CllrWay Ltd

Data Processing Agreement

Version 1.0
Effective date: The date the Customer accepts this version in CllrWay
Issued by: CllrWay Ltd · Company number 17445449
Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Data protection enquiries: info@cllrway.com

This Data Processing Agreement (the Agreement) forms part of the terms governing the Customer's use of CllrWay. It describes how CllrWay Ltd protects personal information processed on the Customer's instructions and sets out the parties' responsibilities under UK data protection law.

The parties

Processor: CllrWay Ltd (CllrWay, we or us).

Controller: The individual councillor identified in the electronic acceptance record, acting in their own capacity as a data controller (Customer or you). This Agreement does not automatically bind the Customer's council, political party, a candidate, or another organisation. Where another person or organisation determines the purposes and essential means of processing, the correct controller arrangements must be established separately.

Formation: This Agreement takes effect when the Customer accepts the approved version using CllrWay's recorded electronic acceptance process. The agreement version and acceptance evidence are recorded and a copy remains available to the Customer.

1. Definitions and interpretation

1.1 Applicable Data Protection Law means the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended, the Privacy and Electronic Communications (EC Directive) Regulations 2003 where applicable, and other applicable UK data protection and privacy requirements.

1.2 Customer Personal Data means personal information processed by CllrWay on behalf of the Customer through the service, including authorised resident records, casework, correspondence, surveys, electoral data, canvassing information, documents and associated operational metadata. It excludes information for which CllrWay independently determines the purposes and essential means as described in clause 2.4.

1.3 DataSet means a customer-controlled collection of records and associated permissions in CllrWay. DataSet Owner means the account holder entitled under the service's ownership rules to administer and explicitly delete that DataSet. Operational ownership does not, by itself, settle legal controllership under data protection law.

1.4 Documented Instructions means this Agreement, its Schedules, the Customer's lawful configuration and use of the service, and any other written instructions agreed with CllrWay and capable of being retained as a record.

1.5 Personal Data Breach, controller, processor, processing, sub-processor and other defined data protection terms have the meanings given by Applicable Data Protection Law.

1.6 The five Schedules form part of this Agreement. If there is a conflict with the CllrWay Terms of Use or another customer agreement concerning the processing of Customer Personal Data, this Agreement takes precedence to that extent, subject to mandatory law.

2. Roles, scope and duration

2.1 For Customer Personal Data, the Customer determines the lawful purposes and essential means of processing as controller and CllrWay acts as processor on the Customer's Documented Instructions.

2.2 The subject matter, duration, nature and purposes of processing, categories of individuals and types of personal information are described in Schedule 1. Processing continues for the provision of the service and the lawful return, deletion and residual retention arrangements described in this Agreement.

2.3 An individual councillor's account and DataSets may be shared with authorised colleagues without transferring the DataSet's operational ownership. Such access must be lawful for the relevant information and purpose. A councillor's political affiliation alone does not make their party the controller of their DataSet.

2.4 CllrWay is a separate controller for personal information it uses for its own company activities, including customer relationships, account administration where it determines the purpose, billing, company correspondence, security incident management and contractual acceptance evidence. That processing is described in CllrWay's Privacy Notice and is not governed by these processor obligations.

2.5 Where a Customer acts on behalf of a political party, candidate, council or another controller, this individual-councillor Agreement is not a substitute for the correct controller–processor arrangement for that processing.

3. Customer responsibilities

3.1 The Customer is responsible for identifying and documenting the lawful basis for their processing, providing required privacy information, maintaining accurate and relevant records and applying appropriate retention, disclosure and access rules.

3.2 When processing special-category information (including political opinions or health information) or criminal-offence information, the Customer must establish and document any additional applicable legal condition and safeguards, including an appropriate policy document where required.

3.3 The Customer must lawfully obtain and use any electoral register or information derived from it. The Customer must comply with the electoral legislation and any conditions attached to receipt, use, retention or disclosure. The additional conditions in Schedule 4 apply.

3.4 The Customer determines which colleagues may access their DataSets and must grant, review and revoke access in accordance with applicable law. Granting application access does not itself authorise disclosure between separate controllers or different purposes.

3.5 The Customer must not instruct unlawful processing. Where CllrWay considers that an instruction would infringe Applicable Data Protection Law, CllrWay will inform the Customer without undue delay unless legally prohibited, and may suspend the affected processing while the issue is addressed.

4. Documented instructions and permitted processing

4.1 CllrWay shall process Customer Personal Data only on Documented Instructions, including in respect of international transfers, unless required otherwise by applicable UK law. Where legally permitted, CllrWay shall tell the Customer before carrying out legally required processing that is not instructed by the Customer.

4.2 The Customer's authorised use of the service constitutes instructions to receive, organise, secure, store, retrieve, display, correct, share according to permissions, generate correspondence, manage casework and surveys, support electoral activity, back up, export and delete Customer Personal Data as required to operate the selected functions.

4.3 CllrWay shall not sell Customer Personal Data or use identifiable resident, casework or canvassing information for its own advertising, party-political activities, unrelated product development, or training third-party AI models. Any distinct use requiring CllrWay to determine its own purposes must have a separate lawful basis and appropriate notice or agreement.

4.4 CllrWay is a self-service platform. The Customer uploads and manages their information directly. CllrWay staff do not routinely receive uploaded electoral registers or inspect individual residents' records. Exceptional personnel access required for secure support, incident response or legal compliance shall be restricted, justified and appropriately controlled.

5. Confidentiality

5.1 CllrWay shall ensure that persons authorised to process Customer Personal Data are subject to confidentiality obligations arising by contract or law and receive appropriate instruction on secure handling.

5.2 Authorised personnel access shall be limited to what is necessary for their duties. Confidentiality continues after access ends to the extent required by law and contract.

6. Security of processing

6.1 CllrWay shall implement and maintain technical and organisational measures appropriate to the risks, in accordance with Article 32 UK GDPR, considering the nature of casework, the possibility of sensitive personal data and the risks of multi-customer processing.

6.2 The measures set out in Schedule 2 form part of this Agreement. CllrWay may update measures as technology and threats change, provided the overall protection is not materially reduced. It shall review and test the effectiveness of relevant measures as appropriate.

6.3 The Customer shall also protect credentials and connected mailboxes, manage access grants responsibly and report suspected unauthorised access promptly.

7. Sub-processors

7.1 The Customer grants general written authorisation for CllrWay to engage sub-processors performing the activities set out in Schedule 3, to the extent that those providers act as processors of Customer Personal Data. CllrWay shall maintain a current written provider register identifying applicable providers, purposes, locations and international transfer safeguards and make it available to the Customer.

7.2 CllrWay shall notify the Customer of intended additions or replacements of sub-processors ordinarily at least 30 calendar days before the proposed change and provide a reasonable opportunity to object on data protection grounds. For urgent changes needed to protect security or continuity, CllrWay may give shorter notice where justified and shall inform the Customer as soon as practicable.

7.3 CllrWay shall consider reasonable objections in good faith. Where no workable alternative is available and the objection remains unresolved, the Customer may terminate the materially affected processing and exercise the return or deletion rights under clause 12, subject to accrued payment obligations.

7.4 CllrWay shall impose written data protection obligations on sub-processors that provide a level of protection equivalent to the mandatory obligations of Article 28. CllrWay remains responsible to the Customer for the performance of those obligations by its sub-processors.

7.5 A provider acting as a separate controller for CllrWay's billing or business processing is not automatically a sub-processor of Customer Personal Data. The Customer's own connected email or identity provider may also be engaged under a separate relationship; its role must be assessed in context.

7.6 General sub-processor authorisation does not override the statutory restrictions concerning the full electoral register. The limits in Schedule 4 apply to any processing or disclosure of that material.

8. International transfers

8.1 CllrWay shall make or permit a restricted international transfer of Customer Personal Data only on Documented Instructions and where an applicable lawful transfer route is available, including relevant UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum or another permitted mechanism.

8.2 CllrWay shall document relevant hosting, support and transfer arrangements and shall provide the Customer with information reasonably necessary for the Customer's transfer assessment, where required.

8.3 The selection of a UK or EEA hosting region does not, of itself, determine the location of every support, backup or communication activity. Relevant arrangements are covered by the provider information supplied under Schedule 3.

9. Individual rights and data protection complaints

9.1 Taking account of the nature of the processing, CllrWay shall assist the Customer through appropriate technical and organisational measures to respond to requests to access, correct, erase, restrict or port personal information and to objections or other applicable rights.

9.2 Where CllrWay receives a request or complaint about Customer Personal Data, it shall, where reasonably possible and legally permissible, direct it to or notify the relevant Customer without undue delay. CllrWay shall not independently decide the Customer's substantive response unless instructed or required by law.

9.3 CllrWay remains independently responsible for complaints relating to processing for which it is controller. Both parties shall cooperate, as appropriate, with applicable data-protection complaint-handling requirements.

10. Personal Data Breaches and assistance

10.1 CllrWay shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. It shall use available contact details and update the Customer as material information becomes available.

10.2 So far as reasonably available, notifications shall describe the nature of the incident, the affected information and individuals, likely consequences, mitigation and recommended actions, together with a point of contact. CllrWay shall document and investigate relevant incidents.

10.3 Taking account of processing and information available, CllrWay shall assist the Customer with Articles 32–36 UK GDPR obligations, including security, breach reporting, impact assessments and prior consultations where applicable.

10.4 Unless legally required, CllrWay shall not notify individuals or regulators on behalf of the Customer without authorisation. The controller remains responsible for its own regulatory notification decisions.

11. Demonstrating compliance and audits

11.1 CllrWay shall make available information reasonably necessary to demonstrate compliance with Article 28 and shall allow for and contribute to audits or inspections conducted by the Customer or an auditor mandated by the Customer.

11.2 Audits shall be coordinated on reasonable notice, with appropriate confidentiality and security precautions. CllrWay may first supply relevant independent assessments, policies, audit summaries, technical documentation or other evidence. Arrangements shall not frustrate an audit right required by law.

11.3 Neither party is required to disclose another customer's confidential information. The parties shall reasonably cooperate to minimise disruption; any additional charge for extraordinary assistance must be agreed in advance and shall not defeat mandatory legal rights.

12. Data return, deletion and termination

12.1 On expiry or termination of relevant services, CllrWay shall, at the Customer's choice, return or securely delete Customer Personal Data processed on their behalf and delete existing copies, unless applicable UK law requires retention. Reasonable return arrangements shall be available before final deletion.

12.2 The Customer may explicitly delete a DataSet that they own, even where other users have been given access. Other members have no veto over the DataSet Owner's authorised deletion. The application warns of the consequences before carrying out the deletion.

12.3 On authorised DataSet deletion, associated active database records are removed and a minimal deleted-DataSet record may remain for up to 30 days for the deletion lifecycle. Identified associated files are deleted after database changes commit, with recorded retries for eligible failures. A 30-day deleted-DataSet record is not a recovery window.

12.4 Files independently retained under another lawful record or relationship are not automatically deleted merely because they were used in a DataSet. Residual copies in backups, soft-deleted Blob versions or snapshots may remain protected and unavailable for ordinary use until the relevant configured retention cycle ends, unless law requires longer retention.

12.5 Account deletion is distinct from deleting a DataSet. Where the Customer closes an account, the service shall explain the consequences for any DataSets they own and require specific confirmation before those DataSets are deleted. Removing a person's access to another controller's DataSet shall not automatically delete that other controller's records.

12.6 The Customer's ability to obtain a return of Customer Personal Data under clause 12.1 is not limited to any personal-account data download. Where available self-service exports do not cover information reasonably required for return, CllrWay shall arrange proportionate assistance through a secure method.

13. Responsibilities and liability

13.1 Each party remains responsible for its obligations under Applicable Data Protection Law. Nothing in this Agreement transfers the Customer's lawful-basis, transparency or controller obligations to CllrWay, or relieves CllrWay of its statutory processor obligations.

13.2 To the extent permitted by law, contractual liability between the parties is governed by the applicable CllrWay customer terms. Nothing excludes or restricts liability that cannot lawfully be excluded, data-subject rights or powers of a competent regulator.

13.3 No service setting, module entitlement or DataSet permission permits processing or disclosure forbidden by electoral or other applicable legislation.

14. Electronic acceptance, updates and law

14.1 The Customer may accept this Agreement electronically. CllrWay shall record the accepting account, agreement version and document evidence, UTC time and affirmation that the person accepts in their own capacity as controller. The corresponding immutable approved PDF shall remain available for subsequent download.

14.2 Approved versions are preserved. Material changes shall be communicated appropriately and, where required, a new version shall be presented for renewed acceptance. Previously accepted versions are not silently replaced.

14.3 This Agreement is governed by the law of England and Wales, without overriding mandatory data protection law.

---

Schedule 1 — Description of processing

Subject matter. Provision of a hosted councillor casework and workflow platform, including resident records, correspondence, surveys, appointments, ward collaboration and optional electoral and canvassing tools.

Duration. From the Effective Date until the relevant services cease and data is returned, deleted or lawfully retained in accordance with this Agreement.

Nature of processing. Collection through customer entry or upload; receipt; import transformation; organisation; storage; retrieval; display; controlled sharing; communication on instruction; analysis and reporting; backup; correction; export; restriction and deletion.

Purposes. To allow the Customer to carry out their lawful councillor responsibilities and any separately permitted electoral activities using features they select. The Customer determines the specific lawful purposes; CllrWay does not independently use Customer Personal Data to campaign.

Categories of individuals. Residents, electors, household members, correspondents, people referred to in casework, survey respondents, service users, authorised ward colleagues, campaigners and volunteers, and other individuals lawfully included by the Customer. Information may concern children or vulnerable individuals.

Categories of information. Names; postal and email addresses; telephone numbers; council, ward and electoral details; register identifiers; correspondence; issue and case notes; appointment and surgery information; survey responses; canvassing responses; attachments; contact history; permissions; and activity metadata. Depending on usage, records may include health, safeguarding, political opinion or criminal-offence information.

Processing scope. DataSets created and operated by the Customer acting as controller, including DataSets created later while this Agreement is in force. Access granted to colleagues is subject to lawful instructions and the service's permissions. If a DataSet is in fact controlled by an organisation or party, an appropriate distinct controller arrangement is required.

Schedule 2 — Technical and organisational measures

A. Authentication and access. Microsoft identity-based authentication; server-side module and DataSet membership checks; role-based Read, Write and Owner permissions; restricted administrative functions; revocation of user access; secure session configuration. Any MFA requirement depends on the applicable identity and access configuration.

B. Separation of customer information. DataSet-scoped service and query authorisation, checks on direct record-ID requests, restrictions on files, imports, exports and background operations. Access to another DataSet is not granted merely by common ward, council or political-party affiliation.

C. Transport, storage and secrets. HTTPS/TLS for connections; platform-managed encryption at rest for database and Blob Storage; restricted secrets configuration and cryptographic-key management appropriate to deployed settings. CllrWay does not require customers to email full electoral-register files to its personnel.

D. Development and assurance. Dependency and vulnerability review, access-control regression tests, controlled deployment, issue tracking and security review of changes to protected processing paths.

E. Audit and monitoring. Audit records capture relevant actors, timestamps, objects, permissions and changed field names while minimising sensitive field values. Operational application logs are normally retained for 90 days and application audit records for 365 days under the published retention policy, subject to justified exceptions and the operation of the retention controls.

F. Data lifecycle. The resident import pathway processes uploaded files in memory and retains import metadata without ordinarily storing the original upload. Authorised DataSet deletion removes active database records using transactional operations and registers eligible file deletion instructions for post-commit processing and retry. Some files associated with separately retained records have their own lifecycle.

G. Backups and recovery. Access-controlled platform backups, restoration capability and retention according to the configured Azure SQL and Storage settings. Residual copies are protected against ordinary use and age out under applicable retention settings.

H. Incident response and support. Incident monitoring, triage, restricted operational access, breach communication without undue delay and assistance with required controller obligations. Personnel access to identifiable resident content is not routine.

I. Token-based functions. Controlled and scoped access for authorised calendar subscriptions, teller and canvasser links, with expiry or user-initiated revocation appropriate to the token purpose. Calendar feed URLs are bearer credentials and must be kept confidential by the Customer.

Schedule 3 — Service providers and sub-processing arrangements

The services below support CllrWay's operation. A named service is a sub-processor under this Agreement only to the extent it processes Customer Personal Data on CllrWay's behalf; other controller-to-provider relationships are governed separately. CllrWay maintains the operational provider register and provides applicable legal entity, processing location and transfer details to Customers in connection with the authorisation process in clause 7.

Provider / service	Processing purpose	Scope and role
Microsoft Azure (including App Service, Azure SQL and Azure Blob Storage)	Hosting, storing, securing and backing up customer information	Hosting sub-processing for Customer Personal Data, subject to the applicable Microsoft contractual terms
Microsoft Entra ID	Authentication and account identity	Identity-related processing; provider roles depend on the configuration and applicable identity agreements
Hostinger SMTP	Sending configured service or customer-directed email	Email transport where used by CllrWay; message content and recipient details may pass through the service
Microsoft Graph / customer-connected Microsoft mailbox	Customer-authorised connected email functions	Optional, and subject to the Customer's mailbox provider relationship and the specific service data flow

Optional SMS or other communications services shall not be used to process Customer Personal Data through CllrWay unless the applicable provider, its role and relevant information have first been made available to the Customer under clause 7. Subscription payment services such as Stripe, when handling CllrWay's own customer billing, are ordinarily part of CllrWay's separate controller activities and are not included merely by virtue of processing payments.

CllrWay shall make the current applicable provider information available to the Customer and notify changes as described in clause 7. The above authorisation does not itself permit onward disclosure of restricted full-register information where electoral legislation prohibits it.

Schedule 4 — Full electoral-register and canvassing information

4.1 Permitted use. The full electoral register and information derived from it may be used only by persons entitled to receive it and for the purposes permitted by the applicable electoral legislation and conditions of supply. It is distinct from the open register. Lawful electoral canvassing is not prohibited by this Agreement.

4.2 Use of a processor. Regulation 92(7) of the Representation of the People (England and Wales) Regulations 2001 allows specified entitled recipients to use a processor for relevant authorised purposes. Regulation 92(9) places restrictions on disclosure by the processor. Nothing in this Agreement enlarges that entitlement or permits disclosure to another user or sub-processor where restricted by law.

4.3 Customer instructions. Before upload, the Customer must establish and retain the authority under which the register was obtained, the source and relevant date, the electoral purpose, the intended users and any restrictions. CllrWay may require an appropriate declaration or supporting instructions for restricted processing.

4.4 Self-service import. The Customer imports register information directly through the authenticated service. The ordinary import pathway processes files in memory and retains import history rather than a routine copy of the uploaded file. The Customer must not disclose the register by sending it to CllrWay staff as an ordinary support attachment.

4.5 Access and sharing. Full-register information may be accessed, shared or exported only to recipients lawfully entitled to receive it for the permitted purpose. DataSet membership, a shared ward or the same political affiliation is not sufficient by itself to override statutory disclosure restrictions.

4.6 Purpose separation. Electoral-register and canvassing records must not be treated as an unrestricted source of information for unrelated casework or another controller's purposes. Similarly, sensitive councillor casework must not be reused for political campaigning without a lawful basis and any necessary additional safeguards.

4.7 Political opinions. Canvassing information may reveal or infer political opinions and therefore comprise special-category personal data. The Customer must establish an Article 6 lawful basis and any required Article 9 condition, policy document and safeguards. Conditions available to registered political parties are not automatically available to all individual councillors or campaigners.

4.8 End of permitted use. At the end of authorised processing, the Customer must instruct appropriate return, access restriction or deletion, having regard to applicable electoral and data protection requirements. CllrWay shall support the lawful instruction in accordance with clause 12.

Schedule 5 — Controller identity and evidence of acceptance

The electronic acceptance record forms part of the evidence that this Agreement is binding on the Customer and identifies the version accepted.

Controller identity and capacity: The Customer's account identity and their declaration that they are accepting in their own capacity as a controller of the relevant processing. This does not constitute authority to bind a political party, council or another controller.

Agreement evidence: Approved version label, immutable approved PDF, content and PDF hashes, the time of acceptance in UTC, and the affirmative acceptance action. Technical evidence, where recorded and justified, may include IP address and user agent.

Coverage: DataSets owned and controlled by the accepting councillor for the processing described in Schedule 1, including qualifying DataSets created later, without changing the legal ownership or controller identity of third-party information.

Version history: Each accepted version remains retrievable. A new version requiring renewed acceptance is presented through CllrWay; previous versions are not overwritten.

Retention of evidence: CllrWay retains necessary acceptance evidence for justified contractual or legal purposes in its capacity as a separate controller, according to its applicable retention policy. Unnecessary technical identifiers are minimised on account erasure.

---

CllrWay Ltd · Company no. 17445449
Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ
Data protection enquiries: info@cllrway.com
Document version 1.0 | Effective on recorded acceptance