Data processing agreement

Last updated: 26 October 2026

This agreement sets out how SupplierVault handles personal data for our customers, as required by Article 28 of the UK GDPR. It forms part of our terms of service and applies automatically to every customer: there's nothing to sign. If you'd like a signed copy for your records, email hello@suppliervault.co.uk.

1. Who this agreement is between

• You: the organisation that uses SupplierVault, as the controller of the personal data you put into it.
• Us: Gary Callaway, trading as SupplierVault, a sole trader, of 61 Harcourt Gardens, Bath, BA1 4DL, United Kingdom, as your processor. We are registered with the Information Commissioner's Office, registration number ZC262506.

Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018 ("data protection law").

This agreement covers the personal data we process for you in providing SupplierVault. It doesn't cover the account and billing details we hold about you as a customer, or our website visitors. We are the controller of those, and our privacy notice explains how we handle them.

2. What we process and why

The details of the processing (its subject matter, purpose, the types of personal data and the people it's about) are set out in the annex at the end of this agreement.

3. Your instructions

• We only process the personal data on your documented instructions. Your instructions are these terms, this agreement, and the choices your organisation makes in SupplierVault (for example, sending a form to a supplier, switching on the AI assistant or connecting your accounting software).
• We won't use your data for our own purposes, sell it, or use it to train AI models.
• If the law requires us to process the data in another way, we'll tell you first, unless the law prevents us from telling you.
• If we think an instruction breaks data protection law, we'll tell you straight away.

4. Your responsibilities

You are responsible for having a lawful basis for the personal data you put into SupplierVault, for telling people how it's used where required, and for only entering what you need. SupplierVault isn't designed for special category data (such as health information) or criminal offence data, and you shouldn't enter it unless you have a lawful basis and have checked SupplierVault's security is suitable. Full bank account numbers and IBANs must not be entered: SupplierVault holds only the last 4 digits.

5. Confidentiality

Anyone we authorise to process your data is bound by a duty of confidentiality and only has the access they need to provide and support the service. We don't open your organisation's records unless we need to (for example to fix a problem, to help when you ask us, or where the law requires it).

6. Security

We take appropriate technical and organisational measures to protect your data, as required by Article 32 of the UK GDPR. They include:

• Your records, uploaded documents and sign-in accounts are held with Supabase in London, UK, and encrypted at rest and in transit (all connections use HTTPS).
• Each organisation is separated at the database level. Row-level security on every table means a signed-in person can only read the organisations they belong to.
• Roles and, on the Professional and Enterprise plans, access by area and teams limit what each person can see and change. These rules are checked by the database itself, not just by the app.
• Sign-in with email and password, or with Microsoft or Google where switched on for the customer. Passwords are stored hashed. Your admins can require two-step sign-in for everyone and make company sign-in the only way in, both enforced in the database.
• A tamper-evident audit trail records who did what and when. Entries can't be edited or deleted.
• Only the last 4 digits of bank account numbers are stored.
• Suppliers never get into your workspace: each supplier contact gets a time-limited portal link that only shows what you chose to send.
• Backups are kept by our hosting provider and overwritten on a rolling basis.

More detail is in Security and your data. We review these measures and may improve them, but we won't reduce the overall level of protection.

7. Sub-processors

• You give us general authorisation to use the sub-processors listed on our sub-processors page.
• We'll tell you at least 30 days before we add or replace a sub-processor, by email to your organisation's admins and by updating that page. You can object on reasonable data protection grounds within those 30 days. We'll work with you to address it, and if we can't, you can end your subscription before the change takes effect.
• Each sub-processor is bound by a written contract with data protection obligations that give at least the same protection as this agreement. We remain responsible to you for their work.

8. Transfers outside the UK

Your records are held in the UK. Where a sub-processor processes personal data outside the UK (as listed on the sub-processors page), we only allow it where it's protected by safeguards recognised under UK data protection law, such as UK adequacy regulations, the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

9. Helping you with people's rights

If someone asks us directly to exercise their data protection rights over data you control, we'll pass the request to you without undue delay and won't respond to it ourselves unless you ask us to. Most requests can be handled by you in the app, for example by exporting, correcting or deleting a supplier's records. Where you can't do something yourself, we'll help you respond, taking into account the nature of the processing.

10. Personal data breaches

• If we become aware of a personal data breach affecting your data, we'll tell your organisation's admins without undue delay, and where possible within 48 hours.
• We'll tell you what we know about what happened, the data and people likely to be affected, the likely consequences, and what we're doing about it. Where we don't know everything straight away, we'll send updates as we find out more.
• We'll help you meet your own duties to report a breach to the ICO and tell the people affected.

11. Other help we give you

Taking into account the nature of the processing and the information we have, we'll help you with data protection impact assessments and any consultation with the ICO that relate to SupplierVault.

12. Audits and information

• We'll give you the information you reasonably need to show that we meet our obligations under this agreement, including answering your security and due-diligence questionnaires.
• If that isn't enough, you (or an independent auditor you appoint who is bound by confidentiality) can audit our compliance. Please give us at least 30 days' notice, and no more than one audit in any 12 months unless a regulator requires it or there has been a personal data breach. You pay your own costs. Audits of our sub-processors are carried out by relying on their own independent certifications and reports.

13. When the service ends

• Before you close your organisation, you can export your registers and reports from the app, or ask us for a copy of your data.
• After an organisation is closed, we delete its data within 30 days. Backups are overwritten within 7 days after that.
• We won't keep a copy unless the law requires us to.

14. Liability and how this agreement fits with our terms

• The limits of liability in section 13 of our terms of service apply to this agreement, except where the law doesn't allow liability to be limited.
• If anything in this agreement conflicts with the terms of service on data protection, this agreement takes priority.
• This agreement lasts for as long as we process personal data for you.
• We may update this agreement, for example to reflect changes in the law. We'll tell you at least 30 days before a significant change takes effect, and we won't reduce the protection it gives your data.
• This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex: details of the processing

Questions about this agreement: hello@suppliervault.co.uk.