Customer Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between the customer identified in the applicable Cleera account (“Customer”) and Seringa Ltd, trading as Cleera, a company registered in England and Wales (company number 15449830) with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (“Cleera”, “we”, “us”). This DPA supplements, and is incorporated by reference into, the Cleera Terms of Service. By creating a Cleera account, or by continuing to use Cleera after being notified of an updated version of this DPA, an authorised administrator of the Customer accepts this DPA on the Customer's behalf, as recorded in Cleera's systems (see Privacy Policy for how acceptance records are kept).

1. Definitions and interpretation

Capitalised terms not defined in this DPA have the meaning given in the Terms. In this DPA:

• “Data Protection Laws” means the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003, each as amended or replaced.
• “Controller”, “Processor”, “Sub-processor”, “Data Subject”, “Personal Data” and “Personal Data Breach” have the meanings given in the UK GDPR.
• “Customer Data” means Personal Data relating to the Customer's clients, leads, introducers, and adviser or admin users, that the Customer or its users submit to, or that is generated within, the Services.
• “Services” means the Cleera platform as described in the Terms, including any AI-assisted features enabled on the Customer's plan.
• “FCA” means the UK Financial Conduct Authority.

2. Roles of the parties

For Customer Data, the Customer is the Controller and Cleera is the Processor, processing Customer Data only on the Customer's documented instructions. The Customer's instructions are given by its use and configuration of the Services (see Terms §6) and by this DPA. Cleera will promptly inform the Customer if, in Cleera's reasonable opinion, an instruction given by the Customer infringes Data Protection Laws, without obligation to actively monitor the Customer's instructions for this purpose.

The Customer, not Cleera, determines the lawful basis for each processing activity carried out through the Customer's use of the Services (for example contract, legitimate interests, or consent), issues privacy notices to its own clients, leads and introducers, and remains responsible for its own compliance with FCA rules (including SYSC 9 record-keeping and COBS 9A suitability documentation requirements) that apply to its regulated activities.

3. Subject matter and duration

Subject matter: the provision of the Services to the Customer, involving the processing of Customer Data as necessary to deliver case management, client and introducer portals, document collection, e-signature, optional identity verification (where enabled), AI-assisted features (where enabled), outbound integrations the Customer chooses to connect, and related functionality.

Duration: this DPA applies for as long as Cleera processes Customer Data under the Agreement, being the Customer's subscription term plus (a) a 30-day post-termination export window, and (b) any further period during which Cleera is required to retain specific records under Clause 16 (Term, termination and deletion).

4. Nature and purpose of processing

Cleera processes Customer Data to provide: hosting and secure storage of case and client documents; branded client and introducer portals; case and workflow management; dynamic forms and fact-finds; document collection and e-signature; optional identity document and biometric verification for the Customer's own clients (only where the Customer enables this feature and a client actively completes a check); AI-assisted document analysis, extraction, suitability-note drafting and case chat (only where the Customer's plan includes AI features and a Customer user actively triggers them); outbound sync to third-party systems the Customer connects (for example Intelliflo Office); transactional email delivery; property and address look-ups; and audit logging and reporting. Full detail of each processing activity is set out in Annex 1.

5. Types of Personal Data and categories of Data Subjects

The categories of Data Subjects and Personal Data processed are set out in Annex 1. The Customer must not submit special category data (as defined in UK GDPR Article 9) or criminal offence data through the Services other than incidentally, and must take reasonable steps to minimise such data at source. Cleera does not intentionally process special category data through any AI-assisted feature. Where the Customer enables optional identity verification, the images and portrait/liveness data captured may constitute biometric data; the Customer is responsible for determining whether this falls within Article 9 for its use case and for obtaining any consent required before a client's check begins (see Clause 10).

6. Controller obligations

The Customer warrants that it will:

• determine and be able to demonstrate the lawful basis for each processing activity carried out through its use of the Services;
• provide all privacy notices, and obtain all consents, required under Data Protection Laws for its clients, leads, and introducers;
• comply with its own record-keeping and suitability documentation obligations under FCA rules, including SYSC 9 and COBS 9A;
• ensure only authorised users of the Customer have access to the Services, and promptly remove access for individuals who no longer require it;
• promptly notify Cleera of any data protection compliance concern relevant to the Services that comes to the Customer's attention.

7. Processor obligations

Cleera shall, in respect of Customer Data:

• process Customer Data only on the Customer's documented instructions, including in relation to international transfers, unless required to do otherwise by law, in which case Cleera will inform the Customer before processing unless legally prohibited from doing so;
• ensure that persons authorised to process Customer Data are subject to appropriate confidentiality obligations;
• implement appropriate technical and organisational security measures, summarised in Annex 3;
• comply with the conditions for engaging Sub-processors set out in Clause 8;
• taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures with fulfilling the Customer's obligations to respond to Data Subject requests;
• assist the Customer in ensuring compliance with its security, breach-notification, data protection impact assessment, and prior-consultation obligations, taking into account the nature of the processing and the information available to Cleera;
• at the Customer's election, delete or return all Customer Data on termination of the provision of Services relating to processing, and delete existing copies, save to the extent retention is required by law (including FCA SYSC 9);
• make available to the Customer information reasonably necessary to demonstrate compliance with this Clause 7, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to Clause 13 (Audits and inspections).

8. Sub-processors

The Customer generally authorises Cleera to engage the Sub-processors listed in Annex 2 to process Customer Data, provided Cleera imposes data protection obligations on each Sub-processor that are no less protective than this DPA.

Cleera will give the Customer at least 30 days' written notice (by email to the Customer's registered administrator contact, or an in-app or website notice) before appointing a new Sub-processor or replacing an existing one, other than an emergency security-critical change, which will be notified as soon as reasonably practicable afterwards.

The Customer may object to a new Sub-processor on reasonable data protection grounds within 30 days of notice. If the parties cannot resolve the objection, the Customer's sole remedy is to terminate the affected feature of the Services or, if the Sub-processor is fundamental to the Services, the Agreement, without further liability for the unexpired term.

Cleera remains liable for the acts and omissions of its Sub-processors to the same extent Cleera would be liable if it had performed the relevant processing itself.

9. AI sub-processing

Cleera uses OpenAI as a Sub-processor for AI-assisted features (chat assistant, suitability note generation, document checklist generation, document analysis, and fact-find extraction), only where the Customer's plan includes AI features and a Customer user actively triggers the relevant feature.

• Zero-data-retention is enforced on every such API call, both by a data-retention setting on Cleera's OpenAI account and by an explicit no-retention instruction sent with every individual request; OpenAI does not retain, and does not train models on, Customer Data submitted through the Services.
• Data sent to OpenAI is minimised: National Insurance numbers, full dates of birth, full postal addresses, employer names, and itemised expenditure lines are excluded from AI prompts by design.
• All AI outputs are assistive drafts only. The Customer's authorised users remain responsible for reviewing AI outputs for accuracy before relying on them, communicating them to clients, or filing them as part of a regulatory record (see Terms §9).
• OpenAI processes Customer Data under a Data Processing Agreement between Seringa Ltd and OpenAI (signed 26 June 2026), incorporating Standard Contractual Clauses and the UK International Data Transfer Agreement as the transfer mechanism for data leaving the UK.

10. Identity verification sub-processing

Cleera uses Didit (Didit Identity Spain, S.L.) as a Sub-processor for optional identity document and biometric verification of the Customer's clients, only where the Customer enables this feature and a client actively completes a check having given explicit consent.

• Cleera does not transmit the client's document images or biometric data to Didit itself — the client is redirected to a session hosted by Didit and provides that data to Didit directly. Cleera receives back, and stores in its own systems, the identity document images (front and back), the portrait/liveness image used to match the client to the document, the verification outcome, and a compliance report.
• The identity document images and verification outcome are retained for 5 years from the end of the Customer's relationship with the client, on the basis that they are evidence of customer due diligence Cleera's Customer (or Cleera acting on the Customer's instructions) is required to keep under the Money Laundering Regulations 2017 (regulation 40); this retention is not affected by a Data Subject erasure request during that period.
• The portrait/liveness image is not itself a regulation 40 record — it is used only to confirm the client matched their document at the moment of the check. The standalone copy of this image is automatically deleted approximately 90 days after the check completes, or immediately on a Data Subject erasure request received before that automatic deletion, whichever is sooner. A copy of the portrait image remains visible within the compliance report generated for that check, which is retained for the same 5-year period as the identity document images, as it forms part of the evidential record of the check having been performed.
• Didit acts as Cleera's Sub-processor and Cleera's Customer's instructions (given via enabling the feature) flow through Cleera to Didit; Didit processes data in the EU by default (Didit Identity Spain, S.L., Barcelona), with Standard Contractual Clauses or an equivalent transfer mechanism applied to any transfer outside the UK/EEA.
• Didit is contractually bound to notify Cleera of a Personal Data Breach affecting Customer Data within 48 hours of confirming it, under its own published Data Processing Agreement (Annex 2 of Didit's Business Terms & Conditions) — ahead of the 72-hour window Cleera itself must meet under UK GDPR Article 33 and Clause 13 of this DPA.

11. International transfers

Where Cleera or a Sub-processor transfers Customer Data outside the United Kingdom, Cleera will ensure an appropriate transfer mechanism recognised under Data Protection Laws is in place before the transfer occurs, such as the UK International Data Transfer Agreement, UK-recognised Standard Contractual Clauses, or an applicable UK adequacy regulation.

12. Security measures

Cleera implements and maintains the technical and organisational security measures summarised in Annex 3, and will not materially decrease the overall level of security during the term of the Agreement.

13. Audits and inspections

On the Customer's reasonable written request, no more than once in any 12-month period (save following a Personal Data Breach affecting Customer Data, or at the request of the FCA or ICO), Cleera will provide information reasonably necessary to demonstrate compliance with this DPA. Given Cleera's reliance on its own Sub-processors' independent audit programmes (for example SOC 2 reports maintained by infrastructure providers), Cleera may satisfy this obligation by providing a summary of relevant third-party audit reports in place of a direct on-site audit of Cleera's own systems, except where the Customer reasonably demonstrates this is insufficient.

14. Personal Data Breach

Cleera will notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of a Personal Data Breach affecting Customer Data, providing such details of the breach, its likely consequences, and the measures taken or proposed as are available to Cleera at the time, updating that information as it becomes available.

15. Assistance with Data Subject rights

Cleera provides self-service tools (including a system-admin erasure endpoint) that allow the Customer to respond to most Data Subject requests directly. Where the Customer cannot reasonably do so using those tools, Cleera will provide reasonable assistance, at the Customer's cost, taking into account the nature of the processing.

16. Term, termination and deletion

This DPA takes effect on the date the Customer accepts it (or the date the Customer is deemed to accept the current version under the Terms) and continues for as long as Cleera processes Customer Data under the Agreement.

On termination, the Customer may export Customer Data for 30 days. After that period, Cleera will delete or anonymise Customer Data, save that case-shell, timestamp, and adviser-assignment records will be retained where FCA SYSC 9 requires an audit trail (currently up to 7 years from case close), during which such retained records are restricted from further processing except as required by law.

17. Liability

Liability arising under or in connection with this DPA is subject to the limitation and exclusion of liability provisions in the Terms (§10), which apply to claims under this DPA as if set out in full in this document.

18. Changes to this DPA

Cleera may update this DPA to reflect changes in Data Protection Laws, Sub-processors, or the Services. Material changes will be notified to the Customer's administrators, who will be prompted to re-accept the current version before continuing to use AI features or inviting new clients, per Terms §13.

19. Governing law

This DPA is governed by the laws of England and Wales and is subject to the same dispute resolution provisions as the Terms (§14).

Annex 1 — Details of processing

Annex 2 — Sub-processors

This table is the master sub-processor list, kept consistent with Cleera's Records of Processing Activities, Privacy Policy, and processor DPA tracker.

Annex 3 — Security measures (summary)

• Encryption in transit (TLS) for all data sent to and from the Services.
• Encrypted storage of third-party integration tokens (for example Intelliflo OAuth credentials).
• Role-based access control with organisation-scoped data isolation between Customers.
• Private, non-public document and file storage (Vercel Blob, private access only).
• Immutable, timestamped audit logging of case, document, and AI-action events.
• Zero-data-retention enforced on every AI API call.
• Automatic deletion of the standalone copy of the portrait/liveness image captured during optional identity verification, approximately 90 days after the check completes (a copy remains within the retained compliance report for the same period as the identity document images).
• Ongoing dependency and vulnerability management for the Services' codebase and infrastructure.