Declarewise: Data Processing Agreement
Last updated 9 October 2026.
1. What this agreement is
This agreement forms part of the Declarewise Terms of Service between your business ("you") and Sperrin Consulting Ltd, company number NI741657, registered office 24 Dromdallagan, Magherafelt, BT45 7EY ("we", "us").
It covers personal data that you put into Declarewise: in the paperwork you upload or send in from Gmail, and in what you type in. For that data you are the controller and we are your processor. You decide why it's processed, and we process it only to run Declarewise for you.
Details of your own users' logins are different. We handle those as a controller, under our Privacy Policy.
The words "personal data", "controller", "processor", "data subject" and "personal data breach" mean what they mean in UK data protection law (the UK GDPR and the Data Protection Act 2018).
2. What we process
Annex A describes the processing: what it's for, how long it lasts, the kinds of personal data and whose they are.
3. We act only on your instructions
We process your personal data only on your documented instructions. These terms, and your use of the product's own features, are those instructions. Uploading paperwork instructs us to store it and read it, for example.
If the law requires us to process it some other way, we'll tell you first, unless the law forbids telling you. If we think an instruction of yours breaks data protection law, we'll tell you.
4. Confidentiality
Only members of Sperrin's own team can reach your data, and only when they need to: to answer a question you've asked, or to find and fix a fault. We require every one of them to keep it confidential.
5. Security
We keep your data protected with the technical and organisational measures in Annex C, and we'll keep them appropriate to the risk as the product changes.
6. Other services we use (sub-processors)
You give us general permission to use the sub-processors listed in Annex B.
Before we add or replace one, we'll email your account owner at least 30 days in advance. If you object on reasonable data protection grounds and we can't meet your objection, you can end the agreement, and we'll refund any fees you've paid for time after it ends.
We put the same data protection obligations as this agreement on each sub-processor, in a written contract. We remain responsible to you for what they do.
7. Data that leaves the UK
Annex B shows where each sub-processor holds data. We only move personal data out of the UK where UK law allows it: to a country the UK recognises as adequate, or under a safeguard the UK approves, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
8. Helping you meet your obligations
If a person asks us directly to see, correct or delete data that belongs to you, we'll pass the request to you promptly and won't answer it ourselves. We'll help you answer it.
We'll also give you reasonable help with your own security obligations, with reporting a breach to the ICO or telling the people affected, and with any data protection impact assessment you carry out that involves Declarewise, taking into account what we do and the information we have.
9. If something goes wrong
If we become aware of a personal data breach affecting your data, we'll tell your account owner without undue delay, and we aim to do so within 48 hours. We'll say what happened, what data and roughly how many people are affected, what we've done about it, and who to speak to. If we don't know everything yet we'll tell you what we know, then update you as we learn more.
10. When the agreement ends
When your account ends you can download your declarations and paperwork first (Terms, section 10). We then delete your personal data within 90 days, unless the law requires us to keep it, and confirm in writing once it's done if you ask. Copies in our database provider's backups expire on their own within seven days.
11. Showing that we comply
We'll give you the information you reasonably need to show that we meet this agreement. If that information isn't enough, you, or an auditor you appoint who is bound to confidentiality, may audit our compliance:
- with at least 30 days' written notice;
- no more than once in any 12 months, unless there has been a breach affecting your data or a regulator requires it;
- at your own cost, during business hours, and without access to other customers' data.
12. Your side
You confirm that you have a lawful basis to give us the personal data in your paperwork, and that you've told the people concerned, in your own privacy notice, that you use service providers like us.
Please don't upload special category data, such as health information, unless a declaration really needs it. Customs paperwork shouldn't.
13. Liability and the rest
Our liability under this agreement is part of, and counts towards, the limits in the Terms of Service (section 13), as far as the law allows. Your responsibility to us in the Terms (section 14) covers personal data you give us that you weren't entitled to share. If this agreement and the Terms disagree about personal data, this agreement wins. It is governed by the law of Northern Ireland.
Annex A: Details of the processing
| Subject matter | Preparing NI supplementary declarations (TSS) from supplier paperwork for goods moved from Great Britain into Northern Ireland |
| Duration | While your account is open, plus the deletion period in clause 10 |
| What we do with it | Receive it (upload, or email through the script in your own Google account); store it; send it to our AI provider to be read; compare it with the UK Trade Tariff and your saved product catalogue; show it to your users; turn it into a draft declaration and a file you can download |
| Purpose | So your business can prepare and check its customs declarations |
| Kinds of personal data | Names, job titles, business addresses, phone numbers and email addresses printed on paperwork; EORI and VAT numbers where the trader is a sole trader or partnership; signatures and handwriting on dockets; vehicle registrations and driver names on delivery paperwork; the email address of whoever sent paperwork in by email, where a sent email can't be read |
| Whose data | Your suppliers, customers, hauliers and carriers, and their staff; your own staff named on paperwork; sole traders |
| Special category data | None expected (see clause 12) |
Annex B: Sub-processors
| Sub-processor | What it does | Where the data is held | Personal data it receives |
|---|---|---|---|
| Supabase Inc | Database, file storage, sign-in | Ireland (EU) | All of it |
| Vercel Inc | Runs the app | London, UK | Passes through while a page or file is served |
| Anthropic PBC | Reads paperwork; suggests commodity codes from product descriptions | United States, under the UK Addendum to the EU standard contractual clauses (part of Anthropic's data processing terms). Under its business terms, deleted within 30 days unless flagged for breaking its usage policy, never used for training | The paperwork itself, and product descriptions |
| Functional Software Inc (Sentry) | Error reports | Germany (EU) | Personal-data collection off. A page address may name a consignment's internal ID, not a person |
| PostHog Inc | Usage counts | Germany (EU) | None by design: all on-screen text masked, no screen recording |
Google is not our sub-processor. If you send paperwork through the Gmail script, it runs inside your own Google account, under your own agreement with Google.
Annex C: Security measures
Keeping companies apart
- Every table that holds your data carries your company's ID, and the database itself refuses to show a row to anyone outside that company (row-level security). It also refuses any change that would move a row to another company.
- Uploaded files sit in a folder named for your company, under the same database rules.
- Our background jobs, which run with wider access, name your company explicitly in every read and write.
- Each company's inbound email route has its own secret token. We keep only a scrambled (hashed) copy, so it can't be read back, even by us.
Signing in
- Passwords must be at least 12 characters, and any password known from public breach lists is refused.
- A bot check runs on sign-in and on password reset.
- Links in invitation and reset emails are used up only when the person presses Continue, so an email security scanner that opens the link can't spend it.
In transit and at rest
- Everything travels over HTTPS.
- The database and file storage are encrypted at rest by our database provider.
- Our database provider backs the database up daily and keeps each backup for seven days.
Monitoring and our own tools
- Errors are reported to Sentry with personal-data collection turned off.
- Analytics mask all on-screen text and never record the screen.
Reading paperwork
- The reader keeps the exact text it read beside every value, so a person can check it.
- A value the reader can't read stays blank. It is never guessed.
Reviewing and responding
- We review these measures at least once a year, and after any incident.
- If we suspect a breach, we contain it, find out what was affected, and tell you under clause 9.