Last updated: 13 March 2026
Applies where: Protego Sol Limited processes personal data on behalf of a customer in connection with the RegulaTrust Services
1. Purpose and Scope
This Data Processing Addendum (the DPA) forms part of the agreement between Protego Sol Limited and the Customer for the provision of the RegulaTrust Services.
This DPA applies where RegulaTrust processes Customer Personal Data on behalf of Customer as a processor or sub-processor under applicable data protection law.
2. Definitions
Customer Personal Data means personal data processed by RegulaTrust on behalf of Customer in connection with the Services.
Data Protection Law means all laws and regulations applicable to the processing of personal data under the agreement, including where applicable the UK GDPR, the Data Protection Act 2018, the EU GDPR, and related national laws.
Controller, Processor, Data Subject, Personal Data Breach, and Processing have the meanings given in applicable Data Protection Law.
3. Roles of the Parties
The parties acknowledge that:
- Customer acts as Controller, or as Processor acting on behalf of another Controller
- RegulaTrust acts as Processor, or where applicable as Sub-processor
Customer is responsible for ensuring that it has a valid legal basis for the processing of Customer Personal Data and for issuing any required privacy notices.
4. Subject Matter and Nature of Processing
RegulaTrust processes Customer Personal Data for the purpose of providing the RegulaTrust Services, including hosting, storage, retrieval, workflow execution, support, security, maintenance, analytics related to service operation, and other processing necessary to deliver the Services.
The duration of processing is the Subscription Term plus any period during which RegulaTrust retains Customer Personal Data in accordance with the agreement, documented instructions, or applicable law.
Categories of Data Subjects may include:
- Customer personnel
- Customer users
- Customer prospects, clients, vendors, or counterparties
- other individuals whose personal data is submitted to the Services by or on behalf of Customer
Categories of Personal Data may include:
- identification data
- business contact data
- account and authentication data
- communications and support data
- content contained in customer-submitted documents, records, workflows, or forms
- technical usage data associated with service operation
Customer controls the categories of personal data it chooses to submit.
5. Customer Instructions
RegulaTrust will process Customer Personal Data only:
- on documented instructions from Customer
- as necessary to provide the Services under the agreement
- as required by applicable law
The agreement, including this DPA, constitutes Customer’s complete and documented instructions at the time of signature, unless the parties agree additional instructions in writing.
If RegulaTrust believes an instruction infringes applicable Data Protection Law, it may inform Customer and suspend the relevant processing until the issue is resolved.
6. Confidentiality
RegulaTrust will ensure that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.
7. Security Measures
RegulaTrust will implement appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
These measures may include, as appropriate:
- encryption in transit
- encryption at rest where applicable
- role-based access controls
- authentication controls
- logging and monitoring
- secure infrastructure configuration
- network restrictions
- backup and recovery measures
- environment segregation
- secure software development practices
Customer acknowledges that security measures are evaluated in light of the state of the art, implementation cost, scope, context, and risks associated with the processing.
8. Assistance to Customer
Taking into account the nature of the processing and the information available to RegulaTrust, RegulaTrust will provide reasonable assistance to Customer with respect to:
- responding to Data Subject requests
- conducting data protection impact assessments where required
- consulting with regulators where required
- demonstrating compliance with Articles 28 to 36 of the GDPR framework or equivalent provisions under applicable law
Where such assistance requires significant time or effort beyond standard service obligations, RegulaTrust may charge reasonable fees.
9. Personal Data Breach Notification
RegulaTrust will notify Customer without undue delay after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data.
The notification will include available information reasonably necessary for Customer to understand the nature of the breach and meet its own legal obligations, such as where available:
- the nature of the incident
- the categories of affected data
- likely consequences
- mitigation steps taken or proposed
RegulaTrust’s notification of a Personal Data Breach is not an admission of fault or liability.
10. Sub-processors
Customer authorizes RegulaTrust to engage Sub-processors to assist in providing the Services.
RegulaTrust’s current sub-processor categories and providers may include:
- Supabase
- Vercel
- Render
- Stripe
- PostHog
- Brevo
- GoDaddy
RegulaTrust will impose data protection obligations on Sub-processors that are materially no less protective than those set out in this DPA, to the extent applicable to the services performed.
RegulaTrust remains responsible for the performance of its Sub-processors to the extent required by applicable Data Protection Law.
Customer may request reasonable information about Sub-processors relevant to the Services.
11. International Transfers
Customer acknowledges that Customer Personal Data may be processed in the European Union and, for certain backups or infrastructure components, the United States.
Where RegulaTrust transfers Customer Personal Data internationally, RegulaTrust will implement appropriate safeguards as required by applicable Data Protection Law, including Standard Contractual Clauses (SCCs) where applicable.
Where UK transfer rules apply, the parties agree that the SCCs will be read together with any required UK addendum or equivalent transfer mechanism where necessary.
12. Audit and Information Rights
RegulaTrust will make available information reasonably necessary to demonstrate compliance with this DPA.
Where such information is not sufficient, Customer may request an audit no more than once per year, subject to the following conditions:
- the audit must be reasonable, proportionate, and limited to matters relevant to Customer’s use of the Services
- Customer must give reasonable prior written notice
- the audit must not unreasonably interfere with RegulaTrust’s business operations or compromise other customers’ rights, security, or confidentiality
- the audit must be conducted under appropriate confidentiality obligations
- RegulaTrust may satisfy the request through existing audit reports, certifications, summaries, or security documentation where appropriate
- Customer must bear its own costs and reimburse RegulaTrust’s reasonable costs where the audit imposes material operational burden
13. Return and Deletion of Data
Upon termination or expiry of the Services, RegulaTrust will delete or return Customer Personal Data in accordance with the agreement and Customer’s documented instructions, unless retention is required by applicable law.
Where the parties have not agreed a different mechanism, RegulaTrust may retain Customer Personal Data for a limited period necessary for backup integrity, dispute resolution, legal compliance, or security purposes, after which deletion will occur in the ordinary course.
14. Liability
Each party’s liability arising under this DPA is subject to the exclusions and limitations of liability set out in the main agreement, except to the extent prohibited by applicable Data Protection Law.
15. Order of Precedence
If there is any inconsistency between this DPA and the main agreement, this DPA prevails with respect to matters concerning the processing of Customer Personal Data.
16. Contact
Questions regarding this DPA may be sent to: