Data Processing Agreement

What changed on 5 November 2026

• Section 6: we added sign-in with a Microsoft 365 account, said that its multi-factor step depends on the Controller’s own tenant, and recommended multi-factor authentication. We also corrected the wording on tenant isolation and rate limiting.

See earlier changes to this DPA.

1. Introduction

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between SAR Portal (powered by Sekhon IT Consultants Ltd.) (“Processor”, “we”, “us”) and the customer (“Controller”, “you”) using our Service.

Processor Details:

• Legal Name: Sekhon IT Consultants Ltd. (trading as SAR Portal)
• Company Registration: Ireland, CRO No. 579894
• Registered Address: 1 Beaufield Crescent, Maynooth, Co. Kildare, Republic of Ireland
• Data Protection Officer: dpo@sarportal.com

This DPA governs the processing of personal data by SAR Portal on behalf of the Controller in accordance with GDPR (Regulation (EU) 2016/679).

2. Definitions

• Personal Data: Any information relating to an identified or identifiable natural person
• Processing: Any operation performed on personal data
• Data Subject: The individual whose personal data is processed
• Sub-processor: Third parties engaged by SAR Portal to process personal data
• Data Breach: Security incident leading to unauthorized access, loss, or disclosure of personal data

3. Scope and Purpose

3.1 Subject Matter

SAR Portal processes personal data on behalf of the Controller for the purpose of providing DSAR management services.

3.2 Categories of Data Subjects

• Data subjects submitting DSARs
• Employees and staff of the Controller
• Third parties mentioned in documents

3.3 Categories of Personal Data

• Contact information (names, email addresses, phone numbers)
• Documents uploaded by the Controller (which may contain special category data)
• Case notes and communications
• Identity verification data
• User account data (name, email, role) and audit trail data (actions, IP address, user agent, timestamps)

3.4 Duration

Processing continues for the duration of the subscription agreement plus data retention periods specified in our Terms.

4. Processor Obligations

SAR Portal agrees to:

• Process personal data only on documented instructions from the Controller
• Ensure staff are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Assist the Controller in responding to data subject rights requests
• Support the Controller in meeting its obligations under Articles 32 to 36 GDPR (security, breach notification, DPIAs and prior consultation with the supervisory authority)
• At your choice, delete or return all personal data at the end of the service (you can export it during the 90-day window), unless Union or Member State law requires us to keep it
• Make available information necessary to demonstrate compliance

4.1 Scope of Instructions

The Controller’s documented instructions are limited to:

• Configuration of the Service via the user interface
• Requests submitted via our support channels
• Instructions documented in this DPA

SAR Portal is not obligated to follow instructions that would violate GDPR or other applicable laws. The Controller’s instructions also cover any transfer of personal data to a third country or an international organisation. We process personal data other than on the Controller’s documented instructions only where Union or Member State law to which we are subject requires it. In that case we will tell the Controller of that legal requirement before processing, unless that law prohibits this on important grounds of public interest. We will immediately inform the Controller if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection law.

5. Sub-processors

5.1 Authorized Sub-processors

The Controller authorizes the use of the following sub-processors:

Application pages, including the public request portal, also load fonts, icons and a script library in the browser from third-party servers: Google Fonts (Google), Font Awesome (Fonticons, Inc., United States) and the jsDelivr CDN. These servers receive the visitor’s IP address and browser details (user agent) when a page loads. They receive no case content, documents or form data. They are not listed above as sub-processors under a signed DPA. Google Fonts (Google LLC) is certified under the EU-US Data Privacy Framework. Fonticons, Inc. is an active participant in the EU-US Data Privacy Framework (listed as “Font Awesome”); it receives the IP address, user agent and referrer, and keeps identifiable data for a few weeks. jsDelivr is operated by Volentio JSD Limited (United Kingdom), covered by the EU adequacy decision for the United Kingdom; the content delivery providers it uses (Cloudflare, Fastly, Bunny and GCore), including in the United States, receive the IP address, browser details and referring domain, and jsDelivr does not name its safeguards for those onward transfers.

5.1.1 Development Tools (no customer personal data)

Customer production data and personal data are prohibited from general development assistants, coding tools and non-production AI services. Technical and organisational controls enforce separation between production data and non-production development environments.

We do not use any AI assistant on customer production data. If we ever add one, we will list it here and give you 30 days’ notice first (section 5.2).

Our developers also use an AI coding assistant (Anthropic, US) for development work only. It does not process customer personal data and is not a sub-processor. Our rules forbid giving it customer personal data, and an automated check blocks its commands against our production resources.

5.2 Changes to Sub-processors

We will email the tenant Admin contact 30 days before adding or replacing a sub-processor. The Controller may object within 14 days, by writing to dpo@sarportal.com. If we cannot offer a reasonable alternative, either party may end the agreement on 90 days’ notice, during which you can export all your data.

5.3 Sub-processor Obligations

Where we engage a sub-processor, we impose on it, by a written contract, the same data protection obligations as those in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of the GDPR (Article 28(4) GDPR). If a sub-processor fails to fulfil its data protection obligations, we remain fully liable to you for the performance of that sub-processor’s obligations.

6. Security Measures

SAR Portal implements the following technical and organisational measures:

• Encryption at rest (AES-256) and in transit (TLS 1.2+, HTTPS enforced with HSTS)
• Authentication via Azure Entra External ID (OAuth 2.0 / OpenID Connect): users sign in with their organisation’s Microsoft 365 account, a Google account or a one-time code sent to their email; SAR Portal stores no passwords. SAR Portal does not add or enforce a multi-factor step of its own: Google sign-ins follow the multi-factor settings of the user’s Google account or the Controller’s Google Workspace policy; for Microsoft 365, any multi-factor step depends on how the Controller’s tenant treats sign-ins to an outside application; and a one-time email code is a single factor whose security depends on how the Controller protects that mailbox. We recommend that the Controller requires multi-factor authentication on these accounts and mailboxes
• Role-based access control (RBAC) with four defined roles (Admin, Case Manager, Reviewer, Read Only)
• Secrets management via Azure Key Vault
• Logical tenant isolation: your case, document and audit data is stored by tenant and limited to your tenant on the server, enforced in our application code and not by the database; a few platform functions, such as sign-in lookups, provider webhooks and scheduled jobs, read across tenants by design. Documents are kept in a shared storage container in a separate folder for each tenant, and the application checks every storage path against the tenant’s folder. Tenants are separated logically within shared EU-hosted resources, not by dedicated databases or containers
• Every change is built and tested automatically and is deployed to Dev and UAT before a manually approved Production release; our procedure requires a check for vulnerable packages at every release and at least monthly
• Rate limiting on public API endpoints, such as registration, the contact form, public downloads and verification; webhooks are verified by signature
• Our coding rules require personal data (emails, phone numbers, names, financial data) to be masked with our log sanitiser before it is written to our application logs. This is a rule our code follows, not an automatic filter. Application telemetry records the signed-in user’s account identifier (Microsoft Entra object ID). Security-event logs and web server logs (kept for 3 days) include IP addresses for security
• Continuous database backup with 7-day point-in-time restore, held in West Europe; a second copy of documents in North Europe (Ireland)
• Security headers (CSP, HSTS, and others)

7. Data Breach Notification

In the event of a data breach, SAR Portal will:

• Notify the Controller within 24 hours of becoming aware (Processor → Controller notification window, faster than the 72-hour Controller → DPC obligation under GDPR Article 33, to give Controllers time to fulfil their onward obligations)
• Provide details of the breach, affected data, and remediation steps
• Cooperate with the Controller’s investigation and notification obligations
• Document all breaches and actions taken

8. Data Subject Rights

SAR Portal will assist the Controller in responding to data subject requests for:

• Access to personal data
• Rectification of inaccurate data
• Erasure of personal data
• Restriction of processing
• Data portability
• Objection to processing

9. International Transfers

Case data and documents are stored in Microsoft Azure West Europe (Netherlands), with a second copy of documents in North Europe (Ireland). AI processing runs in Azure Sweden Central. Case content stays in the EEA. A few supporting services may process limited account, billing or technical data outside the EEA under Standard Contractual Clauses or the EU-US Data Privacy Framework: Microsoft Graph (your users’ names and emails, for invitations), Google reCAPTCHA (browser signals from people using our website forms and application pages, including your request forms) and Stripe (billing). None of them receive case content or documents. Microsoft Entra External ID keeps directory data in the EU, and Twilio SendGrid email is sent from its EU regional account; their terms allow limited transfers outside the EEA, for example security and fraud signals or vendor support in exceptional cases, under the Microsoft and Twilio data protection terms (SCCs). Except for the browser-loaded font, icon and script files described in section 5.1, whose transfer basis is stated there, any transfers outside the EU are protected by:

• Standard Contractual Clauses (SCCs): We use the European Commission’s 2021 SCCs (Decision 2021/914) for any transfers to third countries
• Named EU regions: our Azure services run in West Europe (Netherlands) and North Europe (Ireland), and our AI runs in Azure Sweden Central on regional deployments
• Adequacy Decisions: Where applicable, transfers may rely on adequacy decisions (e.g., UK, Switzerland)
• UK Transfers: For customers subject to UK GDPR, restricted transfers are covered by the UK International Data Transfer Addendum to the EU SCCs, or the UK IDTA where applicable

9.1 Sub-Processor Transfers

All our sub-processors either:

• Process data exclusively within the EU/EEA, or
• Are covered by the EU-US Data Privacy Framework and/or the Standard Contractual Clauses in their data processing agreements, with supplementary measures where required

You may request copies of relevant SCCs by contacting dpo@sarportal.com.

10. Data Retention and Deletion

Upon termination (cancellation, or automatic cancellation after 30 days of non-payment):

• Customer data available for export for 90 days; we email a reminder 10 days before deletion
• All tenant data deleted from our live systems after 90 days; backup copies then expire within 14 days (files) and 7 days (database)
• If the last admin deletes the organisation’s account, tenant data is deleted straight away instead
• Audit logs: we keep a pseudonymised record of activity on the platform (which account did what, and when). Email addresses, IP addresses and user-agent strings are removed, and the record holds no case documents. Some entries can still contain names, for example a changed contact name or a user’s display name. We keep this record as an independent controller, not as your processor, for one purpose: keeping records of our own service delivery and security, and establishing, exercising or defending legal claims about the service. Our lawful basis is legitimate interests (Article 6(1)(f) GDPR), and by accepting this DPA you acknowledge and authorise this separate processing. We do not use these logs for anything else. Each entry is set to expire at the end of your organisation’s audit-log retention period (7 years by default; on request we can set a period of 3 to 10 years for your organisation, which applies to entries written after the change), counted from when the entry was last written; pseudonymising an entry restarts the period. The 7-year default reflects the 6-year limitation period for contract and tort claims under the Statute of Limitations 1957, plus time to issue and serve proceedings. Entries under a legal hold for an actual or expected claim are kept while the hold applies and for the full retention period after it is released. Our Privacy Policy explains this processing to your users
• Billing records: Irish tax law requires us to keep them for at least 6 years; we keep them for 7 years from the transaction date

11. Audits

The Controller may audit SAR Portal’s compliance with this DPA. We will allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, on reasonable notice and subject to confidentiality. We will provide:

• Access to relevant documentation
• Responses to compliance questionnaires
• On request: our Cyber Essentials and Cyber Essentials Plus certificates, our latest security self-assessment, and Microsoft Azure’s ISO 27001 and SOC 2 reports (through Microsoft’s Service Trust Portal). SAR Portal does not have its own ISO 27001 or SOC 2 audit report

12. Liability

Liability for data protection breaches is governed by the Terms of Service and applicable law, including GDPR Article 82.

13. Contact

For DPA-related inquiries:

• Data Protection Officer: dpo@sarportal.com
• Legal: legal@sarportal.com