This page informs you of our data processing terms agreed by the customer and FinReg
Data Processing Terms
These Data Processing Terms form part of the licence agreement between the Customer and the FinReg entity identified in that agreement ("FinReg"). That entity is either FinReg Global Solutions Limited, a company incorporated in Ireland ("FinReg Ireland"), or FinReg Global Solutions LLC ("FinReg US"). The FinReg entity identified in the licence agreement is the contracting Data Processor under these terms.
Where FinReg US is the contracting Data Processor, it engages FinReg Ireland to provide, operate and support the FinReg Platform on its behalf, and FinReg Ireland acts as a Third-Party Processor subject to Section 5.
These terms take effect on the effective date of the licence agreement. References to the Customer as Data Controller and FinReg as Data Processor relate to Personal Data that FinReg processes on the Customer's behalf in providing the FinReg Platform and Products. FinReg's processing as an independent controller for its own business purposes is addressed in Section 10.
FinReg may update these terms from time to time by publishing the updated version at https://www.finregglobal.com/data-processing-terms with the date of the change.
(a) Non-Material Updates: Updates that are administrative, technical, or required to conform with changes in Applicable Law, and any other update that does not materially reduce the protection given to Personal Data, shall take effect upon publication.
(b) Material Updates: For updates that materially reduce the operational, security, or legal protections provided to Personal Data, FinReg shall provide at least thirty (30) days' advance written notice (via email or platform notification) to the Customer. If the Customer objects in writing on reasonable data protection grounds within such thirty (30) day notice period, the pre-existing DPA terms shall continue to govern the Customer's processing until the expiry or next renewal of the then-current licence agreement term.
Definitions
– Applicable Law: Any law or regulation legally applicable to a party's performance of its obligations under these terms.
– Customer: The individual or the company as represented by the individual with the appropriate authority to enter into the relevant licence agreement.
– Customer Data: all data, including Personal Data, submitted to the FinReg Platform by or on behalf of the Customer.
– Data Protection Requirements: All privacy and data protection laws and regulations applicable to the processing of Personal Data under these terms, including, to the extent applicable, Regulation (EU) 2016/679 (EU GDPR), the Irish Data Protection Act 2018, applicable Irish ePrivacy legislation, the UK GDPR and the UK Data Protection Act 2018, and applicable United States federal and state privacy and data protection laws, and any other data protection laws applicable to the processing of Personal Data under these terms, in each case as amended, supplemented or replaced, together with applicable binding regulatory and judicial decisions.
– Data Subject: The identified or identifiable living individuals who are subjects of the Personal Data.
– Data Subject Access Request: A request from a Data Subject in accordance with Data Protection Requirements.
– Personal Data: Means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person processed by FinReg on the Customer's behalf in connection with the provision of the FinReg Platform and Products, including associated customer communications and support.
– Third-Party Processor: Any third-party subcontractor engaged by FinReg to process Personal Data on behalf of the Customer in connection with the provision of the FinReg Platform and Products.
1. Data Processing
1.1 Data Processor shall only process Personal Data on behalf of the Data Controller in accordance with the licence agreement. The subject-matter, duration of the processing and the nature and purpose of the processing are based on the relevant product or licence agreement. The types of personal data and categories of data subjects are determined and controlled by the Data Controller based on the product in use.
i) Processing particulars. The subject matter of the processing is the provision, operation and support of the FinReg Platform and Products. Its purposes are to deliver the contracted functionality, administer user access, provide customer support and maintain the security and availability of the services. Processing may include collection, recording, organisation, storage, retrieval, consultation, transmission, backup, restoration, return and deletion.
ii) Processing continues for the term of the applicable licence agreement and any subsequent period during which Personal Data is retained in accordance with these terms.
iii) The categories of Data Subjects may include the Customer's authorised users, employees, contractors, representatives and business contacts, and individuals whose Personal Data the Customer includes in platform records, uploaded materials or support communications.
iv) The types of Personal Data may include names, business contact details, job titles, user and account identifiers, access and activity records, meeting details, correspondence and attachments, and other Personal Data contained in information submitted by or on behalf of the Customer through the Platform or associated support channels. The categories actually processed depend on the Customer's use of the services and documented instructions. Any additional customer-specific processing particulars shall be recorded in the applicable licence agreement or an agreed processing schedule.
1.2 Each Party shall comply with the obligations applicable to that party under Data Protection Requirements.
i) The Data Processor shall:
a) promptly inform the Data Controller if, in its opinion, it cannot comply with Data Protection Requirements or an instruction of the Data Controller infringes Data Protection Requirements.
b) ensure its personnel and Third-Party Processors who may process Personal Data have committed themselves to confidentiality.
c) process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or an international organisation, unless required to do so by Applicable Law to which the Processor is subject; in such a case, the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
d) within thirty (30) days after the end of the services, at the Data Controller's choice notified in writing, return the Personal Data (by making it available for export) and delete it, or delete it, unless Applicable Law requires its storage. If the Data Controller makes no choice within that period, the Data Processor shall delete the Personal Data. Personal Data held in backups shall be deleted in line with the Data Processor's backup retention cycle and remains subject to these terms until deleted.
e) make available to the Data Controller all information necessary to demonstrate compliance with Article 28 GDPR and these terms, and allow for and contribute to audits, including inspections, in accordance with Section 3.
ii) The Data Controller represents and warrants that:
a) Its use of the FinReg Platform does not contravene Data Protection Requirements.
b) It has complied and continues to comply with Data Protection Requirements, including requirements for consent and has given appropriate notices in relation to the processing of data by the Data Processor.
c) It has satisfied itself that the requirements under Article 28 GDPR as they apply to the Data Controller with regards to Personal Data are adequate and have assessed the security measures of the Data Processor.
d) It shall ensure compliance with and shall not diminish the Data Processor's security measures through its use of the FinReg Platform.
e) It understands that, to the extent possible, the Data Controller should ensure that any Personal Data is assessed prior to adding it to the FinReg Platform and consideration is completed as to the appropriateness of loading the Personal Data to the FinReg Platform, in particular in relation to special categories of Personal Data.
iii) the Data Processor shall implement all measures required by Article 32 GDPR, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risks to the rights and freedoms of natural persons.
2. Notification of Data Breach
2.1 The Data Processor shall notify the Data Controller without undue delay, and in any event within forty-eight (48) hours, after the Data Processor becomes aware of a personal data breach affecting the Data Controller's Personal Data, including where it is notified by a Third-Party Processor. Notification shall not be delayed pending completion of an investigation, and information may be provided in phases as it becomes available. Unsuccessful attempts that do not compromise the security of Personal Data, such as pings, port scans or failed log-ins, are not personal data breaches. Notification is not an acknowledgement of fault or liability.
2.2 In the event a data breach requires notification by the Data Controller to Data Subjects or relevant Regulators, the parties agree to coordinate in good faith on developing the content of any public statements or required notices.
3. Inspection
3.1 The Data Processor shall provide reasonable assistance in response to inquiries from the Data Controller or its Regulator relating to the processing of the Data Controller's Personal Data.
3.2 On written request, and no more than once a year, the Data Processor shall provide its current ISO 27001 certificate or similar, a summary of its most recent independent penetration test and reasonable answers to a security questionnaire. All such information is FinReg's Confidential Information.
3.3 Where information provided under clause 3.2 is insufficient, or a Regulator requires it, the Data Controller, or an independent auditor it appoints who is bound by confidentiality, may conduct an audit on thirty (30) days' written notice, no more than once a year, within an agreed scope and at the Data Controller's own cost. The Data Controller shall not carry out scans, penetration tests or other active security testing of the FinReg Platform without FinReg's prior written consent. During a Personal Data breach, the Data Processor's priority is containment and remediation; any related customer inspection shall occur only after containment is complete and a final incident report is issued. Nothing in this clause limits a direct, binding order from a competent Regulator.
4. Compliance, Co-operation and Response
4.1 The Data Processor will provide reasonable assistance to the Data Controller in complying with any Data Subject Access Requests or requests received by the Data Controller from Regulators.
4.2 If the Data Processor receives a Data Subject Access Request, the Data Processor will refer the Data Subject to the Data Controller, unless otherwise required by Data Protection Requirements. In the event the Data Processor is legally required to respond to the Data Subject, the Data Controller will fully co-operate with the Data Processor as appropriate. The Data Controller agrees that the provision of technical tools to enable the Data Controller to take the necessary action to comply with such requests/s shall be sufficient to discharge the Data Processor's obligations.
The final sentence of clause 4.2 applies only to the extent that the technical tools provided enable the Data Controller to fulfil the relevant request. Where additional assistance is necessary to meet the Data Processor's obligations under Article 28(3)(e) GDPR, the Data Processor shall provide that assistance.
4.3 Assistance provided under Section 3 and Section 4 using the Platform's standard self-service tools, documentation, and standard security certifications is included in the Customer's fees. Where the Data Controller requests extraordinary DPA-related assistance—such as bespoke compliance audits, manual data extractions outside standard export features, or custom regulatory reporting—the Data Controller shall reimburse the Data Processor's reasonable, pre-approved professional fees, except where assistance is required due to the Data Processor's breach of these terms.
4.4 Taking into account the nature of the processing, the Data Processor shall assist the Data Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling its obligations to respond to requests for the exercise of Data Subjects' rights under Chapter III GDPR.
4.5 Taking into account the nature of the processing and the information available to it, the Data Processor shall assist the Data Controller in ensuring compliance with its obligations under Articles 32 to 36 GDPR, including security of processing, personal data breach notifications and communications, data protection impact assessments and prior consultation with the supervisory authority.
5. Third-Party Processor
5.1 The Data Controller hereby consents to the use of the Third-Party Processor in accordance with Clause 5.2. The Data Processor confirms that they have procedures in relation to assessing third-party processors in line with their ISO 27001 procedures.
The Data Processor shall ensure that each Third-Party Processor is bound by a written contract imposing data protection obligations that provide at least the same level of protection for Personal Data as these terms, to the extent applicable to the services it provides, and that meet the requirements of Article 28(3) GDPR. The Data Processor may rely on a Third-Party Processor's standard data processing terms where they meet this standard. The Data Processor remains responsible to the Data Controller for each Third-Party Processor's performance of those obligations in accordance with Article 28(4) GDPR.
5.2 Subprocessor Authorisation and Objections.
(a) General Authorisation: The Data Controller provides general written authorisation for the Data Processor to engage Third-Party Processors. Current Third-Party Processors are set out in Schedule 1.
(b) Notice of Changes: The Data Processor shall give reasonable prior notice of any new or replacement Third-Party Processor to each Data Controller whose Personal Data will be processed by that Third-Party Processor.
(c) Scope of Objection: The Data Controller may object in writing within thirty (30) days of such notice on documented, reasonable grounds relating to the security or protection of its Personal Data. Objections regarding Third-Party Processors that do not process, store or access the Data Controller's Personal Data shall be invalid.
(d) Resolution & Termination: Upon receipt of a valid objection, the parties shall discuss the objection in good faith. If the Data Processor cannot reasonably accommodate or avoid using the Third-Party Processor for that Customer's services, the Data Controller may terminate the affected service line by giving thirty (30) days' written notice. Any financial adjustment or refund upon such termination shall be determined at FinReg's reasonable discretion in accordance with the underlying licence agreement. Termination under this clause is the Data Controller's sole and exclusive remedy for an unresolved objection.
(e) Urgent Replacement: Where a Third-Party Processor must be replaced urgently to protect the security of Personal Data, or for reasons outside the Data Processor's reasonable control, the Data Processor may make the replacement immediately and shall notify the Data Controller as soon as practicable. The objection process above then applies from that notification.
5.3 International Transfers. The Data Processor shall ensure that any transfer of Personal Data by it or any Third-Party Processor to a country outside the country in which that Personal Data is hosted complies with Data Protection Requirements. Where Personal Data subject to the EU GDPR or UK GDPR is transferred to a country that is not covered by an adequacy decision or regulation (including, for the United States, to a recipient not certified under the EU-U.S. Data Privacy Framework and its UK Extension), the transfer shall be covered by the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 and, where applicable, the UK International Data Transfer Addendum, or by another valid transfer mechanism. Where FinReg US is the contracting Data Processor and the Customer's processing is subject to the EU GDPR or UK GDPR, the Standard Contractual Clauses (Module 2) and, where applicable, the UK International Data Transfer Addendum are incorporated into these terms between the Customer and FinReg US, to the extent any transfer of Personal Data to FinReg US takes place. If a transfer mechanism relied on ceases to be valid, the Data Processor shall implement an alternative mechanism without undue delay.
5.4 Data Location. FinReg shall host Customer Data stored in the FinReg Platform in the hosting region specified in the licence agreement, and shall not change that region without the Customer's prior written agreement. FinReg's personnel, including individual contractors bound by confidentiality, may access Customer Data remotely, wherever it is hosted, to operate, maintain and support the FinReg Platform. Such personnel shall be located in the European Economic Area or the United Kingdom, or in another country where that access complies with clause 5.3. Third-Party Processors listed in Schedule 1 may process limited Personal Data, such as support correspondence, user identifiers and security logs, in the locations shown in Schedule 1.
6. Termination
The terms as set out above will run concurrently with relevant licence agreements between the parties. Please see the licence agreement in relation to terms and conditions upon termination.
7. Confidentiality
The terms as set out above will run concurrently with relevant licence agreements between the parties. Please see the licence agreement in relation to terms and conditions in relation to confidentiality.
Notwithstanding termination or expiry of the licence agreement, the Data Processor's obligations under these terms shall continue for as long as it or any Third-Party Processor retains Personal Data processed on the Data Controller's behalf, until that Personal Data has been returned or deleted in accordance with clause 1.2(i)(d).
8. Liability
The terms as set out above will run concurrently with relevant licence agreements between the parties. Please see the licence agreement in relation to terms and conditions in relation to liability.
9. Governing Law and Jurisdiction
9.1 Where FinReg Ireland is the contracting Data Processor, these terms and any dispute or claim arising out of or in connection with them (including non-contractual disputes or claims) are governed by the laws of Ireland, and the parties submit to the exclusive jurisdiction of the Irish courts.
9.2 Where FinReg US is the contracting Data Processor, these terms are governed by the laws of the State of Delaware, and the parties submit to the exclusive jurisdiction of the state and federal courts located in Delaware.
9.3 Where Standard Contractual Clauses apply to a transfer, their governing law and jurisdiction provisions prevail for disputes under those clauses.
10. FinReg's Processing as an Independent Controller
10.1 FinReg acts as an independent controller when processing business contact details and related communications for its own sales, marketing and customer relationship management purposes. This may include names, business contact details, job titles, relationship history and correspondence relating to those activities.
10.2 FinReg may use HubSpot, Pipedrive and Alta AI Inc. (which uses Snowflake as its data warehouse) to support these activities. To the extent these providers process information solely on FinReg's documented instructions for FinReg's own business purposes, they act as FinReg's processors and not as Third-Party Processors appointed on the Customer's behalf under these terms.
10.3 FinReg is responsible for identifying an appropriate lawful basis for this processing, providing the required privacy information, complying with applicable direct marketing requirements and facilitating the exercise of individuals' data protection rights. Acceptance of these terms does not constitute consent to direct marketing.
10.4 This section does not authorise FinReg to use Personal Data processed on the Customer's behalf for FinReg's own sales or marketing purposes. Where HubSpot processes Personal Data on the Customer's behalf in connection with customer communications or support, that processing is governed by the processor provisions of these terms, including Section 5.
Schedule 1
Addendum A — US Privacy Addendum
1. Application
This addendum applies automatically to the extent FinReg processes Personal Data on the Customer's behalf that is subject to applicable US privacy law, whichever FinReg entity is the contracting Data Processor. "Personal Data" includes personal information under that law. FinReg means the contracting entity identified in the licence agreement and acts as processor or service provider, or as a downstream processor where the Customer processes information for another controller. Statutory terms have their meanings under the applicable law.
2. Permitted purposes
The Customer discloses Personal Data to FinReg solely to host and operate the contracted governance, risk, compliance and quality-management services; administer accounts and access; provide support and associated communications; and perform security monitoring, maintenance, backups, restoration, export and deletion. The processing particulars in clause 1.1 apply. FinReg shall follow the Customer's lawful documented instructions.
3. Use restrictions
Where the California Consumer Privacy Act, as amended, and its regulations ("CCPA") apply, FinReg shall comply with its applicable service-provider obligations and provide the same level of privacy protection required of businesses. FinReg shall not:
– Sell or share Personal Data, including for cross-context behavioural advertising.
– Retain, use or disclose it outside the specified purposes or the direct business relationship with the Customer, except as expressly permitted by the CCPA.
– Combine it with personal information obtained from other sources or FinReg's own interactions with individuals, except as expressly permitted by the CCPA.
Customer-controlled Personal Data shall not be used for FinReg's own marketing, targeted advertising or cross-customer profiling. Section 10 and any Usage Data provision do not override these restrictions. FinReg confirms that it understands and will comply with them.
4. Protection and assistance
The main terms' confidentiality, security, breach-notification, subprocessor, audit and return-or-deletion provisions apply. FinReg shall additionally provide assistance required by applicable US privacy law with consumer requests, security and breach obligations, and data-protection assessments in accordance with Section 4 of the Data Processing Terms. Requests received directly shall be promptly referred to the Customer unless legally prohibited. Each relevant subprocessor processing Customer Personal Data shall be contractually bound to applicable equivalent protections and restrictions.
5. Oversight and remediation
FinReg shall provide necessary compliance information and cooperate with reasonable assessments required by applicable US privacy law. Where the CCPA applies, the Customer may take reasonable and appropriate steps to ensure that FinReg uses Personal Data consistently with the Customer's CCPA obligations. These steps may include reviewing FinReg's independent assessments and reports and, where those are insufficient, conducting assessments or audits once in any twelve-month period, in each case subject to and in accordance with Section 3 of the Data Processing Terms. Alternatively, FinReg may arrange an annual assessment by a qualified independent assessor and provide the Customer with the resulting report.
6. Priority and duration
For processing covered by applicable US privacy law, this addendum prevails over conflicting licence or processing terms to the extent necessary to give effect to these privacy obligations. It does not change agreed liability provisions, indemnities, governing law or forum, or limit mandatory legal rights or duties. Its protections continue while covered Personal Data is retained. Any required sector-specific agreement must be assessed separately.
Last updated: 29 October 2026