Data Processing Agreement

Last updated: 27 July 2026.

This Data Processing Agreement (DPA) supplements the Terms of Service and applies where you (the “Controller”) engage Formation Alert (the “Processor”) to process personal data on your behalf. Where you use the digest solely as a research aid for your own outreach and you determine the purposes of that outreach, you are the Controller of any personal data derived from the digest.

1. Scope and roles

Formation Alert acts as a Processor for the personal data made available to you through the digest, insofar as you use that data to identify prospects for your own commercial outreach.

2. Nature and purpose of processing

Delivery of a weekly digest of publicly-available UK company data (from Companies House) filtered to your criteria.

3. Categories of data

Publicly-available company data: company name, registered address, incorporation date, SIC codes, company type, and where applicable, information about directors and persons with significant control as published on the Companies House register.

4. Sub-processors

Formation Alert uses the sub-processors listed in the Privacy Policy. We will notify you of any new sub-processor at least 30 days before they begin processing your data.

5. Security measures

All data is stored in AWS eu-west-2 (London). Access is restricted to the operator via SSH key with fail2ban, systemd hardening, unattended security upgrades, and per-service isolated Linux users. Secrets are stored in a file readable only by the running service user. Data in transit is TLS-encrypted end-to-end.

6. Your obligations

You confirm that your use of the digest complies with UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). In particular: you have a valid lawful basis (typically legitimate interest for B2B outreach) for contacting individuals identified via the digest; you honour opt-out and unsubscribe requests; you keep records of your outreach activity.

7. Data subject requests

If a data subject contacts Formation Alert with a request relating to processing you have carried out, we will forward the request to you and cooperate reasonably.

8. Data breach

Formation Alert will notify you without undue delay (and within 72 hours) of any personal data breach affecting your data.

9. Deletion on termination

On termination of your subscription, we delete your account data (email, filters, digest history) within 90 days, subject to legal retention requirements for billing records.

10. International transfers

Where sub-processors are located outside the UK/EEA, transfers are made under Standard Contractual Clauses or an adequacy decision.

11. Contact

Data queries: hello@formationalert.com.