Who is who
Controller and processor
For Pekanga Advisor, you (the Advisor) are the data controller for your own clients' personal data. Pekanga Ltd is the data processor, acting only on your documented instructions. This is the same structure we use for schools on the core Pekanga platform, adapted for an independent advisor working with their own client base.
What the DPA covers
Scope of the agreement
DPA sections and schedules
- Definitions and scope of processing
- Processor obligations (confidentiality, security)
- Sub-processor authorisation and 30 days' change notice
- Data subject rights assistance
- 48-hour data breach notification
- Deletion or return of data on termination
- Schedule 1: Controller (Advisor) details
- Schedule 2: Description of processing
- Schedule 3: Security measures
- Schedule 4: Approved sub-processors
Sub-processors
Who processes data on our behalf
The following sub-processors are approved under the Advisor DPA. All operate within the UK or under UK adequacy arrangements.
Database, authentication, and Edge Function processing. Processes all client data at rest and in transit.
Anthropic (Claude API)
UK Adequacy
AI content generation. Processes subject and interest inputs to generate report content. No personal data stored beyond the API request lifecycle.
Sends reports from you to your clients when you use the send-to-client feature.
Processes your subscription payment. Does not process your clients' data.
Application hosting for the Advisor platform front end.
Request the DPA
Ready to sign a full agreement?
Email us and we'll send you the full Data Processing Agreement, pre-populated with Pekanga's details, ready for your review.
Request the DPA