Data processing agreement.

Version 1.3, 26 October 2026. Earlier versions, and the version a firm agreed to, are available from [email protected].

1. About this DPA

1.1 This Data Processing Agreement is between the business named in the Order (“you”, the controller) and TG Digital Ltd, a private limited company registered in England and Wales (company number 17518734), registered office Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE (“we”, the processor). It forms part of the agreement made up of the Order and the Trojan CRM customer terms (the Terms), and applies whenever we process personal data for you.

1.2 “Data protection law” means the UK GDPR, the Data Protection Act 2018 and other UK law on personal data. Words such as controller, processor, personal data, processing, data subject and personal data breach have the meanings given in the UK GDPR.

1.3 Annex 1 describes the processing. Annex 2 describes our security measures. Annex 3 lists our sub-processors. On anything about personal data, this DPA prevails over the Terms.

2. Your responsibilities as controller

2.1 You decide what personal data goes into the Service and why. You are responsible for having a lawful basis for it, for telling the people concerned how you use their data, and, for health information (such as declarations for zero-rated disabled adaptation work), for having a condition under Article 9 of the UK GDPR that permits it.

2.2 You have the rights and obligations of a controller under data protection law, including to give us instructions under clause 3.

3. Processing only on your instructions

3.1 We process personal data only on your documented instructions, including about transfers outside the United Kingdom. Your instructions are: this agreement; your use of the Service and its settings, including sending documents, connecting other services, and asking for exports or erasure; and any other written instructions we agree with you.

3.2 If the law requires us to process personal data in some other way, we will tell you before doing so, unless the law forbids that.

3.3 We will tell you immediately if we believe an instruction breaks data protection law.

4. Confidentiality

4.1 Everyone we authorise to process your personal data (today, our two directors) is bound by a duty of confidentiality, and anyone we authorise in future will be too.

5. Security

5.1 We take the technical and organisational measures required by Article 32 of the UK GDPR, described in Annex 2. We may improve them, but will not change them in a way that materially reduces the protection of your personal data.

6. Sub-processors

6.1 You give us general written authorisation to use the sub-processors in Annex 3.

6.2 We will tell you by email at least 30 days before we add or replace a sub-processor. You may object on reasonable data protection grounds within 10 working days of our notice. If we cannot resolve your objection, you may end the agreement before the change takes effect, and we will refund any Fees paid for the period after it ends.

6.3 Each sub-processor is bound by a written contract with data protection obligations equivalent to those in this DPA. We remain responsible to you for our sub-processors.

7. Requests and complaints from data subjects

7.1 The Service gives you tools to answer requests from the people whose data you hold: to export everything about one of your clients, to correct records, and to erase a client while keeping what the law requires you to keep.

7.2 If a request or complaint about your data reaches us, we will pass it to you within 5 working days and will not answer it ourselves, except to say we have passed it on.

7.3 We will give you reasonable help, free of charge, to respond to requests and complaints, taking into account the nature of the processing.

8. Personal data breaches

8.1 We will tell you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your personal data. We aim to tell you within 24 hours.

8.2 We will tell you, as far as we know it at the time: what happened; the categories and approximate numbers of people and records concerned; the likely consequences; what we have done and propose to do; and who to contact. We will send further information as we learn it.

8.3 We will help you meet your own duties to notify the Information Commissioner and the people affected. Those decisions are yours, and we will not notify them about your data unless you instruct us to in writing.

8.4 Telling you about a breach is not an admission of fault.

9. Other help

9.1 Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your obligations under Articles 32 to 36 of the UK GDPR: security, breach notification, data protection impact assessments and consulting the Information Commissioner.

10. Return and deletion

10.1 You can download all of your data, including personal data, at any time. When the agreement ends you have 30 days to do so (clause 15.6 of the Terms).

10.2 After those 30 days, or sooner if you instruct us in writing, we delete all of your personal data, including your copy of the Service, its database, files, email sending account and suppression list. Backups containing it expire within a further 35 days: we keep a nightly backup of each firm’s database for 35 days, so that a removal made by mistake can be undone, and our hosting provider keeps its own backup of the database cluster for 7. Our email provider’s records of the emails sent for you are not deleted with them: they expire under its own retention period, 30 days after each email on our plan. We keep no copies unless the law requires us to, and will confirm the deletion to you in writing.

11. Information and audits

11.1 We will make available to you all information necessary to show that we meet our obligations under Article 28 of the UK GDPR, including our records of processing and a description of our security measures.

11.2 Once in any 12 months, you may send us a written questionnaire about our compliance with this DPA. We will answer it within 30 days.

11.3 We will allow for and contribute to audits, including inspections, by you or an auditor you appoint who is bound by confidentiality:

1. at most once in any 12 months, unless there has been a personal data breach affecting your data or the Information Commissioner requires it;
2. on at least 30 days’ written notice, during working hours;
3. at your own cost;
4. limited to your personal data and our systems and processes for it, never another customer’s data.

12. Where data is held

12.1 Your personal data is held in the United Kingdom, with one exception: our email provider, Resend (Annex 3), sends the emails the Service sends in your name from Ireland and keeps its records of them (recipient, subject, content and delivery status) in the United States. That transfer relies on the UK Extension to the EU-US Data Privacy Framework, with the UK International Data Transfer Addendum in Resend’s own terms as a fallback. We will not transfer your personal data outside the United Kingdom in any other way except on your instructions and with a safeguard that data protection law recognises. Where a sub-processor may access it from outside the United Kingdom to provide support or keep its service secure, that access is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Agreement or Addendum.

13. Records, liability and duration

13.1 We keep the records of processing that Article 30(2) of the UK GDPR requires.

13.2 Each party’s liability to the other under this DPA is subject to the limits in clause 14 of the Terms. This does not limit either party’s liability to data subjects or to the Information Commissioner.

13.3 This DPA lasts for as long as we process personal data for you.

Annex 1: Description of the processing

Annex 2: Security measures

• Separation: each customer has its own copy of the Service, its own database with its own credentials, its own file store with a key that reaches it alone, and its own key for sending email. Customers’ data is never held together.
• Location: application, database and files hosted in London, United Kingdom; email sent through Resend (Annex 3).
• Encryption in transit: all pages over HTTPS, with HSTS; the database connection encrypted and verified against the provider’s certificate authority.
• Accounts: passwords stored only as scrypt hashes, with common passwords refused, at least 12 characters (or 8 with two-step sign-in); two-step sign-in (a code from an authenticator app, or a single-use recovery code) required for every Admin and available to every User, with its secret stored encrypted; sign-in attempts rate-limited and locked out after repeated failures; sessions end after 30 minutes idle or 8 hours; sign-in and reset links work once and are stored only as hashes.
• Access within your firm: roles enforced on the server (Admin, Office, Supervisor); site supervisors see only their own jobs and no financial figures; protection against cross-site request forgery.
• Files: uploads checked by their content, not their name; files served only to signed-in Users, never by public link.
• Secrets: connections to your accounting software stored encrypted (AES-256-GCM) under a key unique to your copy of the Service; no secrets in our source code.
• Logs and audit: application logs exclude names, addresses, amounts and other personal data; your database records who changed what.
• Change control: every change is tested and released as a single built image; nobody edits a running system.
• Backups: every night each firm’s database is backed up separately, encrypted, and kept in our own private storage in London for 35 days; each backup is restored into a separate database and checked, table by table, before it counts as good, and a failed or missing backup alerts us. A file deleted or replaced is kept as an old version for 35 days. Our hosting provider also takes a daily backup of the whole database cluster, kept for 7 days. Restores are made by us, into a new database, never over the live one.
• People: access to the systems that run the Service is limited to our two directors.
• Incidents: a written incident response and breach procedure.

Annex 3: Sub-processors

Services you connect yourself, such as your own Xero organisation, Microsoft 365 mailbox or calendar app, are your own providers under your own agreements with them, and are not our sub-processors (clause 12 of the Terms).

Version history

1.3, 26 October 2026: we keep a nightly backup of each firm’s database for 35 days, restore-tested; clause 10.2 says backups containing your data expire within 35 days of its deletion, not 7, and Annex 2 describes the backups.

1.2, 24 October 2026: email is sent through Resend instead of Amazon Web Services; clause 12.1, clause 10.2 and Annexes 1 to 3 say what that means for where data is held and when it is deleted.

1.1, 22 October 2026: Annex 2 adds two-step sign-in and the shorter password it allows.

1.0, 15 October 2026: first version.