Data Processing Agreement

Deadline Diary — client watchlist processing

GMS Suite Ltd (Processor) and the Customer (Controller)

Last updated 23 July 2026 · Version 1.0

Background

(A) GMS Suite Ltd operates a software service called Deadline Diary (the "Service"), by which a professional accountancy firm maintains one or more named watchlists of the Companies House registration numbers of the companies it wishes to monitor, and receives email alerts — on a per-watchlist schedule it chooses — when a monitored company's published statutory-compliance data changes (for example its annual accounts, confirmation statement, director/PSC identity-verification status under the Economic Crime and Corporate Transparency Act 2023, company status, and other registered details).

(B) In operating the Service, GMS Suite Ltd processes three distinct categories of personal data in three distinct capacities. This Agreement governs only one of them — the Customer's watchlists of company numbers and labels — for which GMS Suite Ltd acts as the Customer's processor. The other two categories (the Customer's own account data, and the live director/PSC data read from the public register) are processed by GMS Suite Ltd as an independent controller and are outside this Agreement; they are addressed in the Deadline Diary Privacy Notice, not here. This division is set out expressly in clause 2 and is fundamental to the allocation of responsibility between the parties.

(C) The parties enter into this Agreement to comply with Article 28 of the UK GDPR, which requires the relationship between a controller and its processor to be governed by a binding written contract containing the terms set out in Article 28(3)(a)–(h). Article 28(9) permits that contract to be concluded "in writing, including in electronic form"; the parties conclude it electronically as described in clause 15.

1. Definitions and interpretation

1.1 Defined terms. In this Agreement:

• "Agreement" means this Data Processing Agreement, including its Schedules.
• "Charges" means any fees payable by the Customer for the Service under the Terms. The Service is currently provided free of charge.
• "Customer" means the accountancy firm, or the individual acting on its behalf, that creates and holds a Deadline Diary account and accepts this Agreement.
• "Customer Personal Data" means Personal Data Processed by GMS on behalf of the Customer under this Agreement, being such Personal Data as is contained in, or is capable of identifying an individual from, (a) the Companies House registration numbers and free-text labels the Customer enters into or imports to its watchlists, and (b) the company-level compliance snapshots GMS derives from and stores against those watchlist entries. It does not include the Customer's account data or the live-fetched register director/PSC data, both of which GMS Processes as a controller (see clause 2.4). The categories are further specified in Schedule 1.
• "Data Protection Legislation" means the UK GDPR; the DPA 2018; the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"); and all other legislation and regulatory requirements in force from time to time in the United Kingdom relating to the processing of Personal Data and to privacy, together with any guidance or codes of practice issued by the Information Commissioner.
• "GMS" means GMS Suite Ltd, a company incorporated in England and Wales (registered office as shown on the Companies House public register), with ICO registration number ZC130423.
• "Services" or "Service" means the Deadline Diary service described in the Background and in the Terms.
• "Sub-processor" means any third party engaged by GMS to Process Customer Personal Data on GMS's behalf in connection with the Service.
• "Terms" means the Deadline Diary Terms of Service accepted by the Customer, of which this Agreement forms part.
• "UK GDPR" has the meaning given in section 3(10) of the DPA 2018 (Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as modified by the DPA 2018 and by the Data (Use and Access) Act 2025).

1.2 Article 4 terms. The terms "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing" (and "Process", "Processed"), "Special Category Data" and "Supervisory Authority" have the meanings given to the equivalent terms in Article 4 of the UK GDPR. "Supervisory Authority" means the Information Commissioner.

1.3 Interpretation. References to a statutory provision include that provision as amended or re-enacted. In the event of any conflict between this Agreement and the remainder of the Terms in respect of the Processing of Customer Personal Data, this Agreement prevails; in all other respects the Terms prevail. The Schedules form part of this Agreement.

2. Roles, scope and the limits of this Agreement

2.1 Roles. As between the parties, in respect of Customer Personal Data the Customer is the Controller and GMS is the Processor. The Customer determines the purposes and means of the Processing; GMS has no purpose of its own in respect of the watchlists and Processes them only to deliver the Service the Customer has instructed.

2.2 Compliance of each party. Each party shall comply with its obligations under the Data Protection Legislation. Nothing in this Agreement relieves the Customer of its own responsibilities as Controller, including its obligation to have a lawful basis under Article 6 for the Processing it instructs and, where its watchlist labels contain the Personal Data of its clients or their representatives, to provide those individuals with any transparency information required by Articles 13–14.

2.3 Sufficient guarantees. GMS declares, and the Customer accepts, that GMS provides sufficient guarantees to implement appropriate technical and organisational measures such that the Processing meets the requirements of the UK GDPR and ensures the protection of the rights of Data Subjects, as required by Article 28(1). The measures are set out in Schedule 2.

2.4 What this Agreement does not cover (the controller carve-out). This Agreement governs the watchlist flow only. GMS acts as an independent Controller, and this Agreement does not apply, in respect of:

  (a) the Customer's account data — the name, firm, email address, IP address and login history GMS collects to create, authenticate and secure the account and to send the alerts; and

  (b) the live public-register director/PSC data — the director and PSC names and their identity-verification status that GMS reads from the Companies House public register live at the moment of display and does not store.

GMS decides, of its own volition and for its own purposes, to fetch the register data in (b); it is not Processed on the Customer's behalf and is not Processed on the Customer's instruction. Because GMS determines the purposes and the means of that Processing, and does not act on behalf of the Customer in respect of it, GMS is a Controller of that data under Article 4(7)–(8) UK GDPR — a processor is defined by processing "on behalf of" a controller, and no such relationship exists for flow (b). That characterisation is reinforced by Article 28(10) UK GDPR, under which a party that determines the purposes and means of Processing is to be treated as a Controller in respect of it. Accordingly, that data cannot be, and is not, brought within an Article 28 processor agreement. GMS's role, lawful basis (Article 6(1)(f) legitimate interests, supported by a legitimate-interests assessment) and transparency obligations (Article 14) for (a) and (b) are set out in the Deadline Diary Privacy Notice. The Schedules to this Agreement therefore describe only the watchlist flow and must not be read as extending to register lookups or to any director/PSC name.

2.5 Scope acknowledgement. The parties acknowledge that a watchlist entry consisting solely of a company registration number relating to a body corporate is not, of itself, Personal Data (Recital 14 UK GDPR excludes information relating to legal persons). Because the labels are free-text and may name or single out an individual (for example a sole trader, a sole-director company, or a named contact), the parties adopt this Agreement as a deliberate protective measure covering the watchlists in their entirety, without prejudice to whether any particular entry constitutes Personal Data.

3. Duration and survival

3.1 Duration. This Agreement takes effect when the Customer accepts it (clause 15) and continues for as long as GMS Processes Customer Personal Data — that is, for the life of the Customer's Deadline Diary account and until GMS has deleted or returned all Customer Personal Data in accordance with clause 11.

3.2 Survival. Clauses 5 (confidentiality), 11 (return or deletion), 12 (records and audit), 13 (warranties and indemnity), 14 (liability) and 16 (general) survive termination or expiry of this Agreement to the extent necessary to give them effect.

4. Processing only on documented instructions (Article 28(3)(a))

4.1 Documented instructions. GMS shall Process Customer Personal Data only on the documented instructions of the Customer, including with regard to transfers of Customer Personal Data to a third country, unless required to do so by domestic law to which GMS is subject; in that case GMS shall inform the Customer of the legal requirement before Processing, unless that law prohibits such information on important grounds of public interest. The Customer's documented instructions comprise this Agreement, the Terms, and the Customer's configuration and use of the Service (including the company numbers and labels it adds, imports or removes across its watchlists, and its per-watchlist alert preferences).

4.2 Scope of instruction. GMS shall not Process Customer Personal Data for any purpose other than performing the Service and complying with its obligations under this Agreement and the Data Protection Legislation. For the avoidance of doubt, GMS shall not sell Customer Personal Data, and shall not use it for advertising, profiling or any product-improvement purpose of its own; the email alerts GMS sends are transactional messages sent in performance of the Service and are not marketing. Any advertising shown within the Service is directed at the Customer's account holder and does not use, and is not targeted by reference to, Customer Personal Data; if GMS in future engages any advertising, analytics or similar third party in a way that would give it access to Customer Personal Data, that party must first be authorised as a Sub-processor under clause 7 and added to Schedule 3.

4.3 International transfers. GMS shall not transfer Customer Personal Data outside the United Kingdom except (a) as necessary to provide the Service through a Sub-processor authorised under clause 7, and (b) where a transfer mechanism valid under Chapter V of the UK GDPR (as amended by the Data (Use and Access) Act 2025) applies to that transfer — namely (i) a transfer approved by regulations under Article 45A UK GDPR (which regulations must satisfy the "data protection test" in Article 45B), including a transfer to the European Economic Area under the UK's transitional approval and, where the recipient is certified, the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework); or (ii) an appropriate safeguard under Article 46 UK GDPR that secures the data protection test (such as the ICO International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses). The transfer mechanism relied on for each Sub-processor is stated in Schedule 3.

4.4 Instructions that infringe the law. GMS shall immediately inform the Customer if, in its opinion, an instruction given by the Customer infringes the UK GDPR or other domestic law relating to data protection. GMS is not obliged to act on an instruction it reasonably considers unlawful, and may suspend the affected Processing until the instruction is withdrawn, amended or confirmed, without liability.

5. Confidentiality of personnel (Article 28(3)(b))

5.1 Commitment to confidentiality. GMS shall ensure that each person authorised to Process Customer Personal Data — including its director and any employee, agent or contractor — is subject to a documented and enforceable duty of confidentiality in respect of that data (whether a contractual confidentiality undertaking or an appropriate statutory obligation of confidence). GMS shall not rely on a director's general duties under the Companies Act 2006 as the confidentiality commitment required by this clause.

5.2 Need-to-know and authority. GMS shall limit access to Customer Personal Data to those personnel who need it to perform the Service, and shall ensure that any natural person acting under its authority who has access to Customer Personal Data does not Process it except on the Customer's instructions, unless required to do so by domestic law (Article 32(4)).

6. Security of Processing (Article 28(3)(c) / Article 32)

6.1 Security measures. Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of Processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, GMS shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as appropriate the measures referred to in Article 32(1)(a)–(d). The measures GMS currently implements are set out in Schedule 2, which is a minimum and not an exhaustive statement of GMS's Article 32 obligation.

6.2 Assessing appropriate security. In assessing the appropriate level of security, GMS shall take account in particular of the risks presented by Processing, especially accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

6.3 Ongoing review. GMS shall keep its security measures under review and may update them from time to time provided the updated measures do not materially reduce the overall level of protection of Customer Personal Data.

7. Sub-processors (Article 28(2), (3)(d) and (4))

7.1 General written authorisation. The Customer gives GMS its general written authorisation to engage Sub-processors to Process Customer Personal Data, subject to this clause 7. The Sub-processors authorised as at the date the Customer accepts this Agreement are those listed in Schedule 3 — currently Hetzner Online GmbH (hosting and infrastructure, European Union), Google (Google Workspace — transactional and alert email), Backblaze Inc. (encrypted off-site backup, ciphertext only), and Anthropic PBC (AI developer tooling used for support, maintenance and fault diagnosis, United States).

7.2 Notice of changes and right to object. GMS shall inform the Customer of any intended change concerning the addition or replacement of a Sub-processor, giving the Customer at least 30 days' prior notice in writing (which may be by email to the account email address or by notice within the Service), thereby giving the Customer the opportunity to object to the change. The Customer may object on reasonable data-protection grounds within 14 days of the notice. If the parties cannot resolve the objection within a reasonable period, the Customer's sole remedy is to terminate the affected part of the Service, and this Agreement in respect of it, on written notice.

7.3 Flow-down of equivalent terms. Where GMS engages a Sub-processor, it shall do so under a written contract imposing on the Sub-processor the same data-protection obligations as are set out in this Agreement, in particular providing sufficient guarantees to implement appropriate technical and organisational measures so that the Processing meets the requirements of the UK GDPR.

7.4 Continuing liability. Where a Sub-processor fails to fulfil its data-protection obligations, GMS remains fully liable to the Customer for the performance of that Sub-processor's obligations.

8. Assistance with Data Subject rights (Article 28(3)(e))

8.1 Assistance. Taking into account the nature of the Processing, GMS shall assist the Customer by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Customer's obligation to respond to requests by Data Subjects exercising their rights under Chapter III of the UK GDPR (including access, rectification, erasure, restriction, objection and, where applicable, portability).

8.2 Forwarding requests. If GMS receives a request from a Data Subject that relates to Customer Personal Data, GMS shall not respond to it directly (other than to acknowledge receipt where appropriate) but shall forward it to the Customer without undue delay, so that the Customer, as Controller, may respond.

8.3 Means of assistance. The Service provides self-service functions by which a signed-in Customer can view, amend and delete its watchlist entries, export all of its stored data as a JSON file, and delete its own account, all from the Settings area; GMS shall make reasonable use of these functions to assist the Customer within the time limits in Article 12(3).

9. Assistance with security, breach notification, DPIAs and prior consultation (Article 28(3)(f))

9.1 Assistance. Taking into account the nature of Processing and the information available to GMS, GMS shall assist the Customer in ensuring compliance with the Customer's obligations under Articles 32 to 36 of the UK GDPR, namely:

  (a) security of Processing (Article 32);

  (b) notification of a Personal Data Breach to the Information Commissioner (Article 33) and communication of a Personal Data Breach to affected Data Subjects (Article 34) — see clause 10;

  (c) data protection impact assessments (Article 35); and

  (d) prior consultation with the Information Commissioner (Article 36).

9.2 Reasonable scope. GMS's assistance obligation under this clause is limited to matters within its role as Processor and the information reasonably available to it; the primary responsibility for the Customer's own DPIAs and regulatory engagement remains with the Customer.

10. Personal Data Breach notification (Article 33(2))

10.1 Notification to the Customer. GMS shall notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.

10.2 Content of notification. The notification shall describe, to the extent then known and insofar as it concerns Customer Personal Data: the nature of the breach (including, where possible, the categories and approximate number of Data Subjects and records concerned); the name and contact details of a point of contact at GMS; the likely consequences of the breach; and the measures taken or proposed to address it and to mitigate its possible adverse effects. Where the information cannot be provided at once, it may be provided in phases without further undue delay.

10.3 Relationship to the Customer's own clock. The parties acknowledge that the Customer, as Controller, is itself subject to the 72-hour notification obligation to the Information Commissioner in Article 33(1), which runs from the Customer becoming aware of the breach; the shorter period in clause 10.1 is designed to give the Customer time to meet it. GMS shall not notify the Information Commissioner or any Data Subject about a breach of Customer Personal Data on the Customer's behalf unless the Customer instructs it to do so in writing.

11. Return or deletion on termination (Article 28(3)(g))

11.1 Choice of return or deletion. On termination or expiry of the Service, at the choice of the Customer (to be exercised by written notice within 30 days of termination; in the absence of a choice, GMS shall delete), GMS shall delete or return all Customer Personal Data to the Customer and delete existing copies, unless domestic law requires GMS to store the Customer Personal Data.

11.2 Timing. GMS shall complete the deletion or return of live Customer Personal Data within 30 days of termination (or of the Customer's choice, if later). Customer Personal Data contained in GMS's encrypted, off-site backups is not immediately erased but ages out of the ordinary backup-rotation cycle within 90 days; during that period it remains encrypted (ciphertext only) and is not accessed or Processed for any purpose other than backup integrity, and is then irretrievably deleted through rotation.

11.3 Certification. GMS shall, on the Customer's written request, confirm in writing that it has complied with this clause.

12. Records, information and audit (Article 28(3)(h))

12.1 Information to demonstrate compliance. GMS shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 and in this Agreement, and shall allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer.

12.2 Modality. GMS's obligation under clause 12.1 shall be satisfied in the first instance by GMS providing relevant documentation (including its records of Processing, its description of technical and organisational measures, and its Sub-processor contracts, redacted as necessary) and written responses to the Customer's reasonable data-protection enquiries.

12.3 On-site inspection. Where documentation is insufficient to demonstrate compliance, the Customer (or its mandated auditor, who must not be a competitor of GMS and must be bound by confidentiality) may conduct an on-site inspection, limited to once in any 12-month period (save where an inspection is required following a Personal Data Breach affecting Customer Personal Data, or where the Information Commissioner requires it), on 30 days' prior written notice, during business hours, in a manner that does not disrupt GMS's operations or compromise the security or confidentiality of other customers' data, and at the Customer's own cost.

12.4 Instructions that infringe. GMS shall immediately inform the Customer if, in its opinion, an instruction relating to this clause infringes the Data Protection Legislation (see also clause 4.4).

13. Controller's obligations, warranties and indemnity

13.1 Warranties. The Customer warrants and undertakes that: (a) it is either the Controller of the Customer Personal Data or is duly authorised by the Controller to instruct the Processing under this Agreement; (b) it has a valid lawful basis under Article 6 of the UK GDPR for the Processing it instructs, and has provided any transparency information required, and (where consent is the lawful basis relied on) has obtained any consent required, in respect of any individual whose Personal Data appears in a watchlist label; (c) its instructions to GMS are lawful and will not cause GMS to breach the Data Protection Legislation; and (d) it is entitled to monitor each company number it adds, and doing so breaches no duty of confidence it owes to its own clients.

13.2 Indemnity. The Customer shall indemnify GMS against all losses, claims, damages, liabilities, fines, costs and expenses (including reasonable legal costs) arising out of or in connection with any breach by the Customer of clause 13.1, subject to and capped in accordance with clause 14.

14. Liability

14.1 Liability that cannot be limited. Nothing in this Agreement or the Terms limits or excludes either party's liability for: (a) death or personal injury caused by its negligence; (b) fraud or fraudulent misrepresentation; (c) any liability owed to a Data Subject under Article 82 of the UK GDPR (the right to compensation), which as against the Data Subject cannot be excluded or limited by any agreement between the parties; (d) any administrative fine or penalty imposed on a party by the Information Commissioner under Article 83 of the UK GDPR or the DPA 2018, which no agreement between the parties can limit, exclude or reallocate away from the party on whom it is imposed; or (e) any other liability that cannot lawfully be limited or excluded.

14.2 Aggregate cap. Subject to clause 14.1, each party's total aggregate liability arising under or in connection with this Agreement and the Terms together (whether in contract, tort including negligence, breach of statutory duty or otherwise) is limited to the greater of (a) the total Charges paid by the Customer in the 12 months preceding the event giving rise to the claim and (b) £1,000. This is a single aggregate cap shared with the Terms; this Agreement does not create a separate or additional cap. The parties agree this is a fair and reasonable allocation of risk, having regard to the nature and pricing of the Service, the fact that the Service is a monitoring aid over public register data and not the authoritative source (the Customer remaining responsible for verifying each deadline against the Companies House register), and the availability to the Customer of its own professional indemnity insurance.

14.3 Apportionment of regulatory liability. As between the parties, and without prejudice to clause 14.1(c) and (d), each party is responsible for any compensation payable under Article 82, and for any administrative fine, to the extent the breach is attributable to that party's own acts or omissions, in accordance with Article 82(2)–(5) of the UK GDPR (which governs recovery between a controller and a processor after either has compensated a Data Subject in full).

15. Acceptance, form and electronic conclusion (Article 28(9))

15.1 Written form in electronic form. This Agreement is concluded in writing, in electronic form, as expressly permitted by Article 28(9) of the UK GDPR ("The contract or the other legal act referred to in paragraphs 3 and 4 … shall be in writing, including in electronic form"). No wet-ink signature is required for the Agreement to bind the parties.

15.2 How the Customer accepts. The Customer accepts this Agreement by an unambiguous affirmative act at account creation. Sign-up is self-service: the Customer enters its name and work email, and GMS emails a single-use, time-limited link. On the Deadline Diary onboarding page reached by following that link — which verifies the Customer's control of the mailbox — the Customer sets a password and is presented with links to the then-current version of this Agreement, the Terms and the Privacy Notice, and must tick an acceptance checkbox that is not ticked by default and submit the form before the account is created. Submitting the form with the box ticked constitutes the Customer's agreement to be bound by this Agreement.

15.3 Evidence of acceptance (accountability). At the moment of acceptance GMS records, as an append-only entry, the identity of the accepting account and email, the version and a cryptographic hash of the exact document accepted, and the date, time, IP address and user-agent of acceptance. GMS retains that entry for the life of the account. When the account is deleted, GMS reduces the retained entry to the minimum needed as evidence of acceptance — the accepting account identity and email, the document version and hash, and the date and time — and discards the IP address and user-agent; it keeps that minimised record for a period of at least six years from acceptance (aligned to the limitation period for a contract claim under section 5 of the Limitation Act 1980), as evidence of the formation of this Agreement and in support of its accountability obligations. Where GMS materially changes this Agreement, continued use of the Service is gated behind re-acceptance of the new version, which is recorded as a fresh entry without overwriting the prior one.

15.4 Authority. The individual accepting this Agreement warrants that they are authorised to accept it on behalf of the Customer firm.

16. General

16.1 Variation. GMS may amend this Agreement on reasonable notice where required to reflect a change in the Data Protection Legislation, a change of Sub-processor made under clause 7, or a change to the Service; any such amendment takes effect through the re-acceptance mechanism in clause 15.3. No other variation is effective unless agreed in writing.

16.2 Order of precedence. This Agreement is incorporated into and forms part of the Terms. Clause 1.3 governs any conflict.

16.3 Severance. If any provision of this Agreement is or becomes illegal, invalid or unenforceable, it shall be deemed modified to the minimum extent necessary to make it valid; if that is not possible, the provision shall be deemed deleted, and the deletion shall not affect the validity of the rest of this Agreement.

16.4 No waiver. No failure or delay by a party to exercise any right is a waiver of it.

16.5 Third parties. Except that a Data Subject retains such rights as the UK GDPR and the DPA 2018 confer directly on them, a person who is not a party to this Agreement has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce any of its terms.

16.6 Notices. Notices under this Agreement may be given by email to the Customer's account email address and to GMS at hello@simplinuity.com, and by notice within the Service.

16.7 Governing law and jurisdiction. This Agreement, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it, is governed by the law of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

Schedule 1 — Details of the Processing (Article 28(3) chapeau)

This Schedule specifies the Processing of Customer Personal Data (the watchlist flow) as required by the chapeau to Article 28(3). It describes only that flow; it does not describe, and must not be read as extending to, the Customer's account data or the live-fetched public-register director/PSC data, which GMS Processes as a Controller outside this Agreement (clause 2.4).

Schedule 2 — Technical and organisational measures (Article 32)

GMS implements the following technical and organisational measures for the Processing of Customer Personal Data, appropriate to the risk under Article 32(1):

1. Data minimisation. Person-level register data (director/PSC names) is fetched live and is never written to disk. Stored data is limited to the Customer's account record, the Customer's chosen watchlists (company numbers and labels), company-level compliance snapshots (dates and status codes, no names), authentication sessions, sign-in attempts, onboarding and password-reset links, access-request records and operational records.

1. Encryption in transit. All connections to the Service are served over TLS/HTTPS; a strict Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff and a same-origin referrer policy are applied to every response.

1. Encryption of backups at rest. Off-site backups are written to Backblaze B2 client-side encrypted (rclone crypt); the backup provider holds ciphertext only and never the decryption key, which is held solely by GMS and escrowed off-server.

1. Access control and authentication. Accounts are created by self-service sign-up: the prospective account holder enters their name and work email, GMS emails a single-use, time-limited link, and following that link (which verifies control of the mailbox) the account holder sets their own password and accepts the Terms, this Agreement and the Privacy Notice. A self-service password-reset flow uses the same single-use-link mechanism. Passwords are stored only as bcrypt hashes (work factor 12) and are never transmitted to or recoverable by GMS. Sessions are held in HttpOnly, Secure, SameSite=Lax cookies scoped to the Service path.

1. Tenant isolation. Every watchlist read and write is scoped to the authenticated account by design, so one Customer's data cannot be read or altered by another.

1. Abuse resistance. Login attempts are rate-limited per email and per IP with lockout, are compared in constant time against a dummy hash to prevent account-enumeration by timing, and cross-site form submissions are rejected by Origin/Referer checks and per-session CSRF tokens.

1. Confidentiality, integrity, availability and resilience. The Service and its database run on infrastructure provided by Hetzner (EU); the database uses write-ahead logging; nightly backups are taken and copied off-site (measure 3); an operational heartbeat and health endpoint make a silently-failed daily run detectable by external monitoring, supporting timely restoration of availability.

1. Storage limitation by automated purge. Personal data with a bounded useful life is purged automatically by the daily job: sign-in attempts after 90 days, spent or expired sign-up and invitation links after 30 days, access-request records after 180 days, dropped-alert records after 180 days, and alert-history records – including the text of alert emails sent – after 180 days; sign-ups where a password is never set are purged after a short grace period; and expired sessions are purged continuously.

1. Security review. GMS reviews the security measures at least annually and after any material change to the Service, and updates them in line with clause 6.3.

1. Personnel confidentiality. Personnel with access are bound by the confidentiality commitment in clause 5.

Schedule 3 — Authorised Sub-processors (Article 28(2), (4))

The Customer's general written authorisation under clause 7.1 extends to the following Sub-processors as at the date of acceptance. GMS will give notice of any change under clause 7.2. This Schedule describes each Sub-processor's Processing of Customer Personal Data (the watchlist flow) only; the Customer's account data is Processed by GMS as an independent Controller and is outside this Agreement (clause 2.4).

*End of Data Processing Agreement.*

Version 1.1