Who is who
Controller and processor
For Pekanga Advisor, you are the data controller for your own clients' personal data. That applies whether you are an independent adviser, a consultancy, a local authority or a school using Advisor with its students. Pekanga Ltd is the data processor, acting only on your documented instructions.
If you manage a team of advisers, you confirm that you are authorised to instruct Pekanga for everything your advisers enter, and that the right permissions are in place with them and their clients.
What the DPA covers
Scope of the agreement
DPA sections and schedules
- Purpose, scope and definitions
- Details of processing: purposes, data subjects and categories of personal data
- Processor obligations: confidentiality, security and assistance with DPIAs
- Sub-processor authorisation, with 30 days' notice of changes and a right to object
- Data subject rights: Pekanga actions erasure and similar requests within 5 working days
- Breach notification without undue delay and, where practicable, within 48 hours
- Controller obligations, including privacy information and telling clients before a session is transcribed
- International transfers and safeguards
- Retention, return and deletion on termination
- Audit rights, once in any 12-month period
- Liability, governed by the terms of the Agreement
- Schedules: controller details, processing, security measures and sub-processors
The DPA covers data created within the Platform, such as appointment notes, session transcripts and AI-generated action plans, plus any cohort list you supply for import. It does not cover separate datasets you hold outside the Platform, for example a school's management information system. You agree not to put special category data or criminal offence data into the Platform unless this has been agreed in writing.
Retention and deletion
What happens to your data
We keep client data while your subscription is active. After it ends you have 60 days to ask for your data to be returned or deleted, and we complete the request within 30 days. If we hear nothing within the 60 days, we delete or anonymise it. Copies taken for maintenance are deleted once they are no longer needed. We may keep information that has been genuinely anonymised, so that no individual can be identified, for statistics, benchmarking and product development.
Sub-processors
Who processes data on our behalf
The following sub-processors are approved under the Advisor DPA. We give 30 days' notice before adding or replacing one.
Database, authentication and Edge Function processing. Processes all client data at rest and in transit, and is where your Client Data is stored.
Anthropic (Claude API)
USA
EU SCCs + UK IDTA
AI content generation through Anthropic's commercial API, sent server-side and limited to what is needed to generate the report. Inputs and outputs are not used to train Anthropic's models and are kept only for a limited period before being automatically deleted. The transfer to the USA is made under the EU Standard Contractual Clauses, supplemented by the UK International Data Transfer Addendum, as incorporated into our Data Processing Addendum with Anthropic.
OpenAI
USA
EU SCCs + UK IDTA
Speech-to-text for dictation in the client chat and appointment notes. Audio is sent for that single request and Pekanga does not keep it. According to OpenAI's published API data controls, the audio transcription service is not subject to abuse-monitoring retention and does not store the audio or the transcript as application data. Data sent to the OpenAI API is not used to train its models. The transfer to the USA is made under the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum.
Speechmatics
EU
Zero-retention (real-time)
Real-time speech-to-text transcription for live session recording. Audio streams directly from the browser to Speechmatics' EU endpoint and is not recorded or stored by Pekanga or Speechmatics. The resulting transcript is returned to the Platform and saved in the adviser's notes for that client. Model training on customer data is disabled on our account, confirmed in writing by Speechmatics and covered under our signed DPA with them.
Resend
USA
EU SCCs + UK IDTA
Sends reports from you to your clients when you use the send-to-client feature, and password reset emails. Holds transactional email content only. Emails are sent from Ireland, but Resend holds its account data in the USA. The transfer to the USA is made under the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum.
Processes your subscription payment. Holds payment data only and does not process your clients' data.
Hosting for the Advisor web application. Its serverless functions run in the USA. When an adviser creates a PDF of a report, the report content passes through one of them to build the PDF. It is not stored there.
Request the DPA
Ready to sign a full agreement?
Email us and we'll send you the full Data Processing Agreement, pre-populated with Pekanga's details, ready for your review.
Request the DPA
The DPA has been drafted to comply with UK GDPR Article 28, the Data Protection Act 2018 and the Data (Use and Access) Act 2025. It should be reviewed by a qualified data protection solicitor before you rely on it. This page does not constitute legal advice. Pekanga Ltd, company number 17216579, ICO registration ZC172552. Version 2.0, October 2026.