Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Controller") and FOUR GEARS LTD (company number NI668978, registered office Reid Memorial Hall, 4a Maryville Avenue, Belfast, Northern Ireland, BT9 7HE), trading as InsureOS ("Processor"), for the provision of the InsureOS service.

1. Roles

The Controller determines the purposes and means of processing personal data within its workspace. The Processor acts on documented instructions from the Controller. Where the Processor engages sub-processors, it does so on the same terms as set out below.

2. Scope of processing

• Subject-matter — operation of the InsureOS CRM, including lead capture, scoring, outreach, calendar booking, policy management, commission tracking and audit logging.
• Duration — for the term of the underlying agreement and any retention period defined in the workspace's retention_days setting.
• Nature and purpose — providing the contracted SaaS service.
• Categories of data subjects — leads, policyholders, broker staff, and Controller employees.
• Categories of personal data — identifiers, contact details, policy details, communication content, consent records, financial transaction metadata.
• Special category data — only where explicitly entered by the Controller (e.g. health insurance applications). Controller is responsible for the lawful basis.

3. Sub-processors

The Controller authorises the following sub-processors:

• Google Cloud Platform — application hosting, database, authentication and private file storage in the configured UK region.
• Configured AI inference provider — model inference for lead scoring and content suggestions only when the Controller enables AI features. The current provider is identified during onboarding and in the applicable service documentation.
• Stripe Payments Europe Ltd — subscription billing and payment processing.
• Any messaging, telephony or calendar provider the Controller connects in Settings → Comms providers (e.g. Twilio, Resend, Meta, Google, Microsoft).

The Processor will give the Controller 30 days' notice of any changes to this list and a right to object.

4. Security measures

The Processor implements the technical and organisational measures described on the Security page, including transport encryption, platform-provided encryption at rest, row-level tenant isolation, encrypted integration credentials, role-based access control, activity logging, and incident notification in line with UK GDPR Article 33 timelines. The Processor holds no security certification and makes no assurance-report warranty.

5. Data subject rights

The Processor provides tooling for the Controller to action data-subject requests: in-app data export (Article 15), right to rectification (lead edit), right to erasure (RTBF), and automated retention enforcement.

6. International transfers

Where personal data is transferred outside the UK / EEA, transfers are governed by the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses (2021/914), as applicable.

7. Audits

The Controller may request a written summary of the Processor's current technical and organisational measures once per twelve-month period.

8. Return and deletion

On termination, the Controller may export workspace data for 30 days. After that period the Processor deletes Controller data within 60 days, save where retention is required by law.

9. Conflict

In the event of conflict with the main agreement, this DPA prevails for matters of personal data processing.

10. Contact

Data protection enquiries and data-subject requests: hello@insure-os.co.uk.