GAIN TAX DATA PROCESSING AGREEMENT
This Data Processing Agreement (the “DPA”) supplements, and is incorporated into, the Licence Agreement constituted by the Terms of Use, available at https://gaintax.co.uk/terms-of-use (the “Agreement”), between GLOBE AI NEURAL TAX LTD, a company incorporated in England and Wales with registered number 16363484 whose registered office is at 128 City Road, London, EC1V 2NX, England (the “Provider”), and the Customer. By indicating acceptance of the Terms of Use, or by signing this DPA, the Customer enters into this DPA.
Parties and Incorporation
“Customer” means the Business Customer (as defined in the Terms of Use) that enters into the Agreement with the Provider, being the entity on whose behalf an account is registered for the Software.
This DPA is entered into on the earlier of: the Customer’s acceptance of the Terms of Use at registration; or the Parties’ signature of this DPA.
This DPA applies where the Provider processes Customer Personal Data in the course of providing the Software. It does not apply to personal data for which the Provider is the controller (such as account, billing and marketing data), which is governed by the Provider’s Privacy Policy, accessible here: https://gaintax.co.uk/privacy-policy.
If there is a conflict between this DPA and the Terms of Use in relation to the processing of Customer Personal Data, this DPA prevails.
Definitions
In this DPA, capitalised terms not defined here have the meanings given in the Terms of Use (including “Software”, “Business Customer” and “UK Data Protection Laws”) and the following words are defined:
Customer Personal Data
personal data contained in Client Data or otherwise submitted to the Software by or on behalf of the Customer, which the Provider processes on the
Customer’s behalf in providing the Software;
Client Data
data relating to the Customer’s own clients that the Customer inputs into the Software, including client profiles, documents, queries and related records;
Controller, processor, data subject, personal data, personal data breach, processing
have the meanings given in UK Data Protection Laws;
Sub-processor
any third party engaged by the Provider to process Customer Personal Data;
Sub-processor List
the list of Sub-processors published at https://gaintax.co.uk/sub-processors, identifying each Sub-processor, its processing location, its activity and the applicable transfer mechanism;
SCCs
the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission on 4 June 2021, as amended, updated or replaced from time to time;
UK Addendum
the international data transfer addendum to the SCCs issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018;
Restricted Transfer
a transfer of Customer Personal Data to a country outside the UK that is not covered by UK adequacy regulations.
Roles of the Parties
The Parties acknowledge that, in respect of Customer Personal Data, the Customer acts as controller (or, where the Customer processes such data on behalf of its own clients as a processor, as processor) and the Provider acts as the Customer’s processor (or sub-processor, as applicable).
The Provider will process Customer Personal Data only for the purposes described in Schedule 1 and in
accordance with the Customer’s documented instructions, unless required otherwise by applicable law, in which case the Provider will inform the Customer of that legal requirement before processing unless prohibited from doing so.
The Parties agree that the Agreement (including this DPA), together with the Customer’s configuration and use of the Software, constitutes the Customer’s complete documented instructions. Additional instructions require the Parties’ written agreement.
The Customer warrants that it has provided all necessary notices to, and holds all necessary lawful bases, rights, consents and authorisations in respect of, the data subjects whose personal data it submits to the Software, to the extent required under UK Data Protection Laws, and that its instructions comply with UK Data Protection Laws.
The Provider will not use Customer Personal Data to train any artificial intelligence or machine learning models, and will ensure that its Sub-processors are contractually prohibited from doing so.
Confidentiality
The Provider will ensure that all persons it authorises to process Customer Personal Data are subject to written or statutory obligations of confidentiality.
Security
The Provider will implement and maintain appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing. The measures current at the Effective Date are described in Schedule 2.
The Provider may update the measures in Schedule 2 from time to time, provided the updates do not materially reduce the overall level of protection.
Assistance to the Customer
Taking into account the nature of the processing, the Provider will assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer’s obligations to respond to requests from data subjects exercising their rights under UK Data Protection Laws. If the Provider receives such a request directly, it will promptly notify the Customer and will not respond except on the Customer’s documented instructions or as required by law.
The Provider will provide reasonable assistance to the Customer with the Customer’s obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to the Provider.
Personal Data Breaches
The Provider will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the Customer with information reasonably required to meet the Customer’s breach notification obligations, as it becomes available. The Provider’s notification is not an admission of fault or liability.
Deletion and Return of Data
On termination or expiry of the Agreement, the Provider will, at the Customer’s choice, delete or return all Customer Personal Data, and delete existing copies, unless and to the extent retention is required by applicable law,
in which case the Provider will isolate and protect the retained data from further processing except as required by that law. If the Customer does not make an election within 30 days of termination, the Provider will delete the data in accordance with its standard deletion schedules.
Audit and Information
The Provider will, on the Customer’s reasonable written request and no more than once in any 12-month period, make available information reasonably necessary to demonstrate compliance with this DPA, which may include summaries of security documentation, certifications and third-party audit reports. Where this information is insufficient, the Provider will allow for and contribute to audits conducted by the Customer or its appointed auditor, at the Customer’s cost, on at least 30 days’ written notice, during business hours, no more than once in any 12-month period, subject to reasonable confidentiality and security requirements and conducted so as to minimise disruption to the Provider’s business. Audit results are the Confidential Information of both Parties.
The Provider will maintain records of its processing activities in respect of Customer Personal Data as required by Article 30(2) of the UK GDPR.
Sub-processors
The Customer provides a general written authorisation for the Provider to engage the Sub-processors named in the Sub-processor List, published at https://gaintax.co.uk/sub-processors, to process Customer Personal Data. The Sub-processor List forms part of this DPA and identifies each Sub-processor, its processing location, its activity and the applicable transfer mechanism.
The Provider will give the Customer at least 30 days’ prior notice of the addition or replacement of any Sub-processor (by updating the Sub-processor List and notifying account holders by email or in-product notice). The Customer may object in writing on reasonable data protection grounds within 30 days of notice. The Parties will work together in good faith to resolve the objection; if it cannot be resolved, the Customer may terminate the Agreement in respect of the affected services and will receive a pro rata refund of prepaid fees for the period after termination.
The Provider will enter into a written agreement with each Sub-processor imposing data protection obligations materially equivalent to those in this DPA, and remains fully liable to the Customer for the performance of each Sub-processor’s obligations.
International Data Transfers
Customer Personal Data is hosted at rest in the United Kingdom. Certain processing operations involve a Restricted Transfer, as described in the Sub-processor List. In particular, AI processing of queries and documents is performed by OpenAI OpCo, LLC in the United States.
The Provider will not make a Restricted Transfer of Customer Personal Data unless the transfer is covered by UK adequacy regulations or by appropriate safeguards under Article 46 of the UK GDPR, being the SCCs as amended by the UK Addendum or an International Data Transfer Agreement issued by the Information Commissioner, together with any supplementary measures reasonably required.
Where the Customer acts as controller and the Provider’s engagement of a Sub-processor involves a Restricted Transfer, the Provider will ensure the transfer is governed by the SCCs (Module Three: processor to sub-processor) as amended by the UK Addendum, or another valid transfer mechanism.
Liability, Term and General
The liability of each Party under or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Terms of Use, except to the extent that liability cannot be limited or excluded under applicable law.
This DPA takes effect on the date set out in clause 2 and continues until the Provider ceases to process Customer Personal Data in accordance with clause 17.
The Provider may update this DPA from time to time in accordance with the variation provisions of the Terms of Use, provided the updates do not materially reduce the protections for Customer Personal Data. The version in force at any time is published at https://gaintax.co.uk/data-processing-agreement.
This DPA is governed by and interpreted according to the laws of England and Wales, and all disputes and claims arising under it (including non-contractual disputes or claims) will be subject to the exclusive jurisdiction of the courts of England and Wales.
Schedule 1: Details of Processing
Subject matter
Provision of the Software (AI-assisted UK tax research, client workspace, document analysis and drafting) to the Customer.
Duration
The term of the Agreement, plus the period reasonably required for deletion or return under clause 17.
Nature and purpose
Hosting, storage, retrieval, analysis and AI-assisted processing of data submitted by the Customer in order to deliver the features of the Software; support and troubleshooting at the Customer’s request; security and service continuity.
Categories of data subjects
The Customer’s clients and prospective clients; directors, employees, partners and beneficial owners of those clients; other individuals whose personal data appears in documents or records submitted by the Customer; the Customer’s authorised users.
Categories of personal data
Identification and contact details; employment and role information; financial and tax information, including income, assets, transactions, tax positions and filings; company and shareholding information; correspondence with HMRC; other personal data contained in documents or queries submitted by the Customer.
Special category and criminal offence data
Not intended to be submitted. The Customer must not submit special category or criminal offence data unless it has a lawful basis and an applicable condition under UK Data Protection Laws; where such data is nevertheless contained in unstructured Client Data, it is processed under the same safeguards as other Customer Personal Data.
Frequency
Continuous, as determined by the Customer’s use of the Software.
Retention
For the duration of the Agreement, subject to deletion or return under clause 17 and any retention required by applicable law.
Schedule 2: Technical and Organisational Measures
The Provider maintains, as a minimum, the following measures. Further detail is published at https://gaintax.co.uk/security-and-data-handling.
Encryption of Customer Personal Data in transit (TLS 1.2 or higher) and at rest.
Hosting of Customer Personal Data at rest on infrastructure located in the United Kingdom.
Contractual controls ensuring that Customer Personal Data is not used by the Provider or its Sub-processors to train AI models.
Rol e-based access controls; client-level access assignment within multi-seat accounts; administrator oversight of user activity; audit trails.
Authentication controls for Provider personnel, including multi-factor authentication and least-privilege access to production systems.
Logical separation of each customer’s data within the Software.
Backup and recovery procedures; monitoring of service health and security events.
Personnel confidentiality obligations and data protection awareness.
Vulnerability and patch management; secure development practices; incident response procedures, including the breach notification process in clause 16.
Execution
This DPA is entered into by the Customer’s acceptance of the Terms of Use at registration. No signature is required, and that acceptance constitutes execution of this DPA by both Parties.
If the Customer requires a separately signed copy of this DPA, or wishes to discuss amendments, please contact the Provider at support@gaintax.co.uk.
This Data Processing Agreement was updated on 3 August 2026.