Draft · not an active customer contract
Commercial data processing: proposed terms and launch conditions
Draft 1.0 · 25 September 2026 · Provided for transparency, not yet executed
This page explains the proposed business-to-business processing arrangement and identifies remaining work. It does not turn the current demonstration or private administration platform into an HMRC-approved or commercially licensed filing product.
Status and parties
This is a publicly available draft for consultation and is NOT a binding Data Processing Agreement or an offer to process a new commercial customer’s personal data. The prospective service provider is INDIVORA LTD; the identity and role of each prospective business customer must be established in a separate, executed agreement. For our own website and enquiries, the company acts as a controller; for a business customer’s operational personal data it may act as processor only where an executed agreement and actual purposes establish that role.
Proposed processing schedule
Subject matter: operation of an agreed business-management workspace. Duration: the agreed service period plus a documented return or deletion period, subject to lawful retention. Data subjects may include the customer’s authorised users, employees, suppliers and end customers. Data may include business contacts, account identifiers, orders, invoices, payment references, inventory, staff and payroll records where expressly enabled. Each actual service and integration must specify its purposes, data categories, location, authorised users and retention in a separately approved schedule.
Documented instructions and confidentiality
The proposed processor would act only on the customer controller’s documented lawful instructions, including transfers, except where law otherwise requires. Access by staff and authorised sub-processors would be limited to persons bound to confidentiality. An instruction to submit a statutory filing or initiate a payment requires a separate verified service, government-account authorisation and explicit action-specific approval.
Security, sub-processors and transfers
Before activation the parties must approve the actual hosting, authentication, access-control, tenant-isolation, encryption/key handling, backup, monitoring and incident-response arrangements. A current list of sub-processors, their locations and their onward-transfer arrangements must be provided, with the appropriate advance notification and objection/change mechanism. Required UK international transfer safeguards must be documented and assessed where relevant. Database-region labels alone do not establish data residency.
Requests, incidents and compliance assistance
A binding agreement must describe how the processor helps the controller with access, correction, erasure, breach notifications, impact assessments and regulator requests. Incident communications should occur without undue delay after the processor becomes aware of a personal-data breach, with the detail needed for the controller’s obligations. The exact reporting channels and contacts must be agreed before launch.
Deletion, return, evidence and audit
On service termination, the controller would be able to request return or deletion of personal data, subject to lawful storage and a documented backup schedule. A signed agreement must define the timeframe, export format and independent audit or inspection arrangements. We cannot promise that these operational mechanisms are live until they have been implemented and tested.
What remains to be approved
Commercial onboarding remains conditional on confirmed legal identity, controller/processor mapping, agreed customer terms, an executed DPA where required, an actual sub-processor and international-transfer register, a reviewed record-retention schedule, verified access and dedicated-tenant isolation, appropriate incident response, and a functioning subject-rights and account-closure process. The fictional demo and any currently paused enquiry intake do not activate these conditions.
Review the current privacy notice, current terms and planned tax integrations.
Return to homepage