Data Processing Agreement (DPA)

Last updated: 13 August 2026 Status: Product template — have counsel complete schedules and countersign before production.

This DPA forms part of the agreement between:

• Customer (Controller) — the organisation using Work Permit Desk for its sponsored workforce / client work
• Provider (Processor) — Work Permit Desk product operator (placeholder legal entity)

1. Roles

For worker and compliance records the Customer uploads, Customer is Controller and Provider is Processor. For Provider’s own account, billing, and website analytics data, Provider may be Controller (see Privacy Policy).

2. Subject matter and duration

Processing of personal data as needed to provide the Work Permit Desk software for the subscription term and wind-down period.

3. Nature and purpose

Hosting, storage, display, workflow automation, audit pack generation, optional AI extraction/explanation (where enabled), support, security logging.

4. Types of data and data subjects

May include identity, contact, immigration, employment, documents, and compliance events relating to Customer staff, sponsored workers, and authorised advisers.

5. Provider obligations

Provider shall:

• Process only on documented instructions from Customer
• Ensure confidentiality of persons authorised to process
• Implement appropriate technical and organisational measures
• Not engage sub-processors without the framework agreed in the Order (list available on request)
• Assist with data subject requests and DPIAs where reasonable
• Delete or return personal data on termination, subject to law
• Make available information necessary to demonstrate compliance

6. Customer obligations

Customer warrants it has a lawful basis to upload personal data and will not instruct Provider to process unlawfully.

7. International transfers

Provider will not transfer Customer personal data outside the UK without appropriate safeguards unless Customer has agreed otherwise in writing.

8. Security

Measures include access control, encryption in transit (TLS in production), tenant isolation (application controls and Postgres RLS where enabled), audit logging, and vulnerability management. Details available on request under NDA.

9. Breach notification

Provider will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer data.

10. Contact

DPA and privacy: WhatsApp +44 7448 313044 or your account manager.

---

*This template is not a signed DPA. Replace entity names, sub-processor schedules, and liability terms before go-live.*