as long as they are kept. Pseudonymised entries can remain personal data, because they can still be linked to an individual.

12. Annex A — Subprocessors

13. Annex B — Technical and organisational measures

Access control and tenant isolation

• Each Customer's data is logically separated. Every request for Customer Data is checked against both the requesting user's organisation and the specific record requested.
• The application connects to the database with a restricted role that can add entries to the audit log but cannot change or delete them. Schema changes use a separate administrative role.
• Agency staff sign in through Clerk, with multi-factor authentication available.
• Contractors sign in with a single-use link sent to their email address. No contractor passwords are stored.

Integrity and audit

• Every action that changes Customer Data is recorded in an audit log.
• The audit log is append-only for the application: the application's database role cannot change or delete an entry, and a database trigger rejects such changes. Only the database-owner credential or the database superuser could alter the log. The owner credential is present in the production environment because the nightly pseudonymisation job needs it; it is used for migrations, for that job, and for operator scripts run by VectisFlow staff.

Encryption

• Data is encrypted in transit using TLS 1.2 or higher.
• Data is encrypted at rest by the storage providers listed in Annex A.
• National Insurance numbers, dates of birth, gender, home addresses and Unique Taxpayer References are additionally encrypted within the application, so they cannot be read from the database alone.
• Background job data is encrypted before it is sent to the job orchestrator, with a key held only by VectisFlow.
• Credentials are held in managed environment configuration and are never written to logs. Error details are redacted before they are stored in the audit log or sent to any third party.

Data minimisation

• Sub-processors receive internal record identifiers in place of personal data wherever the processing allows.
• Email addresses, National Insurance numbers and phone numbers are removed from error reports before they are sent to the error monitoring provider, and session recording is disabled.
• Internal operational alerts identify the agency and the event only, never a contractor, approver or end client.

Uploaded documents

• Uploads are limited to PDF, JPEG and PNG files of up to 10 MB.
• Each file's contents are checked against its declared type before it is stored, and a mismatched file is rejected.
• File names are sanitised before storage.
• Files are held in private storage in the United Kingdom and are never available at a public address. Each download is authorised afresh against the requester's identity, organisation and link expiry.
• Files are always delivered as downloads and are never displayed as active content in the browser.
• A document is not treated as valid until a reviewer at the Customer approves it.
• Uploaded files are not scanned for malware. A Customer that requires malware scanning should tell VectisFlow before signing, so that a scanning provider in the UK or EEA can be assessed and added to Annex A.

Availability and resilience

• The database runs in the London region with automated point-in-time recovery.
• Background jobs are retried automatically if they fail.

Monitoring

• Sign-in and timesheet submission are rate-limited to resist abuse.
• Application logs carry request identifiers and keep personal data to a minimum.

Supplier management

• Each sub-processor is engaged under contract terms that protect personal data to a standard equivalent to this DPA.
• Annex A is kept up to date.