Data Processing Addendum
Version 1.0 — 11 October 2026
This Data Processing Addendum ("DPA") forms part of the agreement between the business that subscribes to PadCount ("you", "Customer") and Padgrad Ltd (company number 17365449, registered office 20 Wenlock Road, London, England, N1 7GU) ("we", "us", "our"). PadCount is a product of Padgrad Ltd, and Padgrad Ltd acts as the processor of the personal data your organisation puts into PadCount (padcount.com). It satisfies the written-contract requirement of Article 28 of the UK GDPR. Where a signed agreement with different terms is in place, that agreement prevails.
1. Roles, subject matter and duration
| Item | Detail |
|---|---|
| Subject matter | The provision of PadCount expense and revenue tracking software |
| Duration | The term of the customer agreement, plus the deletion period below |
| Nature and purpose | Hosting, storing, organising, displaying, exporting and backing up your data; providing support; securing the service |
| Types of personal data | Names, business email addresses, roles and permissions of your users; employee and submitter identity where recorded; expense details; uploaded receipt images (which may contain names, card fragments, addresses and merchant data); financial and VAT data; support communications; access logs |
| Categories of data subjects | Your employees, directors, contractors and other authorised users; individuals appearing in receipts or expense records |
| Controller | The Customer |
| Processor | Padgrad Ltd |
2. Our obligations as processor
We will: process personal data only on your documented instructions; ensure our staff are under confidentiality obligations; implement appropriate technical and organisational security measures (Article 32); assist you with data subject rights and data protection impact assessments; report personal data breaches without undue delay (target: within 48 hours of becoming aware, so you can meet your 72-hour obligation); return or delete data at the end of the engagement; make available the information needed to demonstrate compliance and allow audits on reasonable notice, or satisfy them with a current security summary; and appoint sub-processors only with your authorisation and under written terms.
3. Your obligations
You will provide lawful, documented instructions; ensure you have a lawful basis and appropriate notices for the personal data you put into PadCount; and ensure your users are authorised.
4. Sub-processors
We have your general written authorisation to use the sub-processors below. We will give at least 30 days' notice of a new sub-processor, and you may object.
| Sub-processor | Purpose | Data location |
|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Cloud Storage) | hosting, database, receipt storage | EEA (europe-west1) |
| Stripe | payment processing and billing | US / EU |
| Amazon Web Services (SES) / Resend | transactional email | US / EEA |
| Microsoft Clarity (public marketing pages only) | website analytics | US |
We do not currently use any AI model provider to process your data. If that changes, we will update this list and give you notice.
5. Security measures
Encryption in transit; access control and least privilege; hashed credentials; isolated per-tenant data; audit logging; encrypted storage buckets; regular patching; backup and restore testing; and change management.
6. International transfers
Hosting is in the EEA (Google Cloud europe-west1). Where transfers to third countries occur, they are covered by the ICO IDTA or the UK Addendum to the EU Standard Contractual Clauses, or by the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, together with documented risk assessments.
7. Deletion on exit
We delete the data 60 days after termination, unless retention is required by law, in which case it is isolated and retained only for that purpose.
8. Audits
Once per year on reasonable written notice, or more often where a supervisory authority requires it, or satisfied by a current security questionnaire response.
9. Contact
Data protection matters: privacy@padgrad.com. Legal notices: legal@padgrad.com.