Data processing agreement

This agreement

This data processing agreement forms part of the terms of service for Certly. It applies whenever a customer's use of Certly involves us processing personal data on the customer's behalf, and needs no signature: it takes effect when the customer accepts the terms. Words such as controller, processor, personal data and processing mean what they mean in the UK GDPR and the Data Protection Act 2018.

The particulars

The processor

Kaleido Ltd, a company registered in England and Wales, company number 17516332, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

The controller

The customer, the organisation that holds the Certly account

Subject matter

Providing Certly to the customer

Duration

For as long as the customer uses Certly, and until the data is deleted or returned at the end

Nature and purpose

Hosting, storing and processing personal data so that Certly works for the customer

Types of personal data

Your name, email address and password (stored hashed); Your site's name, alert settings and the wording you write for your chase emails; Supplier company names, contact names and contact email addresses; Certificate documents you or your suppliers upload (PDF, PNG or JPEG), with issue and expiry dates, including versions replaced by a renewal; The sending account you connect: from address, mail server, sign-in name, and the mailbox password or API key, encrypted before it is stored; A log of every chase email: recipient, time sent, delivery result and opens; Sign-in session records, including IP address and browser; A record of the product actions you complete (a chase sent, a certificate uploaded, an audit PDF exported) and when you last used the app; Your subscription status, mirrored from Stripe; and the account details of the customer's users (names, email addresses and sign-in records)

People the data is about

The customer's users, and the people whose details the customer puts into Certly

Where it is processed

Amazon Web Services, in the product's own Postgres database. Uploaded certificate documents are stored in that same database, not in a shared file store.

What Kaleido Ltd agrees to

As the processor, we will:

• process the personal data only on the customer's documented instructions, which are these terms and the customer's use of Certly, unless the law requires otherwise, in which case we tell the customer first unless the law forbids it;
• make sure everyone we allow to process it is bound to keep it confidential;
• take the technical and organisational measures Article 32 of the UK GDPR requires to keep it secure, including encryption of data in transit and access limited to the people who need it;
• use only the subprocessors on our subprocessors page, which the customer authorises by this agreement. We update that page before a new subprocessor processes the data; the customer may object within 30 days, and if we cannot resolve the objection, end its use of Certly and receive a refund of any amount paid for a period it will not receive. Each subprocessor is bound by obligations no less protective than these, and we remain responsible for it;
• help the customer, as far as we reasonably can, to answer requests from the people the data is about;
• help the customer meet its obligations on security, personal data breaches, data protection impact assessments and consulting the regulator, taking into account what we process and the information we have;
• tell the customer without undue delay after we become aware of a personal data breach affecting its data;
• at the end of the customer's use of Certly, delete the personal data, or return it if the customer asks, unless the law requires us to keep it (each of the customer's users can download a copy of their own data from Settings in Certly before then);
• make available the information needed to show that we meet these obligations, and allow for and contribute to audits by the customer or an auditor it appoints, on reasonable notice and no more than once a year unless a regulator requires it or after a personal data breach;
• tell the customer straight away if we think an instruction breaks data protection law.

What the customer agrees to

The customer is responsible for having a lawful basis for the personal data it puts into Certly, for telling the people it is about what the law requires, and for the instructions it gives us.

Transfers outside the United Kingdom

We transfer the personal data outside the United Kingdom only where the transfer is covered by the UK's adequacy regulations or by appropriate safeguards, such as the International Data Transfer Agreement or the UK Addendum to the EU's standard contractual clauses.

Liability

Each side's liability under this agreement is subject to the limits in the terms of service, except where the law does not allow it to be limited.

Keeping a copy

To keep a copy of this agreement, print this page or save it as a PDF from your browser.

Who we are

Certly is a product of Kaleido Ltd, a company registered in England and Wales, company number 17516332, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

You can reach us at support@usecertly.com.

Last updated 2026-10-21