Draft — not yet reviewed by a lawyer
Data processing addendum
Version 2026-10-draft, effective 17 October 2026
A draft laid out under the headings UK GDPR Article 28(3) asks for. Each fact below describes what the software does today. It is not a signed agreement and should not be relied on as legal terms.
1. Subject matter
Fyling provides software that lets the practice prepare and submit filings for its client companies. The practice is the controller of its client data. Fyling is the processor.
2. Duration
For as long as the practice has an account, and afterwards for the retention period the practice sets for its records. The shipped example is 5 years after a client relationship ends.
3. Nature and purpose of processing
Storing, displaying and organising client data; building filings and sending them to Companies House or HMRC when a member of the practice submits them; sending the emails and reminders the practice has set up.
4. Types of personal data
Names, correspondence addresses and dates of birth of directors and people with significant control; contact details; identity-check records; company authentication codes and presenter credentials (stored encrypted); accounting, payroll and tax figures the practice enters or imports.
5. Data subjects
The practice's staff and its clients, and the directors, shareholders and people with significant control of those clients.
6. Processor duties
Fyling processes the data only on the practice's instructions given through the app. Every submission and every change to a filing is written to an audit log the practice can read. Staff access to the platform admin pages is limited to a named list. Duties to help with data-subject requests, to report a breach and to allow audits are for the lawyer to word.
7. Sub-processors
The providers we use are listed on the sub-processors page. How a practice is told about a change is for the lawyer to word.
8. International transfers
The database and the app's functions are set up in London. Some sub-processors are not yet confirmed as UK-hosted: the sub-processors page says which. The transfer wording is for the lawyer.
9. Security measures
Company authentication codes and presenter credentials are encrypted with AES-256-GCM, each bound to its practice and column. Every practice's rows are separated from every other practice's by row-level security in the database. Two-step sign-in is built; forcing it for everyone is a setting that is off by default today.
10. Deletion and return at the end
At the end, the practice can ask for a copy of its data or for the practice to be deleted, from Settings → Data in the app. Records kept for the practice's retention period are held until it ends before they are removed.