GDPR Compliance

Everything else on this page follows from a single distinction, and getting it the wrong way round is the most common error a vendor makes about their own position.

A worked example, because the abstraction is slippery. A manufacturer in Leeds uses SorviAI Finance and stores their own customers’ names, addresses and payment histories. They decide what that data is for, so they are the controller. We hold and process it for them, so we are the processor. We may not decide to use it for a purpose of our own: doing so would make us a controller of data we are not authorised to control, which is among the clearest ways to breach the regulation.

The same manufacturer records its staff’s working time in Worklink. That makes it the controller of its employees’ attendance data too, with the obligations UK employment law attaches to it, which the Worklink section sets out.

We hold both roles at once, and a reviewer who sees only half of it is entitled to assume the other half was overlooked. Our marketing list is ours to answer for. Your ledger is not.

Article 28 of the UK GDPR and the GDPR requires a written agreement between controller and processor. It is not paperwork attached to the relationship: it is what makes the relationship lawful.

It covers what article 28 requires it to cover: the subject matter and duration of the processing, its nature and purpose, the categories of data and of data subjects, processing only on your documented instructions, confidentiality obligations on our staff, the security measures we apply, the conditions under which we engage a sub-processor, our assistance with data subject rights, with data protection complaints, with breach notification and with impact assessments, deletion or return of your data at the end, and your audit rights.

Its security annex turns every security statement on this page and on our Security page into a contractual commitment. An overstated measure in that annex would be a breach of contract as well as an inaccuracy, which is why the security section below states the gaps next to the controls.

It does not name our sub-processors in its own text. That list changes when a vendor changes, and a list inside the agreement would mean re-executing the agreement each time; it is referenced by address instead, which is the next section.

A sub-processor is any third party that can touch your personal data: hosting, email delivery, error tracking, support tooling, payment providers.

• The list is published, not supplied on request. It lives on our Compliance page, with the vendor, what they do, what they can reach, where they hold it, and the safeguard that covers the arrangement.
• Our own suppliers are listed apart from yours. Our sub-processors are DigitalOcean (hosting: the application, the database and uploaded files, all in London), Cloudflare (network delivery and protection, supplied through DigitalOcean), Twilio SendGrid (email, United States), Stripe (our own billing), Sentry (error monitoring and session replay, in its EU region in Frankfurt, Germany), GeoNames (time-zone lookup from a postal code, Switzerland), Google Fonts (font delivery on the app), Google Docs Viewer (previews of Office attachments, which receives a signed, time-limited link to the file), jsDelivr with unpkg as fallback (delivery of the PDF preview component, flag and emoji images and the animation runtime) and Microsoft 365 (our support mailbox, which receives whatever you send us in a support request).
• Integrations you switch on are yours to direct. HMRC Making Tax Digital for VAT, UPS, FedEx, DHL, Microsoft 365 for TeamEmail and your own Stripe account are integrations you direct, not our sub-processors. For HMRC, the fraud prevention headers its rules require are sent with each call: the user’s public IP address and port with a timestamp, a hashed user ID, our own public IP address, a random device ID stored in the browser, the browser’s user agent, screen size, colour depth, display scaling factor and window size, and the time zone. Online invoice payment through the Customer Portal uses Stripe Connect: the money goes to your own connected Stripe account, but SorviAI creates that account and makes the charges with its own Stripe platform key, and the payer’s email address and invoice number are sent to Stripe.
• No AI provider. SorviAI does not currently use an AI provider; if one is added it will be listed as a sub-processor with its transfer basis.
• You are told before a new one starts, not after. We announce a change on the published list and email workspace account owners at least 30 days in advance, and you can object under the Data Processing Agreement. There is no separate subscription for these notices.
• Each must be bound by terms no weaker than ours. That is an article 28 condition on us, and it is the reason the list is short rather than convenient.

The application, the database and uploaded files are hosted in London, but personal data still crosses borders: error reports are processed in Germany, several suppliers are US companies, and some of our team work from India. Each crossing needs a lawful basis of its own, and this is the piece a data protection officer checks first.

Under UK law, as amended by the Data (Use and Access) Act 2025, a transfer out of the UK is lawful where the protection the data receives abroad is not materially lower than in the UK (the “data protection test”). A country covered by UK adequacy regulations passes it automatically. Otherwise the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, backed by a transfer risk assessment, remain the usual way to meet it; both stay valid after the 2025 changes. For US recipients, the UK Extension to the EU-US Data Privacy Framework (the “data bridge”) can be relied on where the recipient is certified under it, for the kinds of data its certification covers.

This area of law has moved several times, and each move invalidated arrangements that were compliant the day before. We would rather show you a row marked “not in place” than publish a mechanism that is not there, which is exactly how vendors end up describing an arrangement a court has since set aside.

A request from an individual comes to you, not to us. You are the controller, and our obligation is to give you what you need to answer it. The table states what the product does today.

Where a request needs us, our turnaround is 10 working days. You generally have one month to answer the individual, so ours is set well inside that.

A request that spans several modules needs our engineering team today, because nothing in the product assembles one person’s data across modules. That matters to you more than the format does: a request you cannot fulfil without emailing your supplier is a request with our queue in the middle of it.

What the 2025 Act changed for UK customers

For an access request you need only make reasonable and proportionate searches; the one-month clock does not run while you wait for the identity checks you need or, where you reasonably ask, for the person to clarify the request. Since 19 June 2026 you must also have a process for data protection complaints: people must be able to complain to you (for example through an electronic form), you must acknowledge each complaint within 30 days and respond without undue delay, and the ICO will normally expect a complaint to reach you before it reaches them. If a complaint concerns processing we carry out for you, we help you answer it within the same turnaround as a rights request.

Worklink records working time and holds employee records. In the United Kingdom that engages employment and immigration law as well as data protection law. You are the controller; we are your processor. This section sets out what UK employers ask us about most, what Worklink does today, and where it falls short.

What Worklink records. For each working day: the check-in and check-out times and the hours, breaks and overtime calculated from them; late arrival and early departure, in minutes, with any reason the employee gave; how the check-in was made (web app, header, administrator, automatic, personal link or kiosk tablet with a code or login) and which kiosk tablet; and the IP address of the check-in and of the check-out. The IP address is recorded every time, and there is no setting to switch it off. Worklink does not record location coordinates, photographs or biometrics at check-in. It also marks employees absent automatically each day, and can clock people out automatically if you switch that on (off by default).

Employee profiles can also hold personal details, home addresses, identification numbers, bank account details and annual pay, dependants with their dates of birth, education and career history, performance reviews, assets, training, exit interviews, uploaded documents, and leave records, including sick leave with the free-text reason each request requires. The visitor desk can record a visitor’s ID type and number, including passport and residence-permit numbers.

An employee who wants to see or correct their attendance record should ask their employer, who is the controller. We help the employer answer.

Employee data in Worklink: the UK rules in one table

UK GDPR and PECR apply in the same way across England, Wales, Scotland and Northern Ireland. Employment law in Northern Ireland is devolved and differs in places, so check the Northern Ireland rules for employees there.

As your processor we must keep our own record of the processing we carry out on your behalf (article 30(2)), and help you with impact assessments where your processing needs one (article 28(3)(f), article 35).

You have 72 hours to notify your supervisory authority of a personal data breach; in the United Kingdom that is the Information Commission (the ICO). Our duty is to notify you early enough that you can still meet it.

• Our commitment: without undue delay, and in any case within 48 hours of confirming an incident affecting your data.
• What you would be told: what happened, which categories of your data were involved, when it occurred and when we detected it, what we have done, and what you need to do.
• Who we would tell: the workspace administrators on record, and any additional contact you have given us for this purpose.

Where we are ourselves the controller (our own signup, marketing, newsletter and careers data), we notify the ICO within 72 hours of becoming aware of a breach, unless it is unlikely to result in a risk to the people concerned.

The same commitment appears on our Security page, and the two are not allowed to differ. If you find that they do, the shorter one binds and we have a documentation failure to fix.

Article 32 requires technical and organisational measures appropriate to the risk. Ours are described in full on the Security page rather than summarised twice and allowed to drift apart. These are the ones a data protection officer asks about first, with the limits we know about.

• Tenant isolation. Each customer is provisioned with a dedicated PostgreSQL schema, so your records are not co-mingled in shared tables.
• Access control. Permissions are role-based and scoped per application, and administrative rights are tiered rather than binary.
• Authentication. Each user can switch on two-factor authentication with recovery codes. Administrators cannot yet require it, it is not offered to Portal users, and there are no hardware keys or single sign-on.
• Audit logging. An audit log is written into your own schema, isolated on the same boundary as your data, and read-only through every interface. The audit log screen has no export; the Activity Log report exports user actions across Finance and Inventory. Coverage is incomplete: Repairs logs deletions only, most settings areas and several modules write nothing, and some sign-in routes write no entry. It is not tamper-evident (no hash chain, signature or write-once storage), and an entry is not written in the same transaction as the change it describes, so a failed write loses the entry rather than the change. Entries are kept for the life of the workspace.
• Staff access. Our support staff open a workspace as one of your users only for support, abuse or legal reasons, with a senior engineer’s approval. The start of that session is recorded in the same transaction as the access, and a banner shows in your interface; the actions taken during the session are not separately logged. Our director and one or two senior engineers can also connect to production databases directly. That access is reviewed every quarter, and those connections leave no audit record.
• Encryption. In transit, with TLS, with these exceptions: connections to the cache (which holds sessions) and the real-time Channels layer use TLS without verifying certificates (only the task broker verifies), the GeoNames lookup uses plain HTTP, and the public storefront reaches the backend over plain HTTP on the private network. At rest, DigitalOcean encrypts the database volumes (LUKS, AES-XTS with a 512-bit key) and the database backups (AES-256), and states that files in its object storage are encrypted at rest.

This is the section a vendor is most tempted to write loosely, and the one where a loose sentence causes the most damage. It concerns what happens when someone asks you to erase their data and that data sits inside your accounts.

An accounting system should be built so that booked records are immutable. Invoices, journal entries and ledgers are not meant to be editable after the fact, and statutory retention requires them to be kept for years. A general ledger you can quietly delete rows from is not a general ledger, and the audit trail that makes your books defensible is the same mechanism that makes erasure hard.

SorviAI does not yet meet that standard in full. A posted invoice can be permanently deleted from Trash, sent and partly paid invoices can be edited in place, lines and totals included, and the audit log is not tamper-evident.

So an erasure request can collide with a retention obligation, and both are legal requirements pointing in opposite directions. The resolution is not to pick one: it is to establish which data carries a retention obligation, to separate personal data from the transactional record, and to pseudonymise rather than delete where retention is mandatory.

Our retention periods for your data

These are the periods for the data we hold as your processor. Our Privacy Policy carries the full table, including the data we hold as controller.

We would rather show you an unanswered question than a promise the platform cannot perform. Promising erasure that a retention rule forbids is a commitment breached routinely, quietly, and in writing.

• The law. UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 (Royal Assent 19 June 2025; its main data protection changes in force since 5 February 2026, and the complaints duty since 19 June 2026), and PECR for electronic marketing and anything stored on a device.
• The regulator. The Information Commission, which replaced the Information Commissioner’s Office on 30 September 2026 and is still known as the ICO (ico.org.uk).
• Our registration. We are registered with the ICO under number ZC254426. The fee is paid by SORVI AI LTD, the controller for our own data, and anyone can check the entry on the ICO’s public register.
• Our UK representative. Not needed: SORVI AI LTD is established in the United Kingdom.
• Recognised legitimate interests. The 2025 Act lets a controller rely on a short fixed list of purposes, such as helping public bodies with crime prevention, safeguarding and emergencies, without the usual balancing test. We rely on it only when answering such a request about data we control; for your data, the decision is yours.
• Automated decisions. The 2025 Act reframed the rules on decisions based solely on automated processing. SorviAI makes no such decisions about anyone, for you or for ourselves. Worklink does mark employees absent automatically each day, and can clock people out automatically if you switch that on; these are automated records that you review and correct, not solely automated decisions with legal or similarly significant effect.
• Complaints. People can complain to us first about data we control, through the form on our contact page or by email to [email protected]; we acknowledge within 30 days and respond without undue delay, as our Privacy Policy explains. You need your own complaints process for data you control, as data subject rights explains.
• Fines. PECR fines now match UK GDPR levels: up to £17.5 million or 4% of worldwide annual turnover.

For a signed copy of the Data Processing Agreement, a rights request that needs our help, or a question this page does not answer. One address reaches us wherever you are, and we answer in English.

Data protection officer and representatives

Data protection officer: our reasoning

Article 37 requires a data protection officer where the controller or processor is a public authority, or where its core activities consist of large-scale, regular and systematic monitoring of individuals or large-scale processing of special category data. UK law has no headcount trigger. We are not a public authority. We host Worklink attendance and leave records as our customers' processor, but monitoring staff is not our core activity: the decisions about it are our customers', and at our current scale that processing is not large-scale. We will revisit this conclusion if that processing grows to a large scale.

This is the first published version. Every later version will be published here with its date, and earlier versions will be kept at this address.

The words on this page that carry a specific legal meaning, in plain language.