Data Processing Agreement
Post Sorted (post.wcg.digital) Last updated: 3 November 2026
This Data Processing Agreement (“DPA”) forms part of the Post Sorted Terms and Conditions between Woodrup Creation Group Ltd (“Processor”, “we”) and the Firm (“Controller”, “you”). It satisfies Article 28 UK GDPR.
1. Definitions
“UK GDPR”, “Data Protection Act 2018”, “personal data”, “processing”, “data subject”, “controller”, “processor” and “personal data breach” have the meanings given in UK data protection law.
“Client Data” means the personal data contained in post and documents you send to Post Sorted, and any data we extract from it.
2. Details of processing
| Subject matter | Scanned inbound post received by the Controller on behalf of its clients |
| Duration | For the term of the subscription, plus the deletion period in section 9 |
| Nature and purpose | Receiving, splitting, classifying, extracting data from, filing and notifying about scanned correspondence |
| Type of personal data | Names, addresses, contact details, tax references (UTR, NI number, VAT number, company number), financial information (amounts owed, penalties, bank details), correspondence content. May incidentally include special category data where it appears in correspondence (e.g. health-related reasons in an HMRC appeal) |
| Categories of data subject | The Controller’s clients, their directors, employees and contacts; HMRC and other correspondents |
3. Processor obligations
We will:
- process Client Data only on your documented instructions, which are: to provide the Post Sorted service as described in the Terms, and any further written instructions you give us. We will tell you if we think an instruction breaches data protection law
- ensure everyone with access to Client Data is bound by confidentiality
- implement the technical and organisational measures in Annex 1
- not transfer Client Data outside the UK except as set out in section 6
- assist you with data subject requests, data protection impact assessments and consultations with the ICO, so far as reasonably possible
- delete or return Client Data at the end of the service as set out in section 9
- make available the information needed to demonstrate compliance, and allow audits as set out in section 8
4. Controller obligations
You confirm that:
- you have a lawful basis to process Client Data and to engage us as processor
- you have given your clients the information required by Articles 13 and 14 UK GDPR, including that you use third-party processors for correspondence handling
- your instructions to us comply with data protection law
- you will review the output of the service and remain responsible for the accuracy of any action taken on it
5. Sub-processors
You give general authorisation for the sub-processors listed in Annex 2. We will give you at least 30 days’ notice before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve it, you may terminate the affected service without penalty.
We impose the same data protection obligations on sub-processors as this DPA imposes on us, and remain liable for their performance.
6. International transfers
Primary storage and processing is in the United Kingdom (Google Cloud europe-west2, London).
Where a sub-processor processes Client Data outside the UK, we ensure an appropriate safeguard is in place: the UK–US Data Bridge, the ICO International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
AI processing of document content uses Google Cloud Vertex AI (Gemini) through its London (europe-west2) regional endpoint, so documents are processed in the UK. Vertex AI prompt data caching is disabled for our project, documents are not retained by the AI service after processing, and Google does not use customer data to train its models.
Client emails are sent from the Firm’s own Microsoft 365 or Google Workspace mailbox, which the Firm connects and controls; those services act for the Firm, not as our sub-processors.
7. Personal data breach
We will notify you without undue delay, and in any case within 48 hours, of becoming aware of a personal data breach affecting Client Data. The notification will include the nature of the breach, the categories and approximate number of data subjects and records affected, likely consequences, and the measures taken. We will cooperate with you on any notification to the ICO or data subjects.
8. Audit
Once per year, on 30 days’ written notice, you may audit our compliance with this DPA, either by reviewing our written responses and supporting evidence, or, where that is insufficient, by an on-site or remote audit conducted during business hours and in a way that does not disrupt our business or expose other customers’ data. Where we hold a relevant certification (e.g. Cyber Essentials, ISO 27001), its report satisfies the audit for the matters it covers.
9. Deletion and return
- Scanned documents are deleted from our systems on the retention schedule you set in your account (default 90 days after processing, minimum 7 days, maximum 12 months). Extracted data filed into your practice management system remains in that system under your control.
- On termination, we delete all Client Data within 30 days, unless UK law requires retention. On request made before that, we will export your Client Data to you first.
- Backups are overwritten within a further 30 days.
- We will confirm deletion in writing on request.
10. Liability
Liability under this DPA is subject to the limitations in the Terms and Conditions. Nothing in this DPA limits liability for a breach of data protection law that cannot be limited.
11. Precedence
If this DPA conflicts with the Terms, this DPA prevails on data protection matters.
Annex 1: Technical and organisational measures
- Encryption: TLS 1.2 or higher in transit; AES-256 at rest for storage and databases.
- Access control: production access restricted to named personnel, multi-factor authentication enforced, least-privilege roles, access reviewed quarterly.
- Tenant isolation: each Firm’s data is logically segregated; no cross-tenant queries are possible from the application layer.
- Logging: all access to Client Data and all administrative actions are logged and retained for 12 months.
- Secrets: integration tokens and credentials held in a managed secrets store, encrypted, rotated on revocation.
- Hosting: Google Cloud Platform UK region, which holds ISO 27001, SOC 1/2/3 and Cyber Essentials Plus.
- Backups: encrypted daily backups, retained 30 days, tested for restore quarterly.
- Vulnerability management: dependencies monitored and critical patches applied within 14 days.
- Personnel: all staff with access bound by confidentiality and trained on data protection.
- Incident response: documented process, tested annually.
- Data minimisation: AI processing receives only the document content needed for classification and extraction; no persistent copies are retained by the AI provider.
Annex 2: Sub-processors
| Sub-processor | Service | Location | Safeguard |
|---|---|---|---|
| Google Cloud Platform (Google Cloud EMEA Ltd) | Hosting, storage, compute, secrets, and AI document classification and data extraction (Vertex AI Gemini) | UK (London) | UK processing; AI data caching disabled; no training on customer data |
| Twilio Inc. (incl. SendGrid) | Receipt of scanned post by email; transactional email and SMS notifications | US / EU | UK–US Data Bridge / IDTA |
| [Payment provider] | Subscription billing | UK / EU | No Client Data processed |
Current list maintained at post.wcg.digital/sub-processors.