Data Processing Addendum

Last updated: 16 August 2026

This Addendum (“DPA”) forms part of the Terms of Service between the Customer (“Controller”) and the Company (“Processor”) and applies where the Processor processes personal data on the Controller’s behalf and the UK GDPR, EU GDPR or a comparable law applies. Where this DPA conflicts with the Terms on data protection, this DPA prevails.

1. Subject matter, duration and nature

• Subject matter: provision of the SessionPilot service.
• Duration: for as long as the Controller holds an account, plus any period needed to return or delete data.
• Nature and purpose: hosting an account, relaying and storing client-encrypted data, operating team-collaboration and audit features, issuing licences, and providing support.
• Types of personal data: account identifiers (email, name), role and workspace membership, public keys, audit records identifying the acting user, and operational metadata such as IP address and timestamps. Any personal data inside profile or session content is encrypted by the Controller before transmission and is not accessible to the Processor.
• Categories of data subject: the Controller’s personnel and authorised users.

2. Processing on documented instructions

The Processor processes personal data only on the Controller’s documented instructions, which the Terms and normal use of the Service constitute, unless required otherwise by law — in which case the Processor will inform the Controller before processing, unless the law prohibits it.

The Processor will tell the Controller if, in its opinion, an instruction infringes data-protection law.

3. Confidentiality

Personnel authorised to process personal data are bound by confidentiality obligations and are granted access only to the extent needed for their role.

4. Security measures

Taking account of the state of the art and the risks involved, the Processor maintains:

• Client-side encryption of profile and session content, using a key derived from a Controller-held passphrase that the Processor never receives;
• Envelope encryption for team sharing, with per-user keypairs and per-workspace keys sealed individually to each member, and cryptographic revocation on member removal;
• Encryption in transit using TLS;
• Password hashing with a modern memory-hard function;
• Access control with scoped tokens, role-based permissions and default-deny per-item access lists;
• A tamper-evident audit log, hash-chained and signed by the acting user, with a server anchor allowing offline verification;
• Rate limiting on authentication endpoints and boundary validation on inputs;
• Backups of the encrypted datastore, and restoration testing.

5. Sub-processors

The Controller gives general authorisation for the Processor to engage sub-processors for hosting and infrastructure, payment processing and transactional email. The Processor imposes data-protection terms on each sub-processor no less protective than this DPA and remains liable for their performance.

A current list of sub-processors is available through the contact form. The Processor will give notice of an intended new sub-processor, and the Controller may object on reasonable data-protection grounds; if the objection cannot be resolved, the Controller may terminate the affected part of the Service.

6. Assistance to the Controller

The Processor will, taking account of the nature of the processing:

• Assist the Controller in responding to data-subject requests, insofar as possible;
• Assist with data-protection impact assessments and prior consultation; and
• Notify the Controller without undue delay after becoming aware of a personal-data breach, with the information available to it.

The Processor’s ability to assist with requests concerning profile or session content is limited by design: it can supply the ciphertext it holds but cannot decrypt it.

7. International transfers

Where personal data is transferred outside the UK or EEA, the transfer is made under an appropriate safeguard, such as Standard Contractual Clauses or an adequacy decision. The parties agree to enter into the applicable clauses where required.

8. Audits

The Processor will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits by the Controller or an independent auditor it mandates, on reasonable notice, no more than once a year unless a supervisory authority requires otherwise, and subject to confidentiality and to not compromising the security of other customers.

9. Return and deletion

On termination, and at the Controller’s choice, the Processor will delete or return personal data processed on the Controller’s behalf, and delete existing copies, unless retention is required by law. Deleted sync items leave tombstones so deletions propagate to the Controller’s devices; these are purged on the retention schedule stated in the Privacy Policy.

10. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service.

To request a countersigned copy of this DPA, or the current sub-processor list, use the contact form.