Data processing agreement

This Data Processing Agreement ("DPA") forms part of the Yopla Terms of Service.

It applies when Yopla processes personal data on behalf of a customer. In those situations:

• The customer is the Data Controller.
• Yopla is the Data Processor.

This agreement explains how we handle that responsibility.

1. When this applies

This DPA applies when Yopla processes personal data as part of delivering:

• Reports and evidence packs
• Surveys and facilitated sessions
• Workspace collaboration
• System integrations
• AI-supported drafting and analysis

If we are not processing data on your behalf, this DPA does not apply. Our Privacy Policy covers how we handle data as a controller.

2. What we process

Depending on the service, we may process:

• Names
• Email addresses
• Job titles
• Organisational roles
• Survey responses
• Uploaded documents
• Communication transcripts
• System usage data

We process this data only to deliver the agreed services.

We do not sell or trade personal data.

3. Our obligations

When acting as Processor, Yopla will:

• Process data only on your documented instructions
• Keep data confidential
• Apply appropriate technical and organisational safeguards
• Restrict internal access on a role-based basis
• Notify you without undue delay if a data breach occurs
• Assist you with reasonable data subject requests

4. Security

We apply safeguards appropriate to the risk, including:

• Encryption in transit
• Secure cloud hosting
• Access controls
• Audit logging
• Regular monitoring

Security is reviewed periodically as part of our operational governance.

5. Sub-processors

We use trusted infrastructure and service providers where necessary.

These may include:

• Cloud hosting providers
• Email delivery services
• Payment processors
• AI service providers

All sub-processors are bound by contractual data protection obligations.

We remain responsible for their performance.

6. International transfers

Some of our sub-processors operate outside the UK or EEA. Where this is the case, we select providers that maintain recognised transfer safeguards such as adequacy decisions, Standard Contractual Clauses, or International Data Transfer Agreements, as part of their own data protection frameworks.

We review these safeguards periodically but do not separately negotiate transfer instruments with large-scale infrastructure providers.

7. Data retention and deletion

At the end of the service:

• You may request return or deletion of personal data
• Secure backups may remain for a limited retention period
• Fully anonymised data may be retained for benchmarking

8. Audit and compliance

We will provide reasonable information to demonstrate compliance with this agreement.

Formal audits must be proportionate and reasonable in scope.

9. Governing law

This DPA is governed by the laws of England and Wales, consistent with the Terms of Service.

10. Contact and changes

We keep this agreement under review and will publish updates on this page. For questions or requests related to data processing, contact us at team@yopla.co.uk.

You can also view all of our policies on our Trust & responsibility page.