Data Processing Addendum

This Addendum forms part of the Terms & Conditions and applies where Autothink Group Ltd processes personal data as a processor on behalf of a customer (the controller), for example search terms and contact details entered by the customer's end users. It meets the requirements of Article 28 UK GDPR.

• Subject matter and purpose: providing address lookup and data validation services.
• Duration: the term of the customer's agreement, plus the retention periods below.
• Data subjects: the customer's end users, staff and customers.
• Data types: search queries, postcodes, selected addresses, names, emails, phone numbers, bank details submitted for validation, IP address and device data.

• Process personal data only on the customer's documented instructions (these Terms and the customer's use of the Service).
• Ensure staff with access are bound by confidentiality.
• Implement appropriate technical and organisational security measures (Article 32).
• Assist the customer with data subject requests, DPIAs and regulator enquiries, at reasonable cost.
• Notify the customer without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting customer data.
• Delete or return customer personal data at the end of the agreement, unless retention is required by law.
• Make available information reasonably needed to demonstrate compliance and allow audits on 30 days' notice, no more than once a year.

The customer authorises the following categories of sub-processor:

• Cloud hosting, database and edge infrastructure providers;
• Our dedicated address-data server provider (Hetzner, EU);
• Email delivery (SendGrid / Twilio);
• Validation providers for phone, email and bank checks, used only when those products are called.

We impose equivalent data protection terms on sub-processors and will give notice of new ones, allowing reasonable objection.

• TLS encryption in transit; encryption at rest by our hosting providers.
• Hashed API keys, role-based access and row-level database security.
• Logging and monitoring, including automated service health checks.
• Least-privilege staff access and secure credential management.

Restricted transfers are made only under UK adequacy regulations or the UK IDTA / Addendum to the EU SCCs.

Usage logs containing customer personal data are kept for up to 24 months, then deleted or anonymised.

Liability under this Addendum is subject to the limitations in the Terms & Conditions.