Data Processing Agreement

Last Updated: 14 October 2026

What changed on 14 October 2026

  • Section 5.1.1: we removed Anthropic, Inc. (via Microsoft Azure AI Foundry). We used this Claude deployment to help with production settings and Azure configuration issues. We had listed it as an EU-resident service, but on 8 October 2026 we found that its deployments were Global deployments, so processing was not limited to the EEA. To avoid any risk of a data leak, we stopped using it and deleted its Claude deployments on 13 October 2026. We do not use any AI assistant on customer production data.
  • Section 5.1: the Microsoft Azure entry now lists the Azure services that process your data and the second copy of documents in North Europe (Ireland). The Stripe entry now says that Stripe may process billing data in the United States. The Azure OpenAI, Document Intelligence and AI Language entries now say what each service keeps.
  • Section 6: we removed “automated dependency scanning and mandatory code review”, which overstated our process: we have no dependency scanner in our pipeline and no mandatory code review. We described the release checks we do run. We also corrected the wording on sign-in, tenant isolation, logging and backups.
  • Section 9: we replaced the reference to Microsoft’s EU Data Boundary with the Azure regions we use.
  • Section 11: we listed the reports we can give you.

Questions: dpo@sarportal.com.

1. Introduction

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between SAR Portal (powered by Sekhon IT Consultants Ltd.) (“Processor”, “we”, “us”) and the customer (“Controller”, “you”) using our Service.

Processor Details:

  • Legal Name: Sekhon IT Consultants Ltd. (trading as SAR Portal)
  • Company Registration: Ireland
  • Registered Address: 1 Beaufield Crescent, Maynooth, Co. Kildare, Republic of Ireland
  • Data Protection Officer: dpo@sarportal.com

This DPA governs the processing of personal data by SAR Portal on behalf of the Controller in accordance with GDPR (Regulation (EU) 2016/679).

2. Definitions

  • Personal Data: Any information relating to an identified or identifiable natural person
  • Processing: Any operation performed on personal data
  • Data Subject: The individual whose personal data is processed
  • Sub-processor: Third parties engaged by SAR Portal to process personal data
  • Data Breach: Security incident leading to unauthorized access, loss, or disclosure of personal data

3. Scope and Purpose

3.1 Subject Matter

SAR Portal processes personal data on behalf of the Controller for the purpose of providing DSAR management services.

3.2 Categories of Data Subjects

  • Data subjects submitting DSARs
  • Employees and staff of the Controller
  • Third parties mentioned in documents

3.3 Categories of Personal Data

  • Contact information (names, email addresses, phone numbers)
  • Documents uploaded by the Controller
  • Case notes and communications
  • Identity verification data

3.4 Duration

Processing continues for the duration of the subscription agreement plus data retention periods specified in our Terms.

4. Processor Obligations

SAR Portal agrees to:

  • Process personal data only on documented instructions from the Controller
  • Ensure staff are bound by confidentiality obligations
  • Implement appropriate technical and organizational security measures
  • Assist the Controller in responding to data subject rights requests
  • Support the Controller in meeting GDPR obligations (security, breach notification, DPIAs)
  • Delete or return all personal data at the end of the service relationship
  • Make available information necessary to demonstrate compliance

4.1 Scope of Instructions

The Controller’s documented instructions are limited to:

  • Configuration of the Service via the user interface
  • Requests submitted via our support channels
  • Instructions documented in this DPA

SAR Portal is not obligated to follow instructions that would violate GDPR or other applicable laws. We will promptly notify the Controller if we believe an instruction infringes data protection law.

5. Sub-processors

5.1 Authorized Sub-processors

The Controller authorizes the use of the following sub-processors:

Sub-processor Purpose Location DPA in Place
Microsoft Azure (App Service, Functions, Cosmos DB, Blob Storage, Key Vault, Application Insights, Defender for Storage) Hosting, storage, monitoring, malware scanning EEA — West Europe (Netherlands); second copy of documents in North Europe (Ireland) Yes
Microsoft Azure Entra External ID Authentication EEA — West Europe Yes
Azure OpenAI Service AI features. Not used to train models. Microsoft’s abuse monitoring may store prompts and responses that its systems flag, in the EU, for review by authorised Microsoft staff in the EEA EEA — Sweden Central Yes
Azure AI Document Intelligence Text extraction from documents and scanned pages. Microsoft deletes the document and results automatically 24 hours after analysis EEA — Sweden Central Yes
Azure AI Language Service PII entity detection. Input text is not stored (Microsoft’s logging opt-out is on by default for PII detection) EEA — Sweden Central Yes
Microsoft Graph API User provisioning (email + display name for invitations) Global (covered by Microsoft SCCs) Yes
Stripe (Stripe Payments Europe, Ireland) Billing and payments (no card data held by us) EEA — Ireland; Stripe may process billing data in the US under the EU-US Data Privacy Framework and SCCs Yes
Twilio SendGrid Email delivery (EU SMTP endpoint) EEA Yes
Google reCAPTCHA Enterprise Bot protection (browser signals only, no case data) Global (Enterprise DPA) Yes

5.1.1 Development Tooling Sub-Processors

Customer production data and personal data are prohibited from general development assistants, coding tools and non-production AI services. Technical and organisational controls enforce separation between production data and non-production development environments.

We do not use any AI assistant on customer production data. If we ever add one, we will list it here and give you 30 days’ notice first (section 5.2).

Our developers also use an AI coding assistant (Anthropic, US) for development work only. It is not a sub-processor. Our rules forbid giving it customer personal data, and an automated check blocks its commands against our production resources.

5.2 Changes to Sub-processors

We will notify the Controller 30 days before adding new sub-processors. The Controller may object within 14 days.

6. Security Measures

SAR Portal implements the following technical and organisational measures:

  • Encryption at rest (AES-256) and in transit (TLS 1.2+, HTTPS enforced with HSTS)
  • Authentication via Azure Entra External ID (OAuth 2.0 / OpenID Connect): users sign in with a Microsoft or Google account, or a one-time code sent to their email
  • Role-based access control (RBAC) with four defined roles (Admin, Case Manager, Reviewer, Read Only)
  • Secrets management via Azure Key Vault
  • Logical tenant isolation: every record is partitioned by your tenant ID and every query is limited to your tenant
  • Every change is built and tested automatically and is deployed to Dev and UAT before a manually approved Production release; we check for vulnerable packages at every release and at least monthly
  • Rate limiting on all public-facing endpoints
  • We mask personal data (emails, phone numbers, names, financial data) before it is written to our application logs. Web server logs, kept for 3 days, include IP addresses for security
  • Continuous database backup with 7-day point-in-time restore; a second copy of documents in North Europe (Ireland)
  • Security headers (CSP, HSTS, and others)

7. Data Breach Notification

In the event of a data breach, SAR Portal will:

  • Notify the Controller within 24 hours of becoming aware (Processor → Controller notification window, faster than the 72-hour Controller → DPC obligation under GDPR Article 33, to give Controllers time to fulfil their onward obligations)
  • Provide details of the breach, affected data, and remediation steps
  • Cooperate with the Controller’s investigation and notification obligations
  • Document all breaches and actions taken

8. Data Subject Rights

SAR Portal will assist the Controller in responding to data subject requests for:

  • Access to personal data
  • Rectification of inaccurate data
  • Erasure of personal data
  • Restriction of processing
  • Data portability
  • Objection to processing

9. International Transfers

Case data and documents are stored in Microsoft Azure West Europe (Netherlands), with a second copy of documents in North Europe (Ireland). AI processing runs in Azure Sweden Central. A few supporting services work outside the EU under Standard Contractual Clauses or the EU-US Data Privacy Framework: Microsoft Graph (your users’ names and emails, for invitations), Google reCAPTCHA (browser signals from people using your request forms) and Stripe (billing). None of them receive case content or documents. Any transfers outside the EU are protected by:

  • Standard Contractual Clauses (SCCs): We use the European Commission’s 2021 SCCs (Decision 2021/914) for any transfers to third countries
  • Named EU regions: our Azure services run in West Europe (Netherlands) and North Europe (Ireland), and our AI runs in Azure Sweden Central on regional deployments
  • Adequacy Decisions: Where applicable, transfers may rely on adequacy decisions (e.g., UK, Switzerland)
  • UK Transfers: For customers subject to UK GDPR, restricted transfers are covered by the UK International Data Transfer Addendum to the EU SCCs, or the UK IDTA where applicable

9.1 Sub-Processor Transfers

All our sub-processors either:

  • Process data exclusively within the EU/EEA, or
  • Have signed SCCs with us and implement supplementary measures where required

You may request copies of relevant SCCs by contacting dpo@sarportal.com.

10. Data Retention and Deletion

Upon termination:

  • Customer data available for export for 90 days
  • All tenant data permanently deleted after 90 days
  • Audit logs retained per our documented retention policy (default 7 years), based on our legitimate interest in defending potential legal claims within the applicable limitation period
  • Billing records retained for at least 6 years, in line with Irish tax record-keeping requirements

11. Audits

The Controller may audit SAR Portal’s compliance with this DPA. We will provide:

  • Access to relevant documentation
  • Responses to compliance questionnaires
  • On request: our Cyber Essentials and Cyber Essentials Plus certificates, our latest security self-assessment, and Microsoft Azure’s ISO 27001 and SOC 2 reports (through Microsoft’s Service Trust Portal). SAR Portal does not have its own ISO 27001 or SOC 2 audit report

12. Liability

Liability for data protection breaches is governed by the Terms of Service and applicable law, including GDPR Article 82.

13. Contact

For DPA-related inquiries: