This Data Processing Agreement ("DPA") forms part of the Terms of Service between Clearpath Labs Ltd - trading as SnapAddress - and the customer. It applies automatically to every account from the moment you create an account or use the Service; no signature is needed. Every version is kept at Previous versions.
For the personal data contained in the address-lookup queries you submit, you are the controller and we are your processor. This DPA is the written processing contract that UK GDPR Article 28 requires for that processing. Your own account, business and billing data, and our website and dashboard analytics, are processed by us as controller and are covered by the Privacy Policy, not by this DPA.
1. Parties and roles
- Processor: Clearpath Labs Ltd (company no. 17145150, registered office 35 Floyer Close, Richmond, England, TW10 6HS), trading as SnapAddress ("we", "us").
- Controller: the customer (the account holder) ("you").
2. Subject-matter, nature and purpose of the processing
Processing of UK address-lookup queries you submit, to provide the Service: postcode and address autocomplete and validation against our own licensed copy of Royal Mail PAF data.
3. Duration
This DPA applies for the term of your account.
4. Types of personal data and categories of data subject
- Personal data: postcodes and partial address data contained in your lookup queries.
- Data subjects: your end users - the people whose addresses are looked up through your application.
We process query content only to answer the request and do not retain it afterwards, with one exception: a postcode or address identifier that could not be found is kept for 14 days, without any link to your account or key, so we can spot gaps in the data. The usage record we keep for billing holds the time, route, result code and whether a credit was spent - not the query. We do not store the addresses returned to your end users.
5. Our obligations as processor (Article 28(3))
We will:
- (a) process the personal data only on your documented instructions (including for international transfers), unless we are required to process it by law - in which case we will inform you before processing, unless the law prohibits it;
- (b) ensure that the people authorised to process the personal data are under a duty of confidentiality;
- (c) implement the technical and organisational security measures required by Article 32 - including encryption of all traffic in transit, production credentials held only in server environments and never in client code, access to production systems limited to our authorised personnel, and request logging that excludes query content;
- (d) engage sub-processors only under the conditions in clause 6;
- (e) assist you, by appropriate technical and organisational measures, to respond to requests from data subjects exercising their rights;
- (f) assist you with your security, breach-notification, data protection impact assessment and prior-consultation obligations, taking into account the nature of the processing and the information available to us;
- (g) at your choice, delete or return the personal data we process on your behalf at the end of the provision of the Service, and delete existing copies unless the law requires us to keep them - because query content is not retained beyond the request (clause 4), this is in practice already done; our own account, billing and licence records are controller records governed by the Privacy Policy, not personal data processed on your behalf;
- (h) make available to you the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate; and
- (i) inform you immediately if, in our opinion, an instruction from you infringes UK GDPR or other data-protection law.
6. Sub-processors
You give general authorisation for us to use the sub-processors listed below for the processing described in clause 2. We will give you at least 30 days' notice by email before any intended addition or replacement takes effect, giving you the opportunity to object; if you object on reasonable data-protection grounds and we cannot resolve it, you may close your account and clause 10 of the Terms applies. Where we engage a sub-processor, we impose data-protection obligations equivalent to those in this DPA, and we remain liable to you for its performance.
- Supabase - authentication and database hosting (UK, London region).
- Vercel - website and dashboard hosting (UK, London region).
- AWS (Amazon Web Services) - address-lookup API infrastructure (UK, London region, eu-west-2).
- Cloudflare - network edge for the address-lookup API: encryption in transit, security and rate limiting (US company; requests are handled at the Cloudflare data centre nearest the caller).
- Sentry - error monitoring and diagnostics for the API; configured not to receive query content, IP addresses or request bodies (EU region).
Stripe and Resend process account, payment and email data for us as controller and are described in the Privacy Policy; they do not process your end users' lookup data and are not sub-processors under this DPA.
Royal Mail is not a sub-processor: it is the licensor and source of the PAF data. We query our own licensed copy of PAF and do not send your lookup queries to Royal Mail.
7. Personal data breach
We will notify you without undue delay after becoming aware of a personal data breach affecting your personal data, and will provide the information you need to meet your own notification obligations (including the 72-hour window for notifying the ICO).
8. International transfers
The sub-processors in clause 6 process lookup data in the UK or the EEA, except Cloudflare, a US company whose network may handle a request outside the UK/EEA. For that transfer we rely on the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge) where Cloudflare's certification covers it, and otherwise on the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses) in Cloudflare's data processing agreement. You may request details of the safeguards relied on.
Contact
Questions about this DPA? Email snapaddress@clearpathlabs.co.uk.