Legal · Data Processing Agreement

Data Processing Agreement

Version 2026.08 · this DPA forms part of our terms of service for Ally Team and Ally Business workspace admins.

1. Parties

Processor: AllyHub Ltd, 27 Old Gloucester Street, London WC1N 3AX, United Kingdom, Companies House 15 619 428. Controller: the workspace admin who purchased an Ally Team or Ally Business plan. For personal plans this DPA does not apply — AllyHub is the controller for personal-plan data, see the privacy notice.

2. Subject matter and purpose

AllyHub processes personal data of workspace members (name, email, session metadata, aggregate engagement metrics) on the controller's behalf for the sole purpose of operating the shared workspace, provisioning member cabinets, and providing the controller with the agreed monthly engagement report.

3. Duration

This DPA is in force for as long as the workspace holds an active Ally Team or Business plan and for the retention windows described in section 8.

4. Nature and scope of processing

Collection: email invitation, magic-link sign-in, member self-service updates.
Storage: encrypted at rest (AES-256), hosted in Germany (Hetzner Falkenstein).
Consultation: by the workspace admin (aggregate only, never note content) and by AllyHub staff strictly under the limits in section 6.
Transmission: within processor infrastructure and to email provider (Postmark) for transactional messages only.
Erasure: within 30 days of controller request or workspace closure.

5. Types of data and categories of data subject

Types: contact identifiers (email, display name), authentication metadata (session tokens, IP, user agent), session metadata (bookings, attendance, completion of homework), aggregate engagement metrics. Categories of data subject: employees, contractors, or family members of the controller who have been invited to a seat and have signed in.

6. Controller and processor obligations

AllyHub will: (a) process personal data only on documented controller instructions; (b) ensure staff authorised to process are bound by confidentiality; (c) implement appropriate technical and organisational measures per UK GDPR Article 32; (d) engage sub-processors only under a written contract that imposes equivalent obligations (see section 9); (e) assist the controller with data-subject rights requests where reasonable; (f) make available all information necessary to demonstrate compliance and allow reasonable audits; (g) notify the controller without undue delay after becoming aware of any personal data breach affecting workspace members.

7. Security measures

See the security whitepaper. In summary: TLS 1.3 in transit; AES-256 at rest; Argon2id-hashed magic-link tokens; role-based access with quarterly review; principle of least privilege for staff; SOC 2 Type II audit programme (report available under NDA); annual penetration test by an independent third party.

8. Retention and deletion

Member cabinet content — retained until the member deletes it or the workspace is closed; hard-deleted within 30 days thereafter.
Sign-in security data — 90 days rolling.
Aggregate engagement reports — retained by the controller in their own systems; AllyHub keeps a copy for six years for audit purposes.
Invoice records — six years under HMRC rules.

9. Sub-processors

Current sub-processors: Hetzner Online GmbH (hosting); Cloudflare Ltd (object storage, CDN); Postmark / Wildbit LLC (transactional email); Stripe Payments UK Ltd (payments); GoCardless Ltd (Direct Debit); Plausible Insights OÜ (cookie-less analytics). Any change to this list is notified to workspace admins at least thirty days in advance; controllers may object in writing and terminate this DPA if the objection cannot be resolved.

10. International transfers

Where personal data is transferred outside the UK we rely on the mechanisms described in the UK privacy notice section 6.

11. Assistance to controller

On written request AllyHub will assist the controller with: data-subject access requests, data-subject deletion requests, DPIA input for the controller's own risk assessments, and breach notification to affected members within 72 hours of AllyHub becoming aware.

12. Liability

Liability under this DPA is subject to the limits in the terms of service. Nothing in this DPA excludes liability that cannot be excluded under UK GDPR or DPA 2018.

13. Governing law

This DPA is governed by the laws of England and Wales. Disputes: courts of England and Wales.

14. Audit rights

Once per twelve-month period, and on reasonable prior notice (not less than 30 days), the controller may audit AllyHub's compliance with this DPA by means of a written questionnaire, review of our most recent independent penetration-test report (available under NDA), and review of our SOC 2 Type II report once available. On-site inspection is available for enterprise controllers on request and at their cost; scheduling must respect the security controls of our hosting provider.

15. Breach notification

AllyHub will notify the controller of any personal-data breach affecting workspace members without undue delay and, where feasible, within 72 hours of becoming aware. Notification will include (per UK GDPR Article 33(3)): the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed. AllyHub will not notify affected data subjects directly on the controller's behalf without written instruction, unless required by law to do so.

16. Return and deletion

On termination of the workspace or written controller request, AllyHub will return the controller-relevant personal data (aggregate engagement reports, member list, invoice history) in a machine-readable format and then delete AllyHub's copies within 30 days, save for the narrow retention required by law (invoices under HMRC rules).

17. Contact

Data Protection Officer: dpo@allyhub.org. Post: AllyHub Ltd, 27 Old Gloucester Street, London WC1N 3AX, United Kingdom.