Legal

Data Processing Agreement

Last updated: 21 August 2026 · Effective: 21 August 2026 · Version 1.0

This Data Processing Agreement (DPA) forms part of the Terms of Service between Proviso Compliance Limited (trading as Proviso.ie) and the Customer. By using Proviso, you agree to this DPA. It is incorporated by reference into the Terms of Service.

Draft for legal review. This DPA has been prepared to reflect how Proviso processes personal data, but it has not been reviewed by a solicitor. Because it governs your firm's GDPR obligations as a data controller and ours as a processor, it should be reviewed and finalised by a qualified data-protection or Irish solicitor before it is relied upon with paying customers.

1. Definitions

"Controller" — the Customer, who determines the purposes and means of processing personal data entered into Proviso
"Processor" — Proviso Compliance Limited (trading as Proviso.ie), who processes personal data on behalf of the Controller
"Personal data" — any information relating to an identified or identifiable natural person entered into Proviso by the Customer, including adviser names, email addresses, and compliance records
"Processing" — any operation performed on personal data including storage, retrieval, display, and deletion
"GDPR" — the General Data Protection Regulation (EU) 2016/679
"Sub-processor" — any third party engaged by Proviso to process personal data on the Controller's behalf

2. Scope and roles

The Customer is the data controller of all personal data entered into Proviso regarding their advisers and staff. Proviso Compliance Limited is the data processor, processing that data solely to provide the Proviso service as described in the Terms of Service.

Where Proviso collects data directly from the Customer (account registration, billing), Proviso Compliance Limited acts as a data controller in its own right — this is governed by the Privacy Policy rather than this DPA.

External consultants: where the Customer invites an external compliance consultant to access its account, that disclosure is made at the Controller's direction under the Terms of Service. The Consultant is not a sub-processor of Proviso; the Controller is responsible for its arrangement with the Consultant and for revoking access when no longer required. Proviso provides the technical access controls (per-firm access links, revocable at any time, with actions recorded in the audit trail).

3. Processor obligations

Proviso Compliance Limited agrees to:

Process personal data only on documented instructions from the Controller (i.e. as required to provide the Service) and not for any other purpose
Ensure that personnel authorised to process personal data are bound by appropriate confidentiality obligations
Implement appropriate technical and organisational security measures as described in Section 6
Not engage new sub-processors without informing the Controller and providing opportunity to object
Assist the Controller in responding to data subject rights requests, breach notifications, and DPIAs as reasonably required
Delete or return all personal data on termination of the service, at the Controller's choice, subject to legal retention obligations
Make available all information necessary to demonstrate compliance with GDPR Article 28

4. Controller obligations

The Customer agrees to:

Ensure there is a lawful basis for processing all personal data entered into Proviso
Ensure advisers and staff whose data is entered into Proviso have been informed that their compliance data is being tracked on the platform
Not enter client or customer personal data into Proviso — the Service is for internal staff records only
Not enter sensitive personal data (health, biometric, racial/ethnic origin, political opinions etc.) into Proviso
Ensure that documents uploaded during concierge onboarding do not contain data that Proviso is not authorised to process

5. Sub-processors

Proviso currently engages the following sub-processors:

Sub-processor	Purpose	Location	Safeguard
Supabase Inc.	Database hosting, authentication, file storage, edge functions	EU West (Ireland)	DPA with Supabase; EU data residency
Vercel Inc.	Application and website hosting	EU region	DPA with Vercel; EU data residency
Stripe Inc.	Payment processing (does not process adviser personal data)	EU (Irish entity)	Stripe DPA; EU data residency
Resend Inc.	Transactional email delivery (adviser nudge emails, deadline alerts)	EU region	Resend DPA; EU data residency
Anthropic PBC	AI parsing of CPD certificates and concierge onboarding documents uploaded by the Customer. Processes document content in real time; does not retain data after the API call completes and does not use it for AI model training.	USA	Standard Contractual Clauses (SCCs) per Anthropic's DPA
Microsoft Ireland Operations Ltd	Business email (Microsoft 365) — operational correspondence including concierge requests and service notifications	EU	Microsoft DPA; EU data residency

We will notify Customers of any intended new sub-processors via email or in-platform notification at least 14 days before engagement. Customers may object in writing within 14 days; if the objection cannot be resolved, either party may terminate the subscription with a pro-rata refund.

6. Security measures

Proviso Compliance Limited implements the following technical and organisational measures:

Encryption at rest: AES-256 encryption of all database data via Supabase
Encryption in transit: TLS 1.2+ for all data transmitted between client and server
Access controls: Row-level security (RLS) enforced at the database layer — no firm can access another firm's data regardless of application-layer controls
Authentication: JWT tokens with automatic expiry; passwords hashed with bcrypt
File storage: CPD certificate uploads stored in a private, access-controlled storage bucket; not publicly accessible
One-off access controls: Access expiry enforced server-side with hard timestamp checks on every login
Personnel access: Production database access restricted to authorised Proviso personnel only, on a need-to-know basis
Audit logging: Material actions within the platform are logged with timestamps for audit purposes
Data residency: All primary data stored in EU West (Ireland) infrastructure

7. Data subject rights

Where a data subject (e.g. an adviser whose data is held in Proviso) exercises their rights under GDPR directly with Proviso Compliance Limited, we will promptly notify the Customer (Controller) and will not respond to the request without the Controller's authorisation unless required by law.

Proviso will provide reasonable technical assistance to enable the Controller to fulfil data subject requests including access, rectification, erasure, and portability.

8. Personal data breach

In the event of a personal data breach affecting Customer data, Proviso Compliance Limited will notify the Customer without undue delay and in any event within 72 hours of becoming aware of the breach. Notification will include: the nature of the breach, categories and approximate number of individuals affected, likely consequences, and measures taken or proposed. Proviso Compliance Limited will cooperate fully with the Customer's breach response and with any DPC investigation.

9. Data Protection Impact Assessment

Proviso will assist the Customer in conducting a Data Protection Impact Assessment (DPIA) where required by GDPR Article 35, by providing relevant information about Proviso's data processing activities on request.

10. Deletion and return of data

On termination of the service:

Subscription accounts: data is deleted within 30 days of account closure, subject to the 7-year retention obligation for compliance records (CPD, F&P, IAF, AML, complaints, pre-appointment records)
One-off pack accounts: data is deleted within 30 days of the 7-day access expiry, unless the account is converted to a subscription
Concierge onboarding source documents (spreadsheets, PDFs): deleted within 30 days of onboarding completion regardless of subscription status
Generated compliance reports and Compliance Evidence Packs stored for re-download: deleted with the account data

Customers may request an export of their data in CSV format at any time by contacting privacy@proviso.ie.

11. Governing law

This DPA is governed by Irish law and forms part of the Terms of Service. In the event of conflict between this DPA and the Terms of Service, this DPA prevails in respect of data processing matters.

12. Contact

Data protection queries: privacy@proviso.ie
Proviso Compliance Limited, Co. Kildare, Ireland