Data processing

Controller or processor

Which role we take depends on the data.

Website enquiries. When you send an enquiry through this site, we are the controller of the information you provide. That is covered by the privacy notice, not by a processing agreement.

Platform engagements. Where we process data on behalf of a client — reporting data submitted to the platform, for example — the client remains the controller and we act as processor. That relationship is governed by the written agreement between us, which includes data protection terms.

What the agreement covers

• the subject matter, duration, nature and purpose of the processing, and the categories of data and data subjects;
• our obligation to process only on the client’s documented instructions;
• confidentiality undertakings from everyone with access;
• the technical and organisational security measures we apply;
• the terms on which sub-processors may be engaged;
• assistance with data subject requests, breach notification and impact assessments;
• deletion or return of data at the end of the engagement;
• audit and information rights.

Security

The technical and organisational measures are described on the trust and security page. We undertake to implement appropriate measures to ensure the security and confidentiality of data processed on a client’s behalf.

Confidentiality

Client information we hold is treated as confidential and is not used for any purpose other than in connection with the services, except where disclosure is required by law, a court, or a regulator. Confidentiality obligations survive the end of an engagement.

Sub-processors and transfers

We engage sub-processors for hosting, delivery and communications, and other companies in the Regtify group may process data in the course of delivering the services. A current list of sub-processors, with the location of each and the transfer mechanism where one is needed, is available to clients and prospective clients on request.

Requesting the documents

For the data processing terms, the sub-processor list or a security questionnaire, write to info@regtify.com with the entity name and the engagement in question.

Last updated: August 2026.