Data Processing Agreement
Last updated: 20 October 2026
This Data Processing Agreement (DPA) is incorporated by reference in the Terms and Conditions forming part of the Agreement between Goodley Technology Limited and the Client, it sets forth the obligations between the Parties with respect to the processing of personal data in connection with the provision of the Services.
1Definitions
Any capitalised terms not specifically defined in this DPA have the meanings given to them in the Terms and Conditions.
In this DPA, the following terms shall have the following meanings:
- controller, processor, data subject, personal data, processing (and process) and special categories of personal data
- shall have the meanings given in Applicable Data Protection Law;
- Applicable Data Protection Law
- means all laws applicable (in whole or part) to a Party's processing of personal data under or in connection with this DPA, including without limitation, as applicable, EU Data Protection Law and UK Data Protection Law, in each case, as enacted, amended or superseded from time to time.
- EU Data Protection Law
- means: (i) all EU regulations or other legislation applicable to the processing of personal data under this DPA (such as Regulation (EU) 2016/679) (the “GDPR”); (ii) the national laws of each EEA member state implementing any EU directive applicable to the processing of personal data under this DPA (such as Directive 2002/58/EC (the “e-Privacy Directive”)); and (iii) any other national laws of each EEA member state applicable to the processing of personal data under this DPA.
- Sub-processor
- means any third party engaged by Goodley to process Personal Data on behalf of the Client.
- Personal Data Breach
- means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
- UK Data Protection Law
- means: (i) the GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR”); (ii) the Data Protection Act 2018 (the “DPA 2018”); (iii) the Privacy and Electronic Communications (EC Directive) Regulations 2003 as they continue to have effect by virtue of section 2 of the European Union (Withdrawal) Act 2018 (“PECR”); and (iv) any other laws in force in the UK from time to time applicable to the processing of personal data under this DPA.
2Relationship between the Parties
The Parties acknowledge and agree that, pursuant to the Terms and Conditions (including this DPA), Goodley may either:
act as a processor when Goodley receives or otherwise collects Client Data for processing by Goodley; or
act as a controller when the Client provides information about its Authorised Users and/or employees, for the purposes of enabling those Authorised Users to access and use the Services and for other general contract management and commercial relationship purposes.
Where Goodley is a controller of personal data (for example, in relation to Authorised User contact details and passwords, as well as contact details for Client employees with whom Goodley communicates in order to provide the Client with the Services or for general business management purposes) (Ancillary Data), Goodley shall use the Ancillary Data in the manner set out in its Privacy Policy. Client agrees that it shall make the relevant Users and employees aware of Goodley's Privacy Policy.
Where Goodley is a processor of personal data, the terms of this DPA shall apply.
In addition to the warranties contained in the Terms and Conditions, Client warrants, represents and agrees that it has all rights, permissions and consents required by law or contract to enable Goodley to process personal data contained in the Client Data in order for Goodley to provide the Services to the Client.
The Client acknowledges and agrees it is responsible for the accuracy, quality and legality of personal data and the means by which it was obtained. Goodley does not control the contents of the personal data it processes on the Client's behalf.
Each Party shall comply with the obligations that apply to it under Applicable Data Protection Law.
3Goodley's processor obligations
The Client appoints Goodley as a processor to process the personal data described in this DPA for the purposes of providing the Services (and as further described in Annex A to this DPA or as otherwise agreed in writing by the Parties). If Goodley becomes aware that such processing infringes Applicable Data Protection Law, it shall promptly inform the Client.
Limitation of Processing. Goodley will only process the personal data to the extent, and in such a manner, as is necessary for the provision of the Services in accordance with the Client's written instructions. Goodley will not process the personal data for any other purpose or in a way that does not comply with this DPA or the Applicable Data Protection Laws. Goodley shall promptly notify the Client if, in its opinion, the Client's instructions do not comply with the Applicable Data Protection Laws.
Process on instructions. Goodley shall only process personal data on documented instructions from the Client, including to amend, transfer, delete or otherwise process the Personal Data, or to stop, mitigate or remedy any unauthorised processing, unless required to do otherwise by applicable Law. In the event required by applicable Law, Goodley will inform the Client of the legal requirement before processing, unless prohibited by Law.
Confidentiality. Goodley shall maintain the confidentiality of the personal data and will not disclose the personal data to Third Parties unless the Client or this DPA specifically authorises the disclosure, or as required by domestic law, court or regulator (including the Commission). If a domestic law, court or regulator (including the Commission) requires Goodley to process or disclose the personal data to a third-party, Goodley must first inform the Client of such legal or regulatory requirement and give the Client an opportunity to object or challenge the requirement, unless the domestic law prohibits the giving of such notice. Goodley shall ensure that all of its employees are informed of the confidential nature of the personal data and are bound by written confidentiality obligations and use restrictions in respect of the personal data.
Security measures. Goodley shall at all times implement appropriate technical and organisational measures against accidental, unauthorised or unlawful processing, access, copying, modification, reproduction, display or distribution of the personal data, and against accidental or unlawful loss, destruction, alteration, disclosure or damage of personal data including, but not limited to, the security measures set out in Annex B.
Assistance with compliance. Goodley shall reasonably assist the Client, at no additional cost to the Client, with meeting the Client's compliance obligations under the Applicable Data Protection Laws, taking into account the nature of Goodley's processing and the information available to Goodley, including in relation to data subject rights, data protection impact assessments and reporting to and consulting with the Commission under the Applicable Data Protection Laws. Goodley shall notify the Client promptly of any changes to the Applicable Data Protection Laws that may reasonably be interpreted as adversely affecting Goodley's performance of the Services or this DPA.
4Personal Data Breach
Notification. Goodley shall without undue delay notify the Client in writing if it becomes aware of:
the loss, unintended destruction or damage, corruption, or un-usability of part or all of the personal data;
any accidental, unauthorised or unlawful processing of the personal data; or
any Personal Data Breach.
Breach Information. Where Goodley becomes aware of 4.1.1 to 4.1.3, it will provide the Client with the following written information:
a description of the nature of the incident, including the categories of in-scope personal data and approximate number of both data subjects and the personal data records concerned;
the likely consequences; and
a description of the measures taken or proposed to be taken to address the incident, including measures to mitigate its possible adverse effects.
Cooperate. Goodley shall cooperate with the Client and take reasonable steps to assist in the investigation, mitigation and remediation of the breach. Goodley will not inform any Third Party of a breach without the Client's prior consent, unless required by applicable Law.
5International Data Transfers
Data location. Personal data processed under this DPA is stored and processed within the United Kingdom and the European Economic Area, including processing by Goodley's AI model providers.
Transfer safeguards. Goodley shall not transfer personal data to a country outside the UK or EEA unless:
the transfer is to a country that the UK Government has determined provides an adequate level of protection;
appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or Binding Corporate Rules; or
a derogation under Article 49 of the UK GDPR applies.
Sub-processor transfers. Where a Sub-processor processes personal data outside the UK or EEA, Goodley will ensure an appropriate transfer mechanism is in place with that Sub-processor before any transfer occurs.
6Subcontracting
General authorisation. The Client gives general authorisation for Goodley to engage Sub-processors to assist with the provision of the Services, subject to this section 6 of the DPA.
Current Sub-processors. An up-to-date list of Goodley's current Sub-processors is available at goodley.ai/subprocessors.
AI model providers. Goodley's AI model providers are contractually prohibited from using personal data to train or fine-tune their models.
New Sub-processors. Goodley shall:
notify the Client of any intended addition or replacement of a Sub-processor at least thirty (30) days before the change, giving the Client the opportunity to object;
where the Client raises a reasonable objection within fourteen (14) days of notification, Goodley shall work with the Client in good faith to address its concerns. If no resolution can be reached, the Client may terminate the affected Services;
impose data protection obligations on each Sub-processor by contract that are no less protective than those in this DPA; and
remain fully liable to the Client for the performance of each Sub-processor's obligations.
7Complaints, Data Subject Requests and Third Party Rights
Assistance. Taking into account the nature of the processing, Goodley shall assist the Client with appropriate technical and organisational measures to respond to requests from data subjects exercising their rights under the Appropriate Data Protection Laws, including the rights of access, rectification, erasure, restriction of processing, data portability and objection.
Notification. If Goodley receives a request from a data subject about their personal data, it will promptly notify the Client and will not respond to the request directly unless authorised by the Client or required by applicable Law.
Self-service tools. The Goodley Platform provides data export and deletion functionality that the Client can use to respond to data subject requests. Where more help is needed, the Client should contact Goodley at info@goodley.ai.
Complaints. Goodley shall notify the Client immediately in writing if it receives any complaint, notice or communication that relates directly or indirectly to the processing of the personal data or to either party's compliance with the Applicable Data Protection Law.
Third Parties. Goodley shall not disclose the personal data to any data subject or to a Third Party other than in accordance with the Client's written instructions, or as required by domestic law.
8Term and Termination
Duration. This DPA takes effect when the Client signs an Order and continues until the Agreement is terminated or Goodley ceases to provide Services, and all personal data has been deleted or returned under section 10.
Survival. The provisions of this DPA that by their nature should survive termination, including those on confidentiality, liability and data deletion, survive any termination or expiry of this DPA.
9Records and Audit Requests
Information requests. On reasonable request, Goodley shall make available to the Client the information reasonably necessary to demonstrate compliance with this DPA and Applicable Data Protection Laws.
Audit procedures. Goodley shall allow for and contribute to audits, including inspections, conducted by the Client, an auditor mandated by the Client, or a regulator with authority over the Client, on these conditions:
the Client will provide no less than thirty (30) days' prior written notice of any audit, unless a regulator requires a shorter period;
audits will take place during normal business hours and will not unreasonably interfere with Goodley's operations;
the Client and any auditor will comply with Goodley's reasonable security and confidentiality requirements;
audits are limited to once in any twelve (12) month period, unless a regulator requires more or a Personal Data Breach has occurred; and
the Client bears its own audit costs.
Third-party certifications. Where available, Goodley may satisfy an audit request by providing copies of relevant third-party certifications, audit reports or compliance documentation.
10Data Deletion and Return
On termination. On termination or expiry of the Agreement, Goodley will, at the Client's election, provide the Client with a copy of all personal data in a commonly used, machine-readable format, delete all personal data from its systems, or both.
Export period. For thirty (30) days after termination, the Client may export its data using the Goodley Platform's export tools or by asking Goodley for an export, as set out in the Terms and Conditions.
Deletion. Within thirty (30) days after the export period ends, Goodley will delete the Client's personal data, except where applicable law requires it to be retained.
Certification. On request, Goodley shall confirm in writing that personal data has been deleted.
Backups. Personal data may persist in backup systems for a limited period after deletion from primary systems. Those backups are encrypted and access-restricted, and are overwritten in the normal course of business.
Annex A: Scope and purpose of processing
Subject matter. Goodley processes Personal Data on behalf of the Client solely to provide the Services described in the Agreement.
Duration. Processing continues for the duration of the Agreement, plus any retention period required by law or set out in section 10 (Data deletion and return).
Nature and purpose. The processing includes:
- storing and organising compliance-related records and documentation;
- facilitating task management and workflow automation;
- generating compliance reports and management information;
- providing AI-assisted compliance guidance and Outputs; and
- enabling audit trails and record-keeping for regulatory purposes.
Goodley as controller. Goodley acts as an independent controller of the account, billing and contact details of the Client and its Authorised Users, and of usage data about the Goodley Platform. That processing is covered by Goodley's Privacy Policy, not this DPA.
Processing details
| Item | Details |
|---|---|
| Categories of Data Subjects | The Client's employees, customers, complainants, beneficial owners, politically exposed persons and other individuals whose data is processed for compliance purposes |
| Types of Personal Data | Names, contact details, employment information, financial data, identification documents, complaint records, transaction data and other compliance-related information |
| Special category and criminal offence data | May include data revealing political opinions (politically exposed persons), health data (vulnerable customer records) and criminal conviction data (fraud and anti-money-laundering records), where the Client chooses to process it in the Services |
| Processing operations | Collection, storage, organisation, retrieval, consultation, use, disclosure by transmission, alignment, combination, restriction, erasure and destruction |
Annex B: Security measures
Technical and organisational measures. Goodley implements and maintains appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include:
| Category | Measures |
|---|---|
| Encryption | TLS 1.2+ encryption for data in transit; AES-256 encryption for data at rest |
| Access control | Role-based access controls; password-based sign-in; principle of least privilege; unique user credentials; periodic access reviews; prompt revocation of access on staff departure; secure deletion or return of Client Data on termination, in accordance with the Agreement |
| Infrastructure security | Data centres in the United Kingdom and European Economic Area; firewall protection; DDoS protection; regular security patching; databases are not publicly accessible; WAF and malware scanning; separation of development and production environments |
| Data segregation | Logical separation of client data; unique client identifiers; secure multi-tenant architecture |
| Backup and recovery | Automated daily database backups retained for specified period; multi availability zone database with automatic failover |
| Personnel | Staff confidentiality agreements; security awareness training |
| Monitoring and logging | Security event logging; access logs; audit trails; full request tracing |
| Vendor management | Due diligence on Sub-processors; contractual security requirements; periodic reviews |
| Incident management | Support services; notification to Customer without undue delay on becoming aware of a data breach |
Ongoing security. Goodley will regularly test, assess and evaluate the effectiveness of these measures and make improvements as appropriate, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing.