Data Processing Agreement

Published in line with the Compare Your Footprint app.

Compare Your Footprint — Data Processing Agreement

Document Version: 1.0 | Date: April 2026
Incorporated into: CYF Terms and Conditions v2.0
Published at: https://www.compareyourfootprint.com/dpa/

This Data Processing Agreement ("DPA") is incorporated by reference into the Terms and Conditions agreed between CYF and the Customer. It sets out the scope, nature, and purpose of personal data processing carried out by CYF on behalf of the Customer, and lists CYF's approved sub-processors. It is updated independently of the main Terms and Conditions body. The data processing obligations of the parties are set out in Clauses 22, 22A, 22B, and 23 of the Terms and Conditions.

The Customer is the Data Controller and CYF is the Data Processor for the personal data described in this DPA, except where CYF acts as Data Controller in its own right in respect of employee profiles under Clause 22B of the Terms and Conditions.


Version Log

VersionDateSummary
1.0April 2026Initial publication. Processing scope, data types, data subjects, and sub-processor list confirmed.

1 Processing by CYF

FieldDetail
ScopeCYF shall process Personal Data in order to provide the Subscription Services and Professional Services as set out in the Terms and Conditions.
NatureThose processing operations necessary to enable CYF to perform its obligations under the Terms and Conditions, including storage, retrieval, analysis, and transmission of Personal Data as required to deliver the Services.
PurposeProviding the Subscription Services and Professional Services; generating emissions reports and assessments; delivering Employee Survey functionality; facilitating Auditor access under Clause 5D of the Terms and Conditions; producing Anonymised Data in accordance with Clause 3A of the Terms and Conditions.
DurationThe duration of the Agreement between CYF and the Customer, plus the backup retention period specified in Clause 14.7 of the Terms and Conditions (up to one year after termination).

2 Types of Personal Data Processed

CategoryTypes of Personal Data
Platform UsersFirst name; last name; email address; account credentials (hashed passwords, session tokens).
Employee Survey RespondentsFirst name; last name; email address; telephone number (where provided); postcode (for commuting distance calculation only — not retained after calculation unless the employee elects to store their profile under Clause 22B of the Terms and Conditions); commuting mode preferences; working-from-home frequency.
Auditors and VerifiersFull name; email address; organisation name; timestamp and record of agreement to the Auditor Terms of Access.

3 Categories of Data Subject

  • The Customer's employees and administrators who access the Subscription Services as Platform Users.
  • The Customer's employees and contractors who participate in Employee Surveys.
  • Third-party auditors and verifiers who access the platform under Clause 5D of the Terms and Conditions.

4 Sub-Processor List

CYF maintains a current sub-processor list at https://www.compareyourfootprint.com/sub-processors/. The list at the date of this version of the DPA is as follows:

Sub-ProcessorActivityData ProcessedLocation
Maze Digital LtdSoftware development and platform engineering (related CYF group entity)May access platform data in the course of development and maintenance workMalta (EU)
Stripe Inc.Digital payment processingBilling and payment dataUK / USA
Xero LtdAccounting softwareInvoice and billing recordsNew Zealand
Customer.ioCustomer communications and marketing automationUser email addresses; communication preferencesUSA
Freshworks Inc. (Freshdesk)Customer support ticketingUser name; email address; support correspondenceUSA
AidaformWeb formsForm submission data as provided by UsersGermany (EU)
Google LLC (Google Workspace)Email, document storage, and internal collaborationInternal communications; documents containing customer data where shared internallyUSA
Anthropic PBCAI processingPlatform data passed to AI functions (data sharing disabled; customer data is not used for model training)USA
OpenAI Inc.Embedded AI processingPlatform data passed to AI functions (data sharing disabled; customer data is not used for model training)USA

Notice of new sub-processors: CYF shall give the Customer not less than 30 days' written notice before adding any new sub-processor. If the Customer reasonably objects to a new sub-processor on data protection grounds, the parties shall work in good faith to resolve the objection. If unresolved, the Customer may terminate the Agreement without penalty on written notice within 14 days of the sub-processor notice, effective at the end of the 30-day notice period. Customer rights on this point are set out in Clause 22.6 of the Terms and Conditions.


5 International Data Transfers

Where personal data is transferred to sub-processors located outside the United Kingdom or European Economic Area, CYF ensures that appropriate safeguards are in place in accordance with Applicable Data Protection Law, including (where applicable) reliance on adequacy decisions, Standard Contractual Clauses, or other approved transfer mechanisms.

TransferMechanism
UK → EU (Maze Digital Ltd, Aidaform, Customer.io EU infrastructure)EU–UK adequacy decision (in force)
UK → USA (Stripe, Customer.io, Freshworks, Google, Anthropic, OpenAI)Standard Contractual Clauses (SCCs) or equivalent approved mechanism
UK → New Zealand (Xero)UK adequacy regulations (New Zealand designated as adequate)

6 Changes to This DPA

This DPA is updated independently of the main Terms and Conditions. Changes are governed by Clause 22.6 of the Terms and Conditions and the following protocol:

Type of ChangeNotice RequiredCustomer Right to Exit?
Adding a new sub-processor30 days' written noticeYes — if Customer objects on data protection grounds and objection cannot be resolved, without penalty within 14 days
Removing a sub-processorPublication of updated DPA and version log entryNo
Updating processing scope or purpose (non-material)Publication of updated DPA and version log entryNo
Updating processing scope or purpose (material — new categories of personal data or new data subjects)30 days' written noticeYes — without penalty within 14 days of notice
Typographical corrections and clarificationsPublication of updated DPA and version log entryNo

— End of Data Processing Agreement v1.0 —
Compare Your Footprint | compareyourfootprint.com