Data Processing Agreement

Schedule 2 of the Adviser IQ Subscription Agreement is the Data Processing Agreement required by Article 28 UK GDPR. It applies wherever Adviser IQ processes personal data on the customer's behalf. This page summarises it; if they ever differ, the agreement applies.

The customer is the data controller. Adviser IQ is the data processor and acts only on the customer's documented instructions, except where required by law.

Processing of personal data relating to the customer's clients, advisers, and staff for the purpose of providing the CRM, case management, compliance, and communications services described in the agreement.

Adviser IQ uses the sub-processors listed at /sub-processors. We give at least 14 days' written notice before adding or replacing a sub-processor (30 days for a change of hosting provider); customers may object on reasonable data protection grounds.

Adviser IQ implements technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, logging, monitoring, staff training, and periodic testing. Full detail at /security.

Adviser IQ will notify customers of a personal-data breach without undue delay, and in any event within 24 hours of becoming aware. See /data-breach.

Adviser IQ will assist the customer to respond to data-subject requests through appropriate technical and organisational measures, within five business days where the platform cannot do it directly.

When the agreement ends, the customer's data is available to export. Adviser IQ then deletes it from live systems within 90 days and from backups within 12 months, save where retention is required by law.

Adviser IQ will make available information necessary to demonstrate compliance with Art. 28 and allow for audits conducted by the customer or a mandated auditor, on 30 days' notice and once a year, or at any time after a breach or when the customer's regulator requires it.