Data Processing Terms

They apply to business customers on a paid plan or a paid audit, for any personal data inside the websites, Fact Sheets and reports Purlock processes for you (for example a staff name or phone number published on your site). You accept them by using a paid plan; no signature is needed. If you need a signed copy, email support@spendjot.app.

For that data you are the controller and Spendjot Ltd is the processor. For your own account details (your name, email and billing) we are the controller, as described in our Privacy Policy.

• We process the data only on your documented instructions, which are the Terms of Service and the settings you choose.
• Everyone who can access it is bound by confidentiality.
• We keep appropriate technical and organisational measures in place; see our Security page.
• We help you answer requests from people exercising their data rights, and with security and impact assessments where needed.
• We make available the information you need to show these terms are being met, and allow reasonable audits with notice.

You authorise these subprocessors. We give at least 14 days' notice by email before adding or replacing one, and you may object by ending your plan.

Where data leaves the UK or EEA, we rely on adequacy regulations (including the UK and US data bridge) or standard contractual clauses with the UK addendum.

If a personal data breach affects your data, we tell you without undue delay and within 48 hours of becoming aware of it, with what we know and what we're doing about it.

You can download all your data from Account settings at any time. When you delete your account we delete your data, except copies in backups (which expire on their own) and records the law requires us to keep, such as invoices.