Last updated: 1 March 2026
Data Processing Agreement
Summary
This Data Processing Agreement ("DPA") forms part of the Terms of Service between you (the "Controller") and ComplyPost (the "Processor"). It governs how we process personal data on your behalf in accordance with UK GDPR.
1. Definitions
"Personal Data", "Processing", "Controller", "Processor", and "Data Subject" have the meanings given in UK GDPR. "Sub- processor" means any third party engaged by ComplyPost to process Personal Data on behalf of the Controller.
2. Roles and responsibilities
You (the customer) are the Data Controller. ComplyPost is the Data Processor. We process personal data only on your documented instructions and solely for the purpose of delivering the ComplyPost service.
3. Categories of data processed
- Mail content: Scanned letter images, extracted text, AI-generated summaries
- Company data: Company names, registration numbers, registered office addresses
- User data: Names, email addresses, account credentials
- Usage data: Login timestamps, feature usage analytics (anonymised)
4. Data storage and location
Customer data is primarily stored within the United Kingdom on servers hosted in London. Document reading and analysis is performed via secure API calls to GDPR-compliant service providers within the EU/UK region. Data transmitted for processing is not retained by service providers beyond the duration of each request. Certain service providers (such as email delivery and CDN) operate within the EEA in compliance with UK GDPR. See Section 6 for a full list of sub-processors.
5. Security measures
ComplyPost implements appropriate technical and organisational measures, including:
- Bank-grade (AES-256) encryption at rest for all stored data
- Encryption in transit for all connections
- Role-based access controls and least-privilege principles
- Regular security audits and penetration testing
- Automated backup and disaster recovery procedures
- Employee confidentiality agreements and security training
6. Sub-processors
We use the following sub-processors to deliver our service. We will notify you of any changes to this list with at least 30 days' notice.
| Sub-processor | Purpose | Location |
|---|---|---|
| Contabo GmbH | Infrastructure & hosting | London, UK |
| Google Cloud | Document processing & AI-assisted analysis (API only, no data retained) | EU / UK |
| Google (Firebase) | Authentication | EU / UK |
| Stripe | Payment processing | EU / UK |
| Resend | Transactional email | EU |
| Cloudflare | CDN, DDoS protection & DNS | Global (GDPR compliant) |
7. Data breach notification
In the event of a personal data breach, ComplyPost will notify you without undue delay and in any event within 72 hours of becoming aware of the breach. The notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken to address the breach.
8. Data subject rights
We will assist you in fulfilling data subject requests (access, rectification, erasure, portability, restriction, and objection) insofar as this is possible given the nature of the processing.
9. Audit rights
You have the right to audit our compliance with this DPA. We will make available all information necessary to demonstrate compliance and allow for audits conducted by you or an independent auditor, subject to reasonable confidentiality requirements and notice.
10. Data retention and deletion
Upon termination of the service agreement, ComplyPost will delete all personal data within 30 days, unless retention is required by applicable law. You may request data export at any time during your subscription.
11. Contact
For questions about this DPA, contact our Data Protection Officer at [email protected].
ComplyPost
London, United Kingdom