20% off your first month →
Scrutti

Data processing agreement

Draft – business details in square brackets are still to be confirmed.

Last updated: 6 November 2026

This agreement forms part of the terms of service between [Legal entity name, e.g. Scrutti Ltd], trading as Scrutti ("the Processor"), and the subscribing firm ("the Controller"). It sets out the terms required by Article 28(3) of the UK GDPR for the personal data Scrutti processes on the Controller's behalf.

Words such as "personal data", "processing", "controller", "processor" and "personal data breach" have the meanings given in the UK GDPR.

1. Details of the processing

Subject matterChecking the Controller's advice files against a compliance rulebook, and providing results, remedial workflow, development records, MI and reports.
DurationUploaded case files: until shortly after the check is signed off, and no more than 10 days from upload (clause 9). Other data: for the term of the subscription, plus the period needed to return or delete it under clause 10.
Nature and purposeStoring uploaded case files; extracting text; transcribing call recordings (where no transcript is supplied); sending documents and transcripts to an AI model to apply the rulebook; storing and displaying findings, grades, reviews, remedial actions, vulnerability register entries, development goals and coaching records; producing reports.
Types of personal dataIdentity and contact details; personal, family, employment, income and expenditure details; financial products and policies; recorded calls, transcripts and meeting notes; and special category data, in particular health information (including disclosures made for protection advice), and information indicating vulnerability. Adviser names, performance results and development records.
Categories of data subjectsThe Controller's clients and prospective clients, and people named in their files (such as partners, dependants and beneficiaries); the Controller's advisers and staff.
Controller's obligations and rightsAs set out in this agreement and the UK GDPR. The Controller decides what data to upload and who has access. The Controller remains responsible for keeping its own records and meeting its record-keeping obligations.

2. Instructions

  1. The Processor will process personal data only on the Controller's documented instructions, including about international transfers, unless UK law requires otherwise – in which case it will tell the Controller first, unless the law prohibits that.
  2. These terms, the Controller's use of the app's features and settings, and any written instructions agreed between the parties are the Controller's instructions.
  3. The Processor will tell the Controller immediately if it thinks an instruction breaks data protection law.
  4. The Processor will never use the Controller's personal data for its own purposes, and never to train AI models.
  5. The Processor may create and use anonymised, aggregated statistics about how the service is used – for example how many checks are run, typical grades, how often reviewers agree with the checker, and common themes by advice area. These statistics are not personal data: they never identify a client, an adviser or a firm, and we only publish figures drawn from at least three firms. It uses them to monitor and improve the accuracy and quality of the service, including its rulebooks, and to publish industry insights. Creating them is part of the processing the Controller instructs; once created they are not personal data and are not the Controller's data.

3. Confidentiality

The Processor ensures that anyone it authorises to process the personal data is bound by a duty of confidentiality. Scrutti staff do not have routine access to client data; any access needed for support is with the Controller's permission, limited and logged.

4. Security

The Processor takes the measures required by Article 32 of the UK GDPR, including:

  1. encryption of data in transit (TLS) and at rest;
  2. isolation of each firm's data at database level, enforced by row-level security with automated permission tests;
  3. role-based access, with advisers limited to their own cases;
  4. mandatory two-factor authentication for every user and automatic sign-out after 30 minutes of inactivity;
  5. an append-only audit log of sign-ins, checks, reviews, role changes and remedial actions;
  6. deletion of uploaded case files after sign-off, and no more than 10 days after upload;
  7. keeping providers to a minimum and reviewing their security before use.

5. Sub-processors

  1. The Controller gives general authorisation for the Processor to use the sub-processors listed on our sub-processors page.
  2. The Processor will give at least 30 days' notice of any new or replacement sub-processor by email and in the app. The Controller may object on reasonable data protection grounds; if the parties can't resolve the objection, the Controller may end the subscription without penalty.
  3. The Processor will put a written contract in place with each sub-processor that imposes data protection obligations equivalent to this agreement, and remains liable for each sub-processor's performance.

6. International transfers

The Processor will transfer personal data outside the UK only where a lawful transfer mechanism is in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU–US Data Privacy Framework.

7. Helping the Controller

  1. The Processor will help the Controller, by appropriate technical and organisational measures, to respond to requests from data subjects exercising their rights, and will pass on any request it receives directly without responding to it.
  2. The Processor will help the Controller meet its obligations on security, personal data breaches, data protection impact assessments and prior consultation with the ICO, taking into account the information available to it.

8. Personal data breaches

The Processor will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Controller's data. It will provide the information the Controller needs to meet its own reporting obligations, take reasonable steps to contain the breach, and keep the Controller updated.

9. Retention of uploaded files

The Processor deletes uploaded case files – documents, call recordings, transcripts and text extracted from them – within 2 days of the check being signed off by the Controller (for remedial evidence, within 2 days of the remedial action being closed), and in any event no more than 10 days after upload. The transcription provider's copy is deleted as soon as the transcript is returned. Where a check hasn't been signed off, the Processor reminds the Controller 2 days before the 10-day limit, and it confirms in the app once files have been deleted. Files are not kept for longer. Findings may quote short extracts from the files where they are evidence for a finding; these form part of the check results. The Processor is not a record-keeping system and does not keep copies of uploaded files beyond these periods; the Controller remains responsible for keeping its own records for as long as its legal and regulatory obligations require. File review sheets, check results, findings, reviews, remedial actions, MI, reports and the File Check Log are kept for the term of the subscription and dealt with under clause 10.

10. End of the agreement

When the subscription ends, the Controller has 30 days to download its reports and exports. The Processor will then delete the Controller's personal data, including copies, within 90 days, unless UK law requires it to keep some of it. Data in backups is deleted as backups expire. The Processor will confirm deletion in writing on request.

11. Audits and information

The Processor will make available to the Controller all information needed to show compliance with Article 28 and this agreement, and will allow for and contribute to audits and inspections by the Controller or an auditor it appoints, on reasonable notice, at reasonable times and subject to confidentiality.

12. Liability and precedence

Liability under this agreement is subject to the limits in the terms of service. If this agreement conflicts with the terms of service on data protection, this agreement takes priority. It is governed by the law of England and Wales.