Data processing agreement
Last updated 5 November 2026
When you use the paid service, Subscription Law processes your subscribers' personal data on your instructions. This agreement sets out the terms required by Article 28 of the UK GDPR. It forms part of our terms of service for every paid plan.
Parties
| Role | Party |
|---|---|
| Controller | The customer named on the Subscription Law account: [customer legal name, company number and registered address] |
| Processor | Subscription Law is a trading name of AI Programs Holdings Ltd, a company registered in England and Wales (company number 17516543). Registered office: 128 City Road, London, EC1V 2NX. ICO registration number ZC280525. |
1. What we process
| Detail | Description |
|---|---|
| Subject matter | Operating the subscription contracts compliance process for the controller's consumer subscriptions |
| Duration | For as long as the controller has an account, plus the retention period in section 7 |
| Nature and purpose | Reading subscription data from the controller's billing system; scheduling, sending and recording notices; hosting a cancellation route; calculating refunds; keeping evidence records |
| Data subjects | The controller's subscribers and trial users |
| Categories of data | Name, email address, phone number where SMS is used, billing country, subscription and payment details (plan, amounts, dates, status), consent records, notice and delivery records, cancellation and refund records |
2. Our duties as processor
- We process the data only on your documented instructions, which include these terms, your account settings and the operation of the service, unless the law requires otherwise, in which case we tell you first where we can.
- Everyone who processes the data for us is bound by confidentiality.
- We keep the data secure: encryption in transit and at rest, encrypted billing credentials, access limited to named staff, logging, backups, and tested restore.
- We help you respond to data subjects exercising their rights, and we help you meet your duties on security, breach notification and impact assessments, taking into account what we know.
- We tell you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to notify the regulator.
- At the end of the service we delete or return the data as you choose, except where the law requires us to keep it, and we tell you what we keep.
- We make available the information needed to show we meet these duties, and allow audits you reasonably request, at reasonable notice and no more than once a year unless a breach has occurred.
3. Your duties as controller
You confirm that you have a lawful basis for the processing, that your privacy notice covers it, that your instructions comply with data protection law, and that you have the right to give us the data, including through your billing system connection.
4. Sub-processors
You authorise the sub-processors below. We will tell you at least 30 days before adding or replacing one. If you object on reasonable data protection grounds and we cannot resolve it, you may end the service and we will refund any period paid for and not used.
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe Payments Europe Ltd and Stripe Inc | The controller's own billing system; we read subscription events from it and write cancellations and refund back | Ireland and the United States, under Stripe's standard contractual clauses |
| Email delivery provider | Sending notices and returning delivery, bounce and complaint signals | United Kingdom or European Economic Area; named in the dashboard |
| Hosting provider | Running the service, the database and the evidence store | United Kingdom |
| SMS provider (Scale plan only, when enabled) | Sending SMS notices | United States, under standard contractual clauses; named in the dashboard |
| Google LLC | Analytics on this website only, after visitor consent; no subscriber data | United States, under standard contractual clauses |
5. International transfers
We keep subscriber data in the United Kingdom. Where a sub-processor is outside the United Kingdom, the transfer is covered by the UK International Data Transfer Agreement or the Addendum to the EU standard contractual clauses, as noted above.
6. Security measures
- TLS for every connection; AES-256-GCM encryption of billing credentials at rest with rotatable keys.
- Row-level separation of each customer's data by organisation on every table and query.
- Append-only, hash-chained evidence records that cannot be edited.
- Two-step sign-in for every staff member and administrator; sessions that expire; sign-out everywhere.
- Daily encrypted backups and periodic restore tests.
7. Retention and deletion
Evidence records (notices as sent, delivery signals, cancellations, refunds and the event log) are kept for 7 years by default because they are the controller's evidence of a compliant process; the controller may set a different period in the dashboard. Other subscriber data is deleted within 30 days of the account closing, or on request. Backups roll off within 35 days.
8. Liability and term
Liability under this agreement is subject to the limits in our terms of service. This agreement lasts as long as we process your data and ends when the data is deleted or returned.
To put this agreement in place for your business, your account details are entered in the dashboard and the completed agreement is available to download there. Questions: hello@subscriptionlaw.co.uk.