Data Processing Agreement

1. Definitions

• ControllerThe customer who determines the purposes and means of processing personal data using the Verafy platform.
• ProcessorVerafy Ltd, which processes personal data on behalf of the Controller.
• Personal DataAny information relating to an identified or identifiable natural person, including directors, officers, and persons with significant control found in Companies House records.
• ProcessingAny operation performed on personal data, including collection, storage, retrieval, use, and deletion.
• UK GDPRThe retained EU law version of the General Data Protection Regulation as it has effect in UK law.

2. Nature and Purpose of Processing

Verafy processes personal data on behalf of the Controller for the following purposes:

• Retrieving and displaying director and officer information from UK Companies House public records
• Calculating risk scores based on historical appointment and dissolution data
• Storing deal pipeline records containing director names and company information in the Controller's CRM
• Generating PDF intelligence reports containing director history and associated company records
• Monitoring company records for changes to director composition or company status

Legal basis: All personal data processed by Verafy is sourced from the publicly available Companies House register. Verafy does not collect, store, or process personal data beyond what is available in public records, except for account registration data (name, email, password hash) which is processed on the basis of contractual necessity.

3. Obligations of Verafy (Processor)

Verafy Ltd shall:

• Process personal data only on documented instructions from the Controller (i.e. use of the Verafy platform)
• Ensure that persons authorised to process the personal data have committed themselves to confidentiality
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk
• Not engage sub-processors without the prior written consent of the Controller, except those listed in Schedule 1
• Assist the Controller in ensuring compliance with obligations regarding data subject rights
• Delete or return all personal data to the Controller after the end of the provision of services, unless storage is required by law
• Make available all information necessary to demonstrate compliance with the obligations in this DPA

4. Security Measures

Verafy implements the following technical and organisational measures:

• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted in the Neon PostgreSQL managed database
• Passwords are hashed using bcrypt with a minimum work factor of 12
• Authentication uses short-lived JWT tokens (7-day expiry)
• Access to production systems is restricted to authorised personnel only
• Regular dependency updates and security patch management
• Per-user data isolation — each user's CRM data is logically separated in the database

5. Sub-Processors

Schedule 1 — Approved Sub-Processors

6. Data Subject Rights

Verafy will assist the Controller in responding to data subject requests under UK GDPR (Articles 15–22), including rights of access, rectification, erasure, restriction, portability, and objection. Requests should be submitted to support@verafy.uk. Verafy will respond within 72 hours and provide all necessary assistance within the statutory timeframe.

7. Data Breach Notification

In the event of a personal data breach, Verafy will notify the Controller without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The notification will include the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed to address the breach.

8. Term and Termination

This DPA is effective for the duration of the subscription and terminates automatically upon termination of the Terms of Service. Upon termination, Verafy will delete all personal data processed on behalf of the Controller within 30 days, unless retention is required by applicable law.

9. Contact