Data Processing Agreement

1. Parties and roles

For the personal data the Firm holds about its own clients and their officers, the Firm is the controller and FirmPulse is the processor. FirmPulse processes that personal data only on the Firm's documented instructions, including the instructions given through normal use of the platform, unless it is required to do otherwise by law.

FirmPulse is the controller of the limited personal data it holds about the Firm's own staff for account administration, billing and support. That processing is described in our Privacy Policy at https://firmpulse.co.uk/privacy.

2. Subject matter and duration

FirmPulse processes personal data to provide the platform: proposals and quoting, client take-on, anti-money-laundering checks and identity verification, electronic signatures, the client portal, document storage, client invoicing and payment collection, emails and text messages sent on the Firm's behalf, task and deadline management, and related practice-management functions. Processing continues for the duration of the Firm's subscription and the limited periods described in section 11.

3. Categories of data subjects and personal data

Data subjects include the Firm's clients, their directors, persons with significant control, shareholders and other client contacts, people who complete an identity check or sign a document the Firm sends, and the Firm's own staff who use the platform.

Personal data includes contact and identity details, dates of birth, nationality, home addresses, tax identifiers such as National Insurance numbers and Unique Taxpayer References, company and officer information drawn from Companies House, identity documents and the results of identity checks and screening, service and deadline records, documents and electronic signature records, communications and whether they were opened, and billing and payment information.

Identity checks can involve special category data: a photograph compared with an identity document is biometric data. Screening can reveal information about criminal offences. Both are processed only when the Firm runs a check, and are handled as described in section 12.

4. FirmPulse obligations

• Process personal data only on the Firm's documented instructions.
• Tell the Firm immediately if, in FirmPulse's opinion, an instruction from the Firm infringes UK data protection law.
• Ensure that people authorised to process the data are under a duty of confidence.
• Apply appropriate technical and organisational security measures (section 6).
• Engage sub-processors only as set out in section 5.
• Assist the Firm with data subject requests and with its own compliance obligations (sections 7 and 8).
• Notify the Firm without undue delay of any personal data breach (section 7).
• Return or delete personal data at the end of the engagement (section 11).

5. Sub-processors

FirmPulse's sub-processors

The Firm authorises FirmPulse to engage the sub-processors listed below to help provide the platform. FirmPulse has a data processing agreement with each, on data-protection terms no less protective than this DPA, and keeps a record of it: signed with FirmPulse, or the provider's published agreement that forms part of its terms, as each entry says.

• Neon: PostgreSQL database hosting. Data region: London, United Kingdom. Data processing agreement signed with FirmPulse.
• Vercel: application hosting and content delivery. Application servers in London, United Kingdom; content delivery worldwide; company based in the USA. Vercel's data processing addendum, part of its terms.
• Amazon Web Services (S3): secure document storage, including identity documents, selfies and proof of address collected for identity checks, engagement letters, invoices and files shared through the client portal. Data region: London, United Kingdom; company based in the USA. The AWS data processing addendum, part of its service terms.
• Postmark: delivery of email, including FirmPulse system emails and emails sent on the Firm's behalf to its clients and customers. Some emails record whether they were opened and whether a link was clicked. USA. Data processing agreement signed with FirmPulse.
• Twilio: delivery of SMS text messages on the Firm's behalf, such as verification reminders and status notifications. USA. Twilio's data protection addendum, part of its terms.
• Ideal Postcodes Ltd: the address finder on a Firm's Verify pages, on FirmPulse's own account. Receives the postcode or partial address a person types into the finder and a reference for the address they choose, never their name. Where that lookup is unavailable, a postcode can go instead to postcodes.io, the free postcode service Ideal Postcodes Ltd runs, which receives the postcode alone. United Kingdom. Ideal Postcodes' data processing agreement, part of its terms of service.
• Anthropic: suggested wording for the Firm's own proposal text, only when a user asks for a suggestion. Only the Firm's name and its own wording are sent, never client data, and Anthropic does not use it to train its models. USA. Anthropic's data processing addendum, part of its commercial terms.
• Cloudflare: bot protection (Turnstile) on public forms, such as a Firm's Verify pages. Worldwide; company based in the USA. Cloudflare's data processing addendum, part of its subscription agreement.
• Sentry: error monitoring. Data region for error events: European Union; company based in the USA. Sentry's data processing addendum, accepted by FirmPulse.

We will give the Firm reasonable prior notice, at least 30 days where practical, before adding or replacing a sub-processor, so the Firm can object on reasonable data-protection grounds.

Services the Firm connects under its own contract

These services act for the Firm, on the Firm's own account and under the Firm's own agreement with the provider. FirmPulse passes data to them only when the Firm connects or uses them, as each entry says.

• Stripe: card payments for identity check fees, taken on the Firm's own Stripe account. United Kingdom and USA.
• GoCardless: Direct Debit and pay by bank payments through the Firm's own GoCardless account, which the Firm connects through FirmPulse's GoCardless integration, including the payer details FirmPulse passes to GoCardless's payment pages. Client money never passes through FirmPulse. GoCardless and the Firm each act as a controller of payer information. Company based in the United Kingdom.
• ComplyCube Ltd: identity verification and anti-money-laundering screening, run on the Firm's own ComplyCube account, including document, biometric and address checks and sanctions, politically exposed person and adverse media screening. Data region: the region set on the Firm's ComplyCube account, which ComplyCube sets to the United Kingdom by default for an account registered in the UK; company based in the United Kingdom.
• Microsoft 365 (Microsoft Graph): sending email from the Firm's own mailbox, or from a staff member's own mailbox, where one is connected. FirmPulse can send email from a connected mailbox but cannot read it. United Kingdom and European regions.
• Xero: recording invoices and credit notes in the Firm's own Xero organisation, only where the Firm connects it. Company based in New Zealand.
• Google (Google Ads API): upload of completed, paid conversions, with click identifiers and a hashed email address, to the Firm's own Google Ads account, only where the Firm enables this. USA.
• Microsoft Advertising: upload of completed, paid conversions, with the Microsoft click identifier, to the Firm's own Microsoft Advertising account, only where the Firm enables this. USA.

ComplyCube Ltd replaced our previous identity-verification provider, Xama Technologies Limited, on 25 July 2026. Checks completed before that date were carried out by the previous provider, and the records of those checks are retained as described in section 12.

Public bodies

These receive data as controllers in their own right, not as processors for the Firm or for FirmPulse.

• Companies House: official UK company and officer data from the public register. United Kingdom.
• HMRC: checks the Firm asks the platform to make with HMRC, such as confirming that a VAT number is registered. United Kingdom.

6. Security measures

FirmPulse applies technical and organisational measures appropriate to the risk, including: encryption of data in transit, and of stored credentials and access tokens; access controls and least-privilege administration; two-factor authentication for staff sign-in; strict per-firm data separation enforced at the database level (row-level security), so one firm cannot see another firm's data; audit logging; and regular review of access and dependencies.

7. Personal data breaches

FirmPulse will notify the Firm without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting the Firm's data, with the information the Firm reasonably needs to meet its own notification duties.

8. Data subject rights and assistance

Taking into account the nature of the processing, FirmPulse will assist the Firm, by appropriate technical and organisational measures, to respond to requests from data subjects exercising their rights, and to meet the Firm's obligations on security, breach notification, and data protection impact assessments.

9. International transfers

The Firm's data is primarily hosted in the United Kingdom. Where a sub-processor processes personal data outside the UK, FirmPulse relies on an approved transfer mechanism, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards required.

10. Audit

FirmPulse will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by the Firm or an auditor it mandates, on reasonable notice and subject to confidentiality.

11. Return and deletion of data

On termination, FirmPulse will, at the Firm's choice, return or delete the Firm's personal data within a reasonable period, and delete existing copies within 30 days unless storage is required by law. Data held in routine backups is purged on the normal backup cycle.

12. Identity-verification and AML data

Identity-verification data collected through the Verify module is processed to perform statutory Companies House identity checks. Copies of the documents checked and the evidence of each check are kept for seven years from the check, as the Companies House identity verification standard requires.

Where the Firm uses the platform for its anti-money-laundering customer due diligence, including identity checks and screening when it takes on a client, the records are kept for five years from the end of the business relationship, as the Money Laundering Regulations 2017 require, unless the law requires them to be kept longer. At the end of the applicable period FirmPulse deletes them on the Firm's instruction.

The Firm is responsible for obtaining the explicit consent the biometric comparison needs, and for any appropriate policy document its processing of screening results requires. FirmPulse will assist with the Firm's data protection impact assessment on request.

13. Liability

Liability under this DPA is subject to the limitations and exclusions in the FirmPulse Terms of Service at https://firmpulse.co.uk/terms.

14. Changes and contact

We may update this DPA from time to time; material changes will be notified to the Firm. For any data-protection question, or to exercise audit rights, contact hello@firmpulse.co.uk. FirmPulse's ICO registration: ZC184115.

FirmPulse Ltd
C/O 3DOM.UK Accountants Ltd
Second Floor
61 Hamilton Square
Birkenhead
Merseyside
CH41 5AT