Customer Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between the customer identified in the applicable Cleera account (“Customer”) and Seringa Ltd, trading as Cleera, a company registered in England and Wales (company number 15449830) with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (“Cleera”, “we”, “us”). This DPA supplements, and is incorporated by reference into, the Cleera Terms of Service. By creating a Cleera account, or by continuing to use Cleera after being notified of an updated version of this DPA, an authorised administrator of the Customer accepts this DPA on the Customer's behalf, as recorded in Cleera's systems (see Privacy Policy for how acceptance records are kept).

1. Definitions and interpretation

Capitalised terms not defined in this DPA have the meaning given in the Terms. In this DPA:

• “Data Protection Laws” means the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003, each as amended or replaced.
• “Controller”, “Processor”, “Sub-processor”, “Data Subject”, “Personal Data” and “Personal Data Breach” have the meanings given in the UK GDPR.
• “Customer Data” means Personal Data relating to the Customer's clients, leads, introducers, and adviser or admin users, that the Customer or its users submit to, or that is generated within, the Services.
• “Services” means the Cleera platform as described in the Terms, including any AI-assisted features enabled on the Customer's plan.
• “FCA” means the UK Financial Conduct Authority.

2. Roles of the parties

For Customer Data, the Customer is the Controller and Cleera is the Processor, processing Customer Data only on the Customer's documented instructions. The Customer's instructions are given by its use and configuration of the Services (see Terms §6) and by this DPA. Cleera will promptly inform the Customer if, in Cleera's reasonable opinion, an instruction given by the Customer infringes Data Protection Laws, without obligation to actively monitor the Customer's instructions for this purpose.

The Customer, not Cleera, determines the lawful basis for each processing activity carried out through the Customer's use of the Services (for example contract, legitimate interests, or consent), issues privacy notices to its own clients, leads and introducers, and remains responsible for its own compliance with FCA rules (including SYSC 9 record-keeping and COBS 9A suitability documentation requirements) that apply to its regulated activities.

3. Subject matter and duration

Subject matter: the provision of the Services to the Customer, involving the processing of Customer Data as necessary to deliver case management, client and introducer portals, document collection, e-signature, optional identity verification (where enabled), recording and transcription of calls and meetings (where a Customer user starts it), AI-assisted features (where enabled), outbound integrations the Customer chooses to connect, and related functionality.

Duration: this DPA applies for as long as Cleera processes Customer Data under the Agreement, being the Customer's subscription term plus (a) a 30-day post-termination export window, and (b) any further period during which Cleera is required to retain specific records under Clause 16 (Term, termination and deletion).

4. Nature and purpose of processing

Cleera processes Customer Data to provide: hosting and secure storage of case and client documents; branded client and introducer portals; case and workflow management; dynamic forms and fact-finds; document collection and e-signature; optional identity document and biometric verification for the Customer's own clients (only where the Customer enables this feature and a client actively completes a check); AI-assisted document analysis, extraction, form review, suitability-note drafting, case chat, and case-readiness proposals (only where the Customer's plan includes AI features and a Customer user triggers them); recording and transcription of calls and meetings, with AI drafting of case notes and suggested record updates (only where a Customer user starts a recording or sends the meeting bot); AI summaries of case messages between the Customer and its clients (generated automatically once a conversation has been idle); outbound sync to third-party systems the Customer connects (for example Intelliflo Office); transactional email delivery; property and address look-ups; and audit logging and reporting. Full detail of each processing activity is set out in Annex 1.

5. Types of Personal Data and categories of Data Subjects

The categories of Data Subjects and Personal Data processed are set out in Annex 1. The Customer must not submit criminal offence data through the Services other than incidentally, and must take reasonable steps to minimise special category data (as defined in UK GDPR Article 9) at source.

The Services include fact-find templates, particularly for protection insurance, that ask about health, medical history, and smoking status, and recorded calls may include such information if it is discussed. Where the Customer collects this data, it is processed by the Services, including by AI-assisted features the Customer uses on it (for example form review, suitability-note drafting, fact-find extraction, and call transcription and note drafting). The Customer is responsible for identifying an Article 9 condition for that processing and for any consent it requires. Where the Customer enables optional identity verification, the images and portrait/liveness data captured may constitute biometric data; the Customer is responsible for determining whether this falls within Article 9 for its use case and for obtaining any consent required before a client's check begins (see Clause 10).

6. Controller obligations

The Customer warrants that it will:

• determine and be able to demonstrate the lawful basis for each processing activity carried out through its use of the Services;
• provide all privacy notices, and obtain all consents, required under Data Protection Laws for its clients, leads, and introducers;
• before a Customer user records a call or sends the meeting bot to a meeting, tell everyone on the call that it will be recorded and transcribed, and have a lawful basis for doing so (Cleera asks the user to confirm this each time, and records when they did, but does not itself notify participants);
• comply with its own record-keeping and suitability documentation obligations under FCA rules, including SYSC 9 and COBS 9A;
• ensure only authorised users of the Customer have access to the Services, and promptly remove access for individuals who no longer require it;
• promptly notify Cleera of any data protection compliance concern relevant to the Services that comes to the Customer's attention.

7. Processor obligations

Cleera shall, in respect of Customer Data:

• process Customer Data only on the Customer's documented instructions, including in relation to international transfers, unless required to do otherwise by law, in which case Cleera will inform the Customer before processing unless legally prohibited from doing so;
• ensure that persons authorised to process Customer Data are subject to appropriate confidentiality obligations;
• implement appropriate technical and organisational security measures, summarised in Annex 3;
• comply with the conditions for engaging Sub-processors set out in Clause 8;
• taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures with fulfilling the Customer's obligations to respond to Data Subject requests;
• assist the Customer in ensuring compliance with its security, breach-notification, data protection impact assessment, and prior-consultation obligations, taking into account the nature of the processing and the information available to Cleera;
• at the Customer's election, delete or return all Customer Data on termination of the provision of Services relating to processing, and delete existing copies, save to the extent retention is required by law (including FCA SYSC 9);
• make available to the Customer information reasonably necessary to demonstrate compliance with this Clause 7, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to Clause 13 (Audits and inspections).

8. Sub-processors

The Customer generally authorises Cleera to engage the Sub-processors listed in Annex 2 to process Customer Data, provided Cleera imposes data protection obligations on each Sub-processor that are no less protective than this DPA.

Cleera will give the Customer at least 30 days' written notice (by email to the Customer's registered administrator contact, or an in-app or website notice) before appointing a new Sub-processor or replacing an existing one, other than an emergency security-critical change, which will be notified as soon as reasonably practicable afterwards.

Where a Sub-processor engages or replaces its own sub-processor and gives Cleera less than 30 days' notice, Cleera will notify the Customer as soon as reasonably practicable, and in any event within 5 working days of receiving that notice. The Customer's right to object applies from the date of Cleera's notice.

The Customer may object to a new Sub-processor on reasonable data protection grounds within 30 days of notice. If the parties cannot resolve the objection, the Customer's sole remedy is to terminate the affected feature of the Services or, if the Sub-processor is fundamental to the Services, the Agreement, without further liability for the unexpired term.

Cleera remains liable for the acts and omissions of its Sub-processors to the same extent Cleera would be liable if it had performed the relevant processing itself.

9. AI sub-processing

Cleera uses the AI Sub-processors listed in Annex 2 to provide AI-assisted features, only where the Customer's plan includes them. Most of these features run when a Customer user triggers them. Two run automatically as part of a feature the Customer uses: processing of a recorded call after a Customer user starts the recording, and summaries of case messages once a conversation has been idle.

• Data sent to an AI model, including call audio sent for transcription, is processed on a zero-data-retention basis: requests are only routed to model hosts that do not retain prompts, audio, or outputs, and neither Cleera's AI Sub-processors nor their hosts use Customer Data to train models. If a zero-data-retention host is unavailable, the request is not sent.
• Data sent to an AI model is limited to what the feature needs. Structured case summaries are reduced before use (for example, ages rather than dates of birth, and no National Insurance numbers). Features that act on a specific item, such as a document, a set of form answers, a call transcript, or a message thread, use that item in full.
• All AI outputs are assistive drafts only. The Customer's authorised users remain responsible for reviewing AI outputs for accuracy before relying on them, communicating them to clients, or filing them as part of a regulatory record (see Terms §9).
• Where an AI feature proposes an action on a case, nothing is created, sent, or changed until an authorised user of the Customer explicitly reviews and approves it; every approved action is carried out through the same process a person taking that action manually would use.
• Each AI Sub-processor processes Customer Data under data processing terms with Cleera (or, for a downstream model host, with the AI Sub-processor that engages it), with the UK International Data Transfer Agreement or Standard Contractual Clauses applied to transfers outside the UK. The status of each is set out in Annex 2.

9A. Call recording and meeting-bot sub-processing

A Customer user may record a call with a client, or send an automated meeting participant (“Cleera Notetaker”) to a video meeting, to produce a draft case note. Recording only starts when a Customer user starts it, after confirming that participants have been told (see Clause 6).

• Phone-call recording. The audio is captured in the Customer user's browser, stored in Cleera's private storage, and transcribed by the AI Sub-processors on the zero-data-retention basis described in Clause 9. Who said what is worked out from what is said and the names of the people on the call; voices are not used to identify anyone, and no voice profile is created. All audio is deleted automatically within 3 days of transcription (or of the recording failing or being cancelled).
• Meeting bot. The meeting bot is operated by the meeting recording Sub-processor listed in Annex 2. It joins the meeting visibly as “Cleera Notetaker”, records audio only, and receives the names participants display in the meeting. That Sub-processor also transcribes the recording, and Cleera may share case details such as client names with it to improve accuracy. It processes the recording in the EU, does not use it to train AI models, and is instructed to delete it once the transcript has been saved in Cleera, and in any event within 24 hours of the meeting ending.
• Transcripts and outputs. Transcripts, draft call notes, and AI-suggested record updates are stored in Cleera and kept as part of the case record (see Annex 1). Nothing is saved to the case or client record until a Customer user approves it. If a Customer user discards the draft call note, the transcript and any remaining audio are deleted at that point; suggested record updates from the call are kept for review.

10. Identity verification sub-processing

Cleera uses Didit (Didit Identity Spain, S.L.) as a Sub-processor for optional identity document and biometric verification of the Customer's clients, only where the Customer enables this feature and a client actively completes a check having given explicit consent.

• Cleera does not transmit the client's document images or biometric data to Didit itself. The client is redirected to a session hosted by Didit and provides that data to Didit directly. Cleera receives back, and stores in its own systems, the identity document images (front and back), the portrait/liveness image used to match the client to the document, the verification outcome, and a compliance report.
• The identity document images and verification outcome are retained for 5 years from the end of the Customer's relationship with the client, on the basis that they are evidence of customer due diligence Cleera's Customer (or Cleera acting on the Customer's instructions) is required to keep under the Money Laundering Regulations 2017 (regulation 40); this retention is not affected by a Data Subject erasure request during that period.
• The portrait/liveness image is not itself a regulation 40 record: it is used only to confirm the client matched their document at the moment of the check. The standalone copy of this image is automatically deleted approximately 90 days after the check completes, or immediately on a Data Subject erasure request received before that automatic deletion, whichever is sooner. A copy of the portrait image remains visible within the compliance report generated for that check, which is retained for the same 5-year period as the identity document images, as it forms part of the evidential record of the check having been performed.
• Didit acts as Cleera's Sub-processor and Cleera's Customer's instructions (given via enabling the feature) flow through Cleera to Didit; Didit processes data in the EU by default (Didit Identity Spain, S.L., Barcelona), with Standard Contractual Clauses or an equivalent transfer mechanism applied to any transfer outside the UK/EEA.
• Didit is contractually bound to notify Cleera of a Personal Data Breach affecting Customer Data within 48 hours of confirming it, under its own published Data Processing Agreement (Annex 2 of Didit's Business Terms & Conditions), ahead of the 72-hour window Cleera itself must meet under UK GDPR Article 33 and Clause 13 of this DPA.

11. International transfers

Where Cleera or a Sub-processor transfers Customer Data outside the United Kingdom, Cleera will ensure an appropriate transfer mechanism recognised under Data Protection Laws is in place before the transfer occurs, such as the UK International Data Transfer Agreement, UK-recognised Standard Contractual Clauses, or an applicable UK adequacy regulation.

12. Security measures

Cleera implements and maintains the technical and organisational security measures summarised in Annex 3, and will not materially decrease the overall level of security during the term of the Agreement.

13. Audits and inspections

On the Customer's reasonable written request, no more than once in any 12-month period (save following a Personal Data Breach affecting Customer Data, or at the request of the FCA or ICO), Cleera will provide information reasonably necessary to demonstrate compliance with this DPA. Given Cleera's reliance on its own Sub-processors' independent audit programmes (for example SOC 2 reports maintained by infrastructure providers), Cleera may satisfy this obligation by providing a summary of relevant third-party audit reports in place of a direct on-site audit of Cleera's own systems, except where the Customer reasonably demonstrates this is insufficient.

14. Personal Data Breach

Cleera will notify the Customer without undue delay, and in any event within 72 hours of becoming aware, of a Personal Data Breach affecting Customer Data, providing such details of the breach, its likely consequences, and the measures taken or proposed as are available to Cleera at the time, updating that information as it becomes available.

15. Assistance with Data Subject rights

Cleera provides self-service tools (including a system-admin erasure endpoint) that allow the Customer to respond to most Data Subject requests directly. Where the Customer cannot reasonably do so using those tools, Cleera will provide reasonable assistance, at the Customer's cost, taking into account the nature of the processing.

16. Term, termination and deletion

This DPA takes effect on the date the Customer accepts it (or the date the Customer is deemed to accept the current version under the Terms) and continues for as long as Cleera processes Customer Data under the Agreement.

On termination, the Customer may export Customer Data for 30 days. After that period, Cleera will delete or anonymise Customer Data, save that case-shell, timestamp, and adviser-assignment records will be retained where FCA SYSC 9 requires an audit trail (currently up to 7 years from case close), during which such retained records are restricted from further processing except as required by law.

17. Liability

Liability arising under or in connection with this DPA is subject to the limitation and exclusion of liability provisions in the Terms (§10), which apply to claims under this DPA as if set out in full in this document.

18. Changes to this DPA

Cleera may update this DPA to reflect changes in Data Protection Laws, Sub-processors, or the Services. Changes to Sub-processors follow clause 8. Other material changes take effect as set out in Terms §13, and the Customer's Account Owner will be asked to accept the current version the next time they sign in.

19. Governing law

This DPA is governed by the laws of England and Wales and is subject to the same dispute resolution provisions as the Terms (§14).

Annex 1: Details of processing

Annex 2: Sub-processors

This table is the master sub-processor list, kept consistent with Cleera's Records of Processing Activities, Privacy Policy, and processor DPA tracker.

Annex 3: Security measures (summary)

• Encryption in transit (TLS) for all data sent to and from the Services.
• Encrypted storage of third-party integration tokens (for example Intelliflo OAuth credentials).
• Role-based access control with organisation-scoped data isolation between Customers.
• Private, non-public document and file storage (Vercel Blob, private access only).
• Immutable, timestamped audit logging of case, document, and AI-action events.
• Zero-data-retention enforced on every AI request, including call transcription.
• Call and meeting recordings are audio only, and are deleted automatically: phone-call audio within 3 days of transcription, and meeting-bot recordings at the Sub-processor once the transcript is saved and within 24 hours.
• Automatic deletion of the standalone copy of the portrait/liveness image captured during optional identity verification, approximately 90 days after the check completes (a copy remains within the retained compliance report for the same period as the identity document images).
• Ongoing dependency and vulnerability management for the Services' codebase and infrastructure.