Legal
Data processing addendum
Version 1.1, effective 17 October 2026. Part of our terms of service.
1. What this covers
This addendum forms part of the terms between Trailhead Design Limited, trading as Policy365 ("we", "us"), and the business that holds an account (the "customer", "you"). It applies where we process personal data on your behalf in providing Policy365 Sanctions Screening (the "service"). For that data you are the controller and we are your processor, under Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where the terms and this addendum differ about personal data, this addendum applies.
It does not cover the personal data of your own people who use the service (their names, work emails and sign-ins). We hold that as a controller, as our privacy notice explains.
2. The processing
| Subject matter | Screening people and companies you send us against the official sanctions lists, and the people Companies House records for a company you send us; keeping a signed record of each screening; and, where you ask, watching the names you choose and checking them again when a list changes. For a light account, screening without keeping a record; and, where a light check is offered as a certificate, holding its request for up to 24 hours. |
|---|---|
| Duration | For as long as you use the service, and then for each record's retention period (section 9). |
| Nature and purpose | Receiving, matching, recording, storing, signing, retrieving and deleting, so you can meet your own sanctions screening obligations and show what you checked and when. |
| People concerned | Your proposers, policyholders and other customers; their directors, officers and people with significant control; and anyone else you choose to screen. |
| Kinds of personal data | Names; year and month of birth; roles; and, for people found through Companies House, their appointment, nationality, occupation and any disqualification. The results of each screening, including any listed entry a person resembles, and the decisions and notes your reviewers record. Your own references, such as a policy number. No special category data is asked for. |
3. Your instructions
- We process the personal data only on your documented instructions: these terms, this addendum, and what you ask of the service through its pages, its API and any AI assistant your people connect. We do not use it for any other purpose of our own, and we do not sell it.
- If the law requires us to process it otherwise, we will tell you first unless the law forbids it.
- We will tell you if we think an instruction breaks data protection law.
- You are responsible for having a lawful basis to screen the people you send us, and for telling them, as your own privacy notice requires.
4. Confidentiality
Only our people who need it to run and support the service can reach the personal data, and each is bound to keep it confidential. Emails the service sends (sign-in links, notices that a screening needs a decision) never contain the names screened or your references; the email saying a file is screened gives its file name, as you named it.
5. Security
We keep appropriate technical and organisational measures in place, as Article 32 requires, including: encryption in transit and at rest; API keys held only as a hash; the service reaching its database only through fixed procedures, with no right to delete; each screening record signed and stored write-once, so no one, including us, can change or delete it during its retention period; separate accounts that can't see one another's data; and logs that never record the names or dates of birth screened. The measures are described further in our privacy notice.
6. Sub-processors
You authorise us to use these sub-processors:
| Sub-processor | What it does | Where |
|---|---|---|
| Microsoft (Azure) | Hosts the service, its database and its records | UK (UK South, London) |
Microsoft 365, which sends the service's emails, and Stripe, which takes payment, receive none of the personal data this addendum covers. Companies House and the list publishers are sources of public information, not sub-processors. An AI assistant your people connect is yours to choose, under your own terms with its provider; it is not our sub-processor. We give each sub-processor data protection terms at least as protective as these, and remain responsible to you for it. We will email you at least 30 days before adding or replacing one; if you object on reasonable grounds and we can't meet the objection, you may end the agreement without charge.
7. Transfers outside the UK
We keep the personal data in the UK. We will not transfer it outside the UK without a safeguard UK GDPR allows, such as UK adequacy regulations or the UK International Data Transfer Addendum, and we will tell you first. Trailhead Design Limited is a Canadian company; its people reach the data in the UK from Canada, which the UK recognises as giving adequate protection for commercial organisations.
8. Helping you
- People's rights. The service lets you find, print and export every screening you have made. If someone asks us directly about data we hold for you, we will pass the request to you and not answer it ourselves, and we will help you answer it.
- Breaches. We will tell you without undue delay, and within 48 hours of becoming aware, of a personal data breach affecting your data, with what we know of it, and keep you informed as we learn more, so you can meet your own duty to report it.
- Assessments. We will give you the information you reasonably need for a data protection impact assessment, or to consult the Information Commissioner, about the service.
9. At the end
The service's purpose is a record you can rely on: each screening record and results file is kept for six years from the screening, locked against change or deletion, and then deleted. By using the service you instruct us to keep them for that time; neither of us can delete them earlier. When the agreement ends, we stop all other processing: we keep each screening record and results file for the rest of its six years, locked against change or deletion, then delete it, and we can give you a copy of your records on request before then. Names you asked us to watch stop being watched when the agreement ends.
A light account's checks are not kept at all: they are screened and answered, and only a count of checks is kept. A certificate offer's held request is deleted 24 hours after it was made unless it is bought; once bought, it is cleared, and the certificate is kept as a screening record like any other.
10. Showing we comply
We will give you the information you reasonably need to show we meet this addendum, and answer reasonable written questions about it. Where that is not enough, you, or an auditor bound to confidentiality, may audit our compliance once a year, on 30 days' notice, at your cost, in a way that does not reach other customers' data or disrupt the service.
11. Liability and law
The limits on liability in the terms apply to this addendum. It is governed by the law of England and Wales, as the terms are.