Data Processing Agreement
Last updated: 8 October 2026
This Data Processing Agreement ("DPA") forms part of the agreement between Tavon Partners Ltd, trading as Tavons (the "Processor", "we"), and the business that uses Tavons (the "Controller", "you"). It applies whenever we process personal data on your behalf. It is intended to meet Article 28 of the UK GDPR. It takes effect when you create your account.
1. Who is responsible for what, in short
| You (Controller) | We (Processor) |
|---|---|
| Decide why and how personal data about your leads, clients, contacts and referrers is used | Only process it to provide Tavons, following your documented instructions |
| Have a lawful basis (and any consent) for collecting and contacting people, and give them privacy information | Keep it confidential and secure, and limit access to people who need it |
| Comply with PECR and honour opt-outs and objections | Help you answer data subject requests and tell you quickly about a breach |
| Decide what to keep, correct or delete using the controls in Tavons | Delete or return data when the service ends |
| Keep your users' credentials secure | Use only sub-processors listed here, under equivalent terms |
2. Definitions
"Personal data", "controller", "processor", "data subject", "processing", "personal data breach" and "supervisory authority" have the meanings in the UK GDPR and the Data Protection Act 2018 ("Data Protection Law"). "Customer Data" means the personal data we process for you under the agreement.
3. Details of the processing
| Subject matter | Providing the Tavons CRM and related services to the Controller |
|---|---|
| Duration | For as long as the Controller has a Tavons account, plus the deletion period in section 11 |
| Nature and purpose | Hosting, storing, organising, displaying, emailing and deleting Customer Data to provide the CRM, calendar, journey planning, card scanning, statement checking, referral and email features |
| Types of personal data | Names, business names, phone numbers, email addresses, postal and business addresses, location of businesses, notes and meeting details, deal and product details, referral details, and user account details. We do not need, and you must not enter, special category data or criminal offence data. |
| Data subjects | The Controller's leads, prospects, clients, contacts, referrers and its own staff and users |
4. Our obligations as Processor
We will:
- process Customer Data only on your documented instructions, which are this DPA, the agreement and your use of Tavons, unless the law requires otherwise (in which case we will tell you first where we lawfully can);
- tell you if we think an instruction breaches Data Protection Law;
- make sure everyone we authorise to process Customer Data is bound by confidentiality;
- apply the security measures in Annex 1;
- comply with section 5 (sub-processors) and section 10 (international transfers);
- help you respond to data subject requests (section 6), meet your security, breach notification and impact assessment duties (sections 7 and 8), taking into account the nature of the processing;
- delete or return Customer Data as set out in section 11;
- give you the information reasonably needed to show we comply, and allow audits as set out in section 9.
5. Sub-processors
You give us general authorisation to use the sub-processors listed in Annex 2. We will put in place a written contract with each that provides equivalent data protection obligations, and we remain responsible for them. We will give you at least 14 days' notice (by email to your administrator or a notice in the portal) before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that time; we will then work with you in good faith, and if the issue cannot be resolved you may cancel without penalty and receive a refund of any prepaid fees for the period after cancellation.
6. Data subject requests
If a data subject contacts us about Customer Data, we will not respond except to say we have passed it to you, unless the law requires us to. We will send it to you within 5 working days. Tavons includes tools for you to find, correct, export and delete records; if you need our help beyond those tools, we will provide it within a reasonable time, and may charge reasonable costs for unusually large requests.
7. Personal data breaches
We will tell you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Data. Our notice will say, as far as we know: what happened, the type and approximate amount of data and people affected, the likely consequences, and what we are doing about it. We will keep you updated, help you meet your duty to notify the Information Commissioner (within 72 hours) and affected people where required, and will not tell regulators or data subjects about a breach affecting your data without telling you first, unless the law requires it.
8. Assessments and consultation
We will give you reasonable help with data protection impact assessments and with consulting the supervisory authority, where they relate to our processing.
9. Audits
You may ask us for information to show compliance with this DPA (for example our security overview and sub-processor details), and we will answer within a reasonable time. If that is not enough, you may carry out an audit, no more than once a year unless there has been a breach, on 30 days' written notice, during working hours, without disrupting the service, subject to confidentiality, and at your own cost. We may meet an audit request by providing recent independent audit reports or certifications held by us or our sub-processors.
10. International transfers
We keep Customer Data in the UK or Europe where we can. If a sub-processor transfers Customer Data outside the UK, we will make sure the transfer is covered by a UK adequacy regulation, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard.
11. Deletion and return
You can export or delete Customer Data yourself while your account is open. When your account ends we will keep Customer Data for 30 days so you can retrieve it, then delete it from our live systems, and it will fall out of backups on their normal cycle (within 35 days after that). On request we will confirm deletion in writing. We may keep personal data we are required by law to keep, and will keep it protected and not use it for any other purpose.
12. Your responsibilities
You confirm that you have a lawful basis, and where needed consent, for the Customer Data you give us and for the messages you send; that you have given data subjects the information required by law; and that your instructions comply with Data Protection Law. You are responsible for the security of your users' passwords and devices, and for setting your users' access appropriately.
13. Liability
Each party's liability under this DPA is subject to the limits and exclusions in the Terms of Service (section 12), and counts towards the cap there. Nothing in this DPA limits liability that cannot lawfully be limited, or any liability a data subject can claim directly under Data Protection Law. As between us, each party is responsible for compensating the other, to the extent allowed by law and subject to the cap, in proportion to its share of responsibility for a claim.
14. Term, changes and law
This DPA lasts as long as we process Customer Data for you. We may update it to reflect changes in law or in the service, with 30 days' notice. It is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction. Questions: support@tavons.com.
Annex 1: Security measures
- Access control: each company's data is separated at database level; users only see their own company's data, and roles (administrator, staff) limit what they can do.
- Authentication: email and password sign-in through a managed authentication service with passwords stored hashed; session expiry; password reset by email.
- Encryption: data encrypted in transit (HTTPS/TLS) and at rest by our hosting providers.
- Secrets and keys: service credentials are held as protected environment variables and are not sent to browsers; restricted API keys are used for third-party services.
- Minimisation: business card photos and statements are processed and not kept.
- Backups: database backups are taken and retained by our database provider on the plan we hold.
- Monitoring and rate limits: usage limits on higher-cost features, and logs available for investigation.
- People: access to production systems is limited to those who need it and is protected by multi-factor authentication where available.
- Change management: changes are tested before release; we review security issues and apply updates promptly.
Annex 2: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and file storage | Europe (project region shown in your account) |
| Netlify | Website and application hosting and serverless functions | Global edge network |
| Render | Statement analysis and Google connection services | [confirm region] |
| Resend | Sending emails on your behalf | [confirm region] |
| Google (Maps Platform, Calendar, Contacts, sign-in) | Address search, route planning, optional calendar and contacts connections | Global |
| Text-recognition provider | Reading business card images | [confirm provider and region] |
| Payment provider (when subscriptions are enabled) | Taking payments; we do not store full card numbers | [confirm] |