Data Processing Addendum

Last updated: 14 October 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the Terms) between CounterCarbon Ltd ("SupplyFi", "we"), company number 17061500, registered in England and Wales, and the customer using SupplyFi ("the Customer"). It applies where we process personal data on the Customer's behalf, and meets the requirements of Article 28 of the UK GDPR. Terms such as "controller", "processor", "personal data" and "personal data breach" have the meaning given in the UK GDPR. Our own use of account data as controller is covered by our Privacy Policy.

1. Subject matter, duration, nature and purpose

  • Subject matter: providing the SupplyFi platform to the Customer under the Terms.
  • Duration: for as long as the Customer has an account, plus the period needed to return or delete the data under section 8.
  • Nature of processing: hosting, storing, organising, displaying, exporting and deleting data; sending email on the Customer's behalf; and, if the Customer uses AI features, sending the data they submit to AI model providers.
  • Purpose: to provide the Service to the Customer and to follow the Customer's documented instructions.

2. Roles, data categories and data subjects

For the data in this DPA, the Customer is the controller and SupplyFi is the processor.

  • Categories of personal data: business contact details (names, work email addresses, phone numbers, job titles, company names) of the Customer's suppliers and customers, and any other personal data the Customer chooses to put into the Service. The Service is not designed for special category data, and the Customer should not submit it.
  • Data subjects: the Customer's suppliers and customers (and their staff), the Customer's own staff, and other individuals whose details the Customer enters.

Product data (for example dimensions, materials and compliance details) is not usually personal data. Digital Product Passport pages are public by design and show product data the Customer chose to publish.

3. Our obligations as processor

We will:

  • Follow instructions. Process personal data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use of the Service's features. If we think an instruction breaks data protection law, we will tell the Customer. We will not process the data for our own purposes.
  • Keep it confidential. Make sure people authorised to process the data are bound by confidentiality.
  • Keep it secure. Apply appropriate technical and organisational measures, including encryption in transit and at rest, access controls that separate each customer's data, and regular security reviews.
  • Help the Customer. Give reasonable help with responding to data subject requests, security, breach notification, data protection impact assessments and prior consultation, taking account of the nature of the processing. We will pass on to the Customer any data subject request we receive about the Customer's data, rather than answering it ourselves.
  • Tell the Customer about breaches. Notify the Customer without undue delay after becoming aware of a personal data breach affecting their data, with the information we have to help them meet their own obligations.
  • Return or delete. See section 8.
  • Show compliance. See section 6.

4. AI features

Fi never sees your customer or supplier details, just the data they submit. Contact-like columns in spreadsheets are withheld before anything reaches a model. We use providers and settings that do not use the Customer's data to train their models. AI usage is logged for billing and abuse prevention. Customers who bring their own AI key send requests to their chosen provider under their own agreement with it, and that provider is then the Customer's own supplier, not our sub-processor.

5. Sub-processors

The Customer gives general authorisation for us to use the following sub-processors:

  • Clerk — authentication and session management
  • Supabase — database hosting (production: Frankfurt, eu-central-1)
  • Vercel — application hosting (functions run in Frankfurt, fra1)
  • Vercel Blob — file storage (EU, Dublin)
  • Vercel AI Gateway — routes Fi and AI draft requests to AI model providers, currently Anthropic
  • Stripe — payments and billing
  • Resend — email delivery
  • Inngest — background job processing

We have written contracts with each sub-processor that require protections equivalent to this DPA, and we remain responsible for their performance. We will tell the Customer of any new or replacement sub-processor by email or an in-platform notice, normally at least 30 days before it starts processing the Customer's personal data. The Customer may object on reasonable data protection grounds within that time. If we cannot resolve the objection, the Customer may cancel the affected Service under the Terms.

6. Audits

We will give the Customer the information needed to show we comply with this DPA. The Customer may audit us, or appoint an independent auditor, no more than once a year (or after a personal data breach), on 30 days' written notice, during business hours, without unreasonable disruption, and subject to confidentiality. We may meet an audit request first by answering a security questionnaire and sharing relevant documentation. Each party bears its own costs.

7. International transfers

Our production database and application functions are in Frankfurt, and file storage is in Dublin. Some sub-processors, including Clerk, Stripe and the AI providers, may process data in the United States. Where personal data is transferred outside the UK, we use appropriate safeguards: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider participates in it.

8. Deletion or return at the end

When the Customer ends the Service, they can choose to export their data or archive it, as set out in section 6.1 of the Terms. When an account is deleted, we will purge live systems within 7 days of the confirmed deletion request. Backups roll off on their normal schedule. We may keep copies where the law requires it, for example invoices for tax, and will protect them under this DPA while we do.

9. The Customer's responsibilities

The Customer is responsible for having a lawful basis for the personal data it puts into the Service, for giving any notices that data subjects are owed, and for the accuracy of that data.

10. General

This DPA applies for as long as we process personal data for the Customer. If it conflicts with the Terms about personal data, this DPA prevails. The limits on liability in the Terms apply to this DPA, to the extent the law allows. English law governs this DPA, and the courts of England and Wales have jurisdiction. We may update this DPA in line with the Terms (section 18).

11. Contact

CounterCarbon Ltd
Company No. 17061500
Registered in England and Wales
ICO registration number: [ZA…]
Email: hello@supplyfi.co.uk