Data Processing Addendum
This addendum applies where DIYWAY processes personal data on your behalf as a processor. Version 2026-08-23.
This is a summary policy for the current release and does not constitute legal advice.
Roles
You are the controller of your business and customer data. DIYWAY acts as processor and processes data only on your documented instructions.
Scope of processing
Processing is limited to producing commercial analysis, recommendations and reporting within the platform.
Security
Data is held with access controls, per-account isolation and role-based permissions. Client workspaces are separated so users only see data they are granted.
Sub-processors
We use infrastructure and AI sub-processors to operate the service. A current list is available on request, and we remain responsible for their performance.
Retention and deletion
Raw uploaded customer statements and files are deleted 12 months after the engagement ends, or earlier on request, subject only to legal retention requirements. Anonymised or derived metrics may be retained where lawful.
On termination we delete or return customer data within a reasonable period, subject only to legal retention requirements.