Data processing

Data Processing Addendum

Version dated 12 July 2026. This Addendum forms part of the agreement between the agency using the MarginRail workspace (“Agency”) and MarginRail for the Agency plan. DPA questions and countersignature requests can be sent to dpa@marginrail.app.

1. Roles and instructions

The Agency is controller of personal data it places in the authenticated workspace and MarginRail is its processor. MarginRail processes that data only to provide, secure, support and maintain the service on the Agency’s documented instructions, including instructions expressed through normal product use, unless applicable law requires otherwise.

2. Processing details

Subject matter and purpose: capturing agency client requests, comparing them with saved scope boundaries, recording commercial decisions, collecting client responses to proposed paid changes and handing approved fees to billing.

Duration: for the subscription or trial and the limited period needed to export, return or delete data after closure.

Data types: business contact details, client/account labels, submitted request wording, operational scope text, estimates, decision notes, approver names and optional response notes. The service is not intended for credentials, special-category data or unnecessary personal information.

Data subjects: Agency users, Agency clients and their authorised business contacts.

3. Confidentiality and security

MarginRail restricts personal-data access to people and providers who need it to operate or support the service and who are subject to confidentiality obligations. MarginRail maintains appropriate technical and organisational measures described on the Security & trust page, including workspace isolation, passkey authentication, hashed session and link tokens, encrypted recoverable integration secrets, transport encryption and recovery procedures.

4. Subprocessors

The Agency gives general authorisation for MarginRail to use the subprocessors listed on the Security & trust page. MarginRail remains responsible for placing data-protection obligations on subprocessors appropriate to the services they provide. An Agency may object to a new subprocessor on reasonable data-protection grounds by contacting dpa@marginrail.app.

5. International transfers

Where processing requires a restricted international transfer, MarginRail will rely on the applicable adequacy decision, contractual safeguard or other lawful transfer mechanism made available through its provider agreements. MarginRail does not promise that all processing occurs exclusively in the UK.

6. Assistance

Taking into account the nature of the processing, MarginRail will provide reasonable assistance with data-subject requests, security assessments, breach obligations and data-protection impact assessments. Requests should be sent to privacy@marginrail.app.

7. Personal-data breaches

MarginRail will notify the affected Agency without undue delay after becoming aware of a confirmed personal-data breach affecting Agency workspace data. Available information will include the nature of the incident, likely consequences and mitigation or remediation steps, and may be supplied in phases as the investigation develops.

8. Return and deletion

The workspace owner can export workspace records in structured JSON. On verified closure request, MarginRail will delete or return Agency personal data unless law requires retention. Data may remain temporarily in provider recovery history until that recovery window expires and is not used for normal service operation.

9. Demonstrating compliance

MarginRail will make information reasonably necessary to demonstrate compliance with this Addendum available to the Agency. Audits must be proportionate, protect other customers and confidential systems, and normally begin with documentation or a written security review before an onsite inspection is considered.

10. Order of precedence

If this Addendum conflicts with the service terms on personal-data processing, this Addendum controls for that conflict. The remainder of the service agreement continues unchanged.