Legal
Data Processing Agreement
Version 1.0 · Last updated August 2026 · Next review August 2027
This Data Processing Agreement (“DPA”) sets out the terms on which LeakIQ Ltd (“LeakIQ”, the processor) processes personal data on behalf of a customer (the controller) under the UK GDPR. It applies whenever LeakIQ processes personal data for a customer, including during a free pilot, and is incorporated as Schedule 1 of the Master Subscription Agreement. Where this DPA conflicts with any other agreement between the parties on the processing of personal data, this DPA prevails.
1. Roles and scope
- The customer is the data controller and determines the purposes and means of processing. LeakIQ is the data processor and processes personal data only on the customer's behalf.
- LeakIQ processes personal data solely to provide its read-only revenue-leakage detection and recovery service (the "Purpose"), and connects to the customer's systems on a read-only basis: it does not alter, write to, or move the customer's data.
- LeakIQ is registered with the UK Information Commissioner's Office under registration number ZC187738.
2. Details of the processing
As required by Article 28(3) of the UK GDPR:
| Element | Detail |
|---|---|
| Subject matter | Read-only revenue-leakage detection and recovery via the LeakIQ platform |
| Duration | For the term of the engagement, plus the deletion period in section 7 |
| Nature of processing | Collection, storage, analysis and display of financial transaction data read from the customer's connected systems |
| Purpose | To detect uncollected or at-risk revenue (payment failures, billing errors, reconciliation gaps and similar) for the customer |
| Types of personal data | Names, business contact details, account identifiers, payment references and transaction metadata relating to the customer's customers, counterparties and staff |
| Categories of data subjects | The customer's customers, subscribers, debtors, counterparties and employees whose data appears in the connected systems |
3. LeakIQ's obligations
LeakIQ shall:
- process personal data only on the customer's documented instructions, including this DPA and the customer's use of the platform, unless required otherwise by law (in which case it will notify the customer first, unless the law prohibits it);
- ensure that persons authorised to process the personal data are bound by confidentiality;
- implement appropriate technical and organisational measures under Article 32 (see section 6);
- not engage a sub-processor without general or specific authorisation (general authorisation is given for the sub-processors in section 4), and impose data-protection terms equivalent to this DPA on each;
- assist the customer, taking account of the nature of processing, in responding to data-subject requests and in meeting its obligations under Articles 32 to 36;
- notify the customer without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting the customer's data;
- at the customer's choice, delete or return the personal data at the end of the engagement, as set out in section 7; and
- make available the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, on reasonable notice.
4. Sub-processors
The customer gives general written authorisation for LeakIQ to engage sub-processors for hosting, database, transactional email and billing. The current list, with each sub-processor's purpose, location and safeguard, is published at leakiq.io/legal/sub-processors.
- LeakIQ imposes data-protection obligations equivalent to this DPA on each sub-processor and remains liable for their processing.
- LeakIQ will give the customer at least 30 days' advance notice of any intended addition or change of sub-processor, during which the customer may object on reasonable data-protection grounds.
5. International data transfers
Personal data is stored at rest within the European Economic Area (Amazon Web Services, eu-west-1, Ireland) via our database provider. Certain processing operations, namely application compute and transactional email, are performed by sub-processors in the United States. Where personal data is processed outside the UK or EEA, it is protected by appropriate safeguards, namely the Standard Contractual Clauses together with the UK International Data Transfer Addendum (or the relevant provider's Data Privacy Framework certification), as set out in each sub-processor's data processing terms. The per-sub-processor position is shown on the sub-processor list.
6. Security measures
LeakIQ maintains technical and organisational measures appropriate to the risk, including encryption of credentials at rest (AES-256-GCM) and data in transit (TLS 1.2 or higher), tenant isolation, role-based access control, enforced multi-factor authentication for privileged access, and a tamper-evident, hash-chained audit log. These measures are described in more detail in the Information Security Policy and technical documentation.
7. Return and deletion
On termination of the engagement, LeakIQ makes the customer's data available for export for 30 days, after which it is deleted, except for copies required by law or held in routine backups, which age out of the backup window and remain subject to this DPA until deleted. Removing a connector deletes its encrypted credential immediately. Full detail is in the Data Retention & Deletion Policy.
8. General
This DPA is governed by the laws of England and Wales and is incorporated as Schedule 1 of the Master Subscription Agreement. LeakIQ Ltd is a company registered in England and Wales (number 17311148), 195 Wood Street, London E17 3NU. Data-protection queries and requests can be sent to support@leakiq.io.