Compare Your Footprint — Data Processing Agreement
Document Version: 1.0 | Date: April 2026
Incorporated into: CYF Terms and Conditions v2.0
Published at: https://www.compareyourfootprint.com/dpa/
This Data Processing Agreement ("DPA") is incorporated by reference into the Terms and Conditions agreed between CYF and the Customer. It sets out the scope, nature, and purpose of personal data processing carried out by CYF on behalf of the Customer, and lists CYF's approved sub-processors. It is updated independently of the main Terms and Conditions body. The data processing obligations of the parties are set out in Clauses 22, 22A, 22B, and 23 of the Terms and Conditions.
The Customer is the Data Controller and CYF is the Data Processor for the personal data described in this DPA, except where CYF acts as Data Controller in its own right in respect of employee profiles under Clause 22B of the Terms and Conditions.
Version Log
| Version | Date | Summary |
|---|---|---|
| 1.0 | April 2026 | Initial publication. Processing scope, data types, data subjects, and sub-processor list confirmed. |
1 Processing by CYF
| Field | Detail |
|---|---|
| Scope | CYF shall process Personal Data in order to provide the Subscription Services and Professional Services as set out in the Terms and Conditions. |
| Nature | Those processing operations necessary to enable CYF to perform its obligations under the Terms and Conditions, including storage, retrieval, analysis, and transmission of Personal Data as required to deliver the Services. |
| Purpose | Providing the Subscription Services and Professional Services; generating emissions reports and assessments; delivering Employee Survey functionality; facilitating Auditor access under Clause 5D of the Terms and Conditions; producing Anonymised Data in accordance with Clause 3A of the Terms and Conditions. |
| Duration | The duration of the Agreement between CYF and the Customer, plus the backup retention period specified in Clause 14.7 of the Terms and Conditions (up to one year after termination). |
2 Types of Personal Data Processed
| Category | Types of Personal Data |
|---|---|
| Platform Users | First name; last name; email address; account credentials (hashed passwords, session tokens). |
| Employee Survey Respondents | First name; last name; email address; telephone number (where provided); postcode (for commuting distance calculation only — not retained after calculation unless the employee elects to store their profile under Clause 22B of the Terms and Conditions); commuting mode preferences; working-from-home frequency. |
| Auditors and Verifiers | Full name; email address; organisation name; timestamp and record of agreement to the Auditor Terms of Access. |
3 Categories of Data Subject
- The Customer's employees and administrators who access the Subscription Services as Platform Users.
- The Customer's employees and contractors who participate in Employee Surveys.
- Third-party auditors and verifiers who access the platform under Clause 5D of the Terms and Conditions.
4 Sub-Processor List
CYF maintains a current sub-processor list at https://www.compareyourfootprint.com/sub-processors/. The list at the date of this version of the DPA is as follows:
| Sub-Processor | Activity | Data Processed | Location |
|---|---|---|---|
| Maze Digital Ltd | Software development and platform engineering (related CYF group entity) | May access platform data in the course of development and maintenance work | Malta (EU) |
| Stripe Inc. | Digital payment processing | Billing and payment data | UK / USA |
| Xero Ltd | Accounting software | Invoice and billing records | New Zealand |
| Customer.io | Customer communications and marketing automation | User email addresses; communication preferences | USA |
| Freshworks Inc. (Freshdesk) | Customer support ticketing | User name; email address; support correspondence | USA |
| Aidaform | Web forms | Form submission data as provided by Users | Germany (EU) |
| Google LLC (Google Workspace) | Email, document storage, and internal collaboration | Internal communications; documents containing customer data where shared internally | USA |
| Anthropic PBC | AI processing | Platform data passed to AI functions (data sharing disabled; customer data is not used for model training) | USA |
| OpenAI Inc. | Embedded AI processing | Platform data passed to AI functions (data sharing disabled; customer data is not used for model training) | USA |
Notice of new sub-processors: CYF shall give the Customer not less than 30 days' written notice before adding any new sub-processor. If the Customer reasonably objects to a new sub-processor on data protection grounds, the parties shall work in good faith to resolve the objection. If unresolved, the Customer may terminate the Agreement without penalty on written notice within 14 days of the sub-processor notice, effective at the end of the 30-day notice period. Customer rights on this point are set out in Clause 22.6 of the Terms and Conditions.
5 International Data Transfers
Where personal data is transferred to sub-processors located outside the United Kingdom or European Economic Area, CYF ensures that appropriate safeguards are in place in accordance with Applicable Data Protection Law, including (where applicable) reliance on adequacy decisions, Standard Contractual Clauses, or other approved transfer mechanisms.
| Transfer | Mechanism |
|---|---|
| UK → EU (Maze Digital Ltd, Aidaform, Customer.io EU infrastructure) | EU–UK adequacy decision (in force) |
| UK → USA (Stripe, Customer.io, Freshworks, Google, Anthropic, OpenAI) | Standard Contractual Clauses (SCCs) or equivalent approved mechanism |
| UK → New Zealand (Xero) | UK adequacy regulations (New Zealand designated as adequate) |
6 Changes to This DPA
This DPA is updated independently of the main Terms and Conditions. Changes are governed by Clause 22.6 of the Terms and Conditions and the following protocol:
| Type of Change | Notice Required | Customer Right to Exit? |
|---|---|---|
| Adding a new sub-processor | 30 days' written notice | Yes — if Customer objects on data protection grounds and objection cannot be resolved, without penalty within 14 days |
| Removing a sub-processor | Publication of updated DPA and version log entry | No |
| Updating processing scope or purpose (non-material) | Publication of updated DPA and version log entry | No |
| Updating processing scope or purpose (material — new categories of personal data or new data subjects) | 30 days' written notice | Yes — without penalty within 14 days of notice |
| Typographical corrections and clarifications | Publication of updated DPA and version log entry | No |
— End of Data Processing Agreement v1.0 —
Compare Your Footprint | compareyourfootprint.com