Version 2026-11-09 · Terms · Privacy notice
Data Processing Agreement
This agreement is part of the Terms of Service between you (the controller) and [Company name - add COMPANY_NAME in Render] (the processor), and meets Article 28 of the UK GDPR.
1. What we process
| Subject matter | Running payroll and related reports and submissions for you and your clients. |
|---|---|
| How long | While your account is open, plus up to 30 days to return data, unless the law requires longer. |
| Purpose | Calculating pay and deductions, payslips, statutory payments, pension enrolment and files, HMRC submissions, and the related records. |
| People | Employees, directors, workers and former staff of you or your clients; your clients' contacts; your users. |
| Data | Names, contact details, dates of birth, NI numbers, addresses, job and pay details, tax codes, student loans, pension details, bank details, attachment of earnings orders, and sickness and family leave records. Some of this (health information about sickness, maternity and the like) is special category data. |
2. Our promises as processor
- We only process personal data on your documented instructions, which are the terms, your settings and your use of the service, unless the law requires otherwise (and if so we will tell you, unless the law forbids it).
- Everyone who can access the data is bound by confidentiality.
- We take appropriate security measures (Article 32): encryption at rest and in transit, separation of each firm's data, two-step login, least-privilege access, activity logging, backups, and regular testing.
- We only use the sub-processors listed below. We will give you at least 30 days' notice of any new one so you can object, and we bind each to the same data protection duties.
- We help you respond to requests from individuals using their rights, and with security, breach notification, impact assessments and consultations with the ICO.
- We tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need.
- At the end of the service, we delete or return your data, as you choose, unless the law requires us to keep it.
- We make available the information needed to show we meet these duties, and allow reasonable audits (normally by questionnaire, with reasonable notice, at most once a year unless there has been a breach).
- We tell you straight away if we think an instruction breaks data protection law.
3. Sub-processors
| Who | What for | Where |
|---|---|---|
| Render Services, Inc. | Hosting the app and database | Frankfurt, Germany (EU) |
| HM Revenue & Customs | Receiving RTI submissions you choose to send | United Kingdom |
| Email provider set up by us (if email is switched on) | Sending payslips, reports and reminders | UK / EU |
| Anthropic PBC (only if AI document reading is switched on) | Reading payslips and documents you upload | United States (UK IDTA / adequacy safeguards) |
| TrueLayer Limited (only if a bank is connected) | Open Banking: reading bank transactions and balances with your client's consent | United Kingdom |
| Companies House (only when you file accounts) | Receiving accounts you choose to file | United Kingdom |
4. Transfers outside the UK
Data is stored in the EU (Germany), which the UK recognises as adequate. Any transfer to a country without UK adequacy is covered by the UK International Data Transfer Agreement or Addendum.
5. Your duties as controller
You make sure you have a lawful basis, and a condition for special category data, for the processing; that individuals are told about it; and that your instructions are lawful.
6. Liability
The limits of liability in the Terms of Service apply to this agreement, except where the law does not allow it.