Greenlight Data Processing Addendum

Version 1.4 · 21 October 2026

Introduction and how this document works#

This Data Processing Addendum (the DPA) forms part of the Greenlight Terms of Service between Greenlight Compliance Ltd. (Greenlight, Processor) and the customer firm (Customer, Controller).

This DPA is signed by both parties. Unlike the Terms of Service, which are accepted at signup, the DPA is executed as a separate signed document before a Customer's account moves from trial to a paid Subscription Term. We do this because a regulated firm outsourcing the handling of its client records is normally expected by its own regulator and its own outsourcing policy to hold a signed written agreement, rather than a record of a tick box. Request a copy for signature at hello@greenlightamlcompliance.com.

Where a Customer is on a free trial and no signed DPA is yet in place, this published version governs Greenlight's handling of that Customer's data in the meantime, on the same terms.

The DPA is drafted to satisfy the processor obligations of Article 28 of the EU General Data Protection Regulation and the UK GDPR, which are the most demanding of the regimes likely to apply to our customers. It is intended also to satisfy the corresponding requirements of the data protection legislation of the Cayman Islands, the Commonwealth of The Bahamas and the British Virgin Islands, and to serve as the written outsourcing arrangement that a regulated firm in the Turks and Caicos Islands or elsewhere may be expected to have in place with a third party that holds its client records.

Where a term is defined in the Terms of Service and not here, it has the meaning given there.

1. Definitions#

Customer Personal Data means personal data contained within Client Data, that is, personal data that the Customer or its Users upload to, enter into or generate within the Service.

Data Protection Law means all laws and regulations applicable to the processing of personal data under this DPA, including, where applicable, the EU GDPR, the UK GDPR, the Cayman Islands Data Protection Act, the Bahamas Data Protection (Privacy of Personal Information) Act, the British Virgin Islands Data Protection Act, and the common law and statutory duties of confidentiality applicable in the Turks and Caicos Islands.

Data Subject, controller, processor, sub processor, personal data, processing, personal data breach and supervisory authority have the meanings given in the EU GDPR, or the nearest equivalent meaning under the Data Protection Law that applies to the Customer.

Restricted Transfer means a transfer of Customer Personal Data to a country that, under the Data Protection Law applicable to the Customer, requires a specific safeguard or transfer mechanism.

Standard Contractual Clauses or SCCs means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914, Module Two (controller to processor).

UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

2. Roles of the parties#

2.1 The Customer is the controller of Customer Personal Data. Greenlight is the processor.#

2.2 The Customer determines the purposes and means of the processing. The Customer decides which clients to record, which documents to upload, which risk assessments to make, how long to keep records, and which of its personnel to give access to. Greenlight supplies the Requirement Rules, which are the same for every Customer on a given rule set and are not presently configurable by the Customer. A Customer may ask Greenlight to change a rule, and clause 3.3 of the Terms of Service governs the Customer's responsibility for the rules that apply to it.#

2.3 Greenlight is a controller in its own right only in respect of the information described in sections 3.1 to 3.4 of the Privacy Policy, being website, account, security, support and billing information. That processing is governed by the Privacy Policy and not by this DPA.#

2.4 Nothing in this DPA makes the parties joint controllers.#

3. The Customer's obligations#

3.1 The Customer warrants that:#

a. it has a lawful basis for the processing it instructs, and has given any notices and obtained any consents required under the Data Protection Law applicable to it;#

b. it has the right to transfer Customer Personal Data to Greenlight and to authorise the processing described in this DPA, including the transfer to and storage in the United States described in clause 9;#

c. its instructions will not require Greenlight to process Customer Personal Data in breach of Data Protection Law; and#

d. it will not upload personal data that it does not need for a legitimate business purpose, and in particular will not use the Service as a general document store.#

3.2 The Customer is responsible for the accuracy of Customer Personal Data and for responding to Data Subjects.#

3.3 The Customer is responsible for who it gives access to. The Customer acknowledges that every User it creates can see all of that Customer's records. The Service does not presently restrict access to particular clients or documents within a firm. The Customer must therefore only create Users who are entitled to see its whole book, and must remove them promptly when they leave.#

4. Greenlight's processing obligations#

4.1 Instructions. Greenlight will process Customer Personal Data only:#

a. to provide, maintain, secure and support the Service in accordance with the Terms of Service;#

b. in accordance with the Customer's documented instructions, of which the Terms of Service, this DPA and the Customer's use of the Service are the complete set; and#

c. where required by a law applicable to Greenlight, in which case Greenlight will tell the Customer before processing unless that law forbids it.#

4.2 Greenlight will tell the Customer without delay if, in its opinion, an instruction infringes Data Protection Law. Greenlight may suspend performance of that instruction while the point is resolved.#

4.3 Purpose limitation. Greenlight will not process Customer Personal Data for its own purposes. Greenlight will not use Customer Personal Data to develop, train, test or improve any machine learning or artificial intelligence model.#

4.4 No sale or disclosure. Greenlight will not sell, rent, licence or otherwise disclose Customer Personal Data to any third party except to the sub processors in clause 8 or as required by law.#

4.5 Aggregated statistics. Greenlight may generate and use statistics about use of the Service, for example counts of documents processed or features used, provided those statistics contain no personal data and do not identify the Customer or any of its clients.#

5. Confidentiality and personnel#

5.1 Greenlight will ensure that only those of its personnel who need access to Customer Personal Data to perform the Service have access to it.#

5.2 Greenlight will ensure that each such person is bound by a written duty of confidentiality that survives the end of their engagement, and has been informed of the confidential and sensitive nature of the data.#

5.3 Greenlight will keep a record of the individuals who hold production access and will review it at least annually.#

5.4 Support access. Greenlight personnel may access Customer Personal Data only where necessary to diagnose or resolve a fault, to respond to a support request, or where the Customer asks. Each access is limited to named personnel, requires a recorded reason, is read only, expires automatically, and is recorded in a log that Greenlight keeps and makes available to the Customer on request. The Customer may disable support access for its account at any time through the Service.#

5.5 Greenlight acknowledges that Customer Personal Data may be subject to legal professional privilege or to statutory duties of confidentiality binding the Customer, and that the duties in this clause are in addition to, and not in substitution for, any such duty.#

6. Security#

6.1 Greenlight will implement and maintain the technical and organisational measures set out in Schedule 2, which are appropriate to the risk, taking into account the nature of the data and the state of the art.#

6.2 Greenlight may update those measures, provided the overall level of security is not reduced. The current version will be published at https://app.greenlightamlcompliance.com/data-processing.#

6.3 Greenlight makes no representation that it holds any security certification. Schedule 2 states what is in place and, where relevant, what is not.#

7. Personal data breach#

7.1 Greenlight will notify the Customer without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Customer Personal Data.#

7.2 The notification will include, to the extent known and as it becomes known:#

a. the nature of the breach, including the categories and approximate number of Data Subjects and records affected;#

b. the likely consequences;#

c. the measures taken or proposed to address it and to mitigate its effects; and#

d. the name and contact details of a person from whom more information can be obtained.#

7.3 Greenlight will not make any public statement or notification to a supervisory authority or to Data Subjects that identifies the Customer without the Customer's prior written consent, unless legally required to do so.#

7.4 Greenlight will cooperate with and assist the Customer in the Customer's own investigation, notification and remediation.#

7.5 Notification of a breach is not an admission of fault by either party.#

8. Sub processors#

8.1 The Customer generally authorises Greenlight to engage sub processors to process Customer Personal Data.#

8.2 The sub processors engaged at the date of this DPA are listed in Schedule 3.#

8.3 Before engaging a new sub processor that will process Customer Personal Data, Greenlight will give the Customer at least 30 days' notice by email to the account's administrative contact and by updating Schedule 3 at https://app.greenlightamlcompliance.com/data-processing.#

8.4 The Customer may object to a new sub processor on reasonable data protection grounds within that notice period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service, or the Service in whole, without penalty, and receive a pro rata refund of fees paid for the unused period.#

8.5 Greenlight will impose on each sub processor, by written contract, data protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for its sub processors' acts and omissions as if they were its own.#

9. International transfers#

9.1 The Customer acknowledges that the Service is hosted in the United States, that notification email is sent through a provider in the United States, and that Greenlight personnel access the Service from the Turks and Caicos Islands. Processing therefore involves transfers to and access from those countries.#

9.2 Where a transfer under this DPA is a Restricted Transfer, the parties agree that:#

a. for transfers subject to the EU GDPR, Greenlight will enter into the Standard Contractual Clauses (Module Two, controller to processor) with the Customer on request, with Schedule 1 of this DPA populating Annex I, Schedule 2 populating Annex II and Schedule 3 populating Annex III. They are not incorporated into this DPA by default, because Greenlight has no customer established in the European Union at the date of this version;#

b. for transfers subject to the UK GDPR, Greenlight will likewise enter into the UK International Data Transfer Addendum to those clauses on request, on the same basis;#

c. for transfers subject to the Data Protection Law of the Cayman Islands, The Bahamas or the British Virgin Islands, Greenlight's obligations in this DPA, and in particular clauses 4 to 8 and Schedule 2, are intended to provide the contractual safeguards those laws require, and Greenlight will enter into any additional documentation reasonably required to satisfy them; and#

d. Greenlight will, on request, provide the Customer with the information it reasonably needs to carry out a transfer impact assessment.#

9.3 Greenlight will tell the Customer if it receives a legally binding request from a public authority for Customer Personal Data, unless prohibited from doing so, will challenge a request it considers unlawful, and will disclose only the minimum required.#

Note on this clause. Counsel advised deferring the Standard Contractual Clauses until there is an EU or UK customer, so they are offered on request rather than incorporated by default. Greenlight will also appoint an Article 27 representative before accepting a customer established in either territory, as stated in the Privacy Policy.

10. Data subject requests#

10.1 The Service provides the Customer with functions to access and correct Customer Personal Data in its account, and to export part of it as described in clause 12.1, so that the Customer can respond to Data Subjects itself. Where the Service's own functions are not sufficient, Greenlight will assist under clause 10.3.#

10.1A Erasure of individual records is not presently a self service function. A client or an individual can be marked as exited or resigned, and a document can be hidden, but neither action erases the underlying record, because the Service is designed so that a compliance history cannot be rewritten. Where a Customer must erase an individual record to meet a legal obligation, it should ask Greenlight at hello@greenlightamlcompliance.com and Greenlight will carry out the erasure and confirm it in writing, normally within 10 business days.#

10.2 If Greenlight receives a request from a Data Subject relating to Customer Personal Data, it will not respond to the substance of it. It will tell the Data Subject to contact the Customer, and will inform the Customer within 5 business days.#

10.3 Where the Customer cannot fulfil a request using the functions in the Service, Greenlight will provide reasonable assistance, at the Customer's cost where the assistance is materially burdensome and the need for it did not arise from Greenlight's breach.#

11. Assistance, audits and information#

11.1 Greenlight will provide the Customer with the information it reasonably needs to demonstrate compliance with this DPA, and to carry out a data protection impact assessment or a prior consultation with a supervisory authority, in each case in relation to the Service.#

11.2 The Customer may audit Greenlight's compliance with this DPA:#

a. by submitting written questions, which Greenlight will answer within 30 days; and#

b. not more than once in any twelve month period, unless a personal data breach has occurred or a supervisory authority or the Customer's own regulator requires it, by an on site or remote audit on at least 30 days' notice, during business hours, of reasonable scope and duration, subject to confidentiality, and not in a way that disrupts the Service or risks another customer's data.#

11.3 The Customer bears its own costs of an audit and Greenlight's reasonable costs of supporting it, unless the audit reveals a material breach of this DPA by Greenlight, in which case Greenlight bears its own costs.#

11.4 Greenlight will cooperate with the Customer's regulator to the extent the Customer is required to make its outsourced arrangements available to that regulator.#

12. Return and deletion#

12.1 While its account is active, the Customer may export, using the functions in the Service, its requirement positions and review sign offs as CSV files. Those exports include the names of clients and of connected individuals, but not the other details recorded against them, such as dates of birth, addresses, nationality and identity document numbers, and not uploaded documents.#

12.1A On termination, self service export is not available once access ends. Within 30 days of termination the Customer may ask Greenlight for a complete extract of Customer Personal Data, including uploaded documents, and Greenlight will provide it within 10 business days at no charge.#

12.2 At the end of that period, Greenlight will delete Customer Personal Data from the production environment within a further 30 days.#

12.2A Backups. Backups are encrypted, held off site, and expire on a fixed cycle rather than being edited, so Greenlight cannot remove one Customer's data from a backup without destroying every Customer's. Customer Personal Data therefore persists in database backups until the relevant backup expires, which is up to 401 days after it was taken. Backed up copies of a Customer's uploaded documents are held under that Customer's own prefix and can be removed on request, and Greenlight will do so within 30 days of being asked. Until it expires, that data remains encrypted, is not restored or accessed except to recover the Service, and continues to be protected by this DPA.#

12.3 Greenlight may retain Customer Personal Data for longer only to the extent required by a law applicable to it, and in that case will keep it only for that purpose, protect it under this DPA, and delete it when the requirement ends.#

12.4 Greenlight will confirm deletion in writing on request.#

12.5 The Customer is responsible for exporting its own records before the periods in this clause expire. The Customer's statutory record retention obligations are its own, and the existence of its Greenlight account does not discharge them.#

13. Liability and term#

13.1 Each party's liability under this DPA is subject to the limitations and exclusions in clause 12 of the Terms of Service, except where Data Protection Law does not permit that limitation.#

13.2 This DPA takes effect when the Customer accepts the Terms of Service and continues for as long as Greenlight processes Customer Personal Data. Clauses 5, 9.3, 12 and 13 survive.#

13.3 Where the SCCs or the UK Addendum apply and conflict with this DPA, the SCCs or the UK Addendum prevail.#

Schedule 1. Details of the processing#

Subject matter. Provision of the Greenlight software as a service application for tracking client due diligence records.

Duration. The term of the Customer's subscription, plus the deletion periods in clause 12.

Nature and purpose. Hosting, storage, organisation, retrieval, structuring, display, transmission by email notification, export, and erasure of records uploaded or entered by the Customer, together with automated application of the Customer's Requirement Rules to produce lists of outstanding items.

Categories of Data Subject.

• The Customer's clients, both individuals and the individuals connected to corporate clients
• Directors, officers, shareholders, beneficial owners, settlors, protectors, trustees, beneficiaries and authorised signatories of the Customer's clients
• The Customer's own personnel who use the Service as Users

Categories of personal data.

• Identity data: name, former names, date and place of birth, nationality, gender
• Identity document data: passport, national identity card and driving licence details and images, including document numbers and expiry dates
• Contact and address data: residential address, correspondence address, email, telephone
• Verification data: utility bills, bank statements and similar address or source of funds evidence uploaded by the Customer
• Relationship data: role in relation to a client entity, shareholding, date of appointment or resignation
• Compliance status data: dates of onboarding, review and sign off, risk ratings entered by the Customer, and whether a person has been identified by the Customer as a politically exposed person
• User account data: name, work email, authentication records, and an audit record of actions taken in the Service

Special category and sensitive data. The Customer may upload data revealing racial or ethnic origin, for example from a photographic identity document, and data relating to a person's status as a politically exposed person, which may reveal political opinions. Identity documents may reveal other special category data incidentally. The Customer must not upload health data, biometric data used for identification, genetic data, or data relating to criminal convictions and offences unless it has confirmed with Greenlight in writing that the processing is lawful and that appropriate additional safeguards are in place.

Frequency. Continuous for the duration of the subscription.

Schedule 2. Technical and organisational security measures#

This schedule states the measures actually in place as at the date of this version, and separately lists the measures that are not yet in place. We publish the second list because a security schedule that mentions only what is finished is of no use to a Customer assessing us. Each item was checked against the platform before this version was issued.

In place#

Separation of customers. Each Customer's data is isolated at the database level by row level security policies applied to every table holding Customer data. The policies are enforced by the database and the application connects under a role that cannot bypass them, so a failure in application code results in no data being returned rather than another Customer's data being returned.

Immutable audit record. Every material action is recorded in an audit log that is append only, enforced by database triggers that reject any attempt to update or delete an entry.

Encryption at rest. We do not encrypt uploaded documents at rest on the application volume ourselves, and we do not rely on or claim encryption applied by our hosting provider. Every copy that leaves our infrastructure, including all backups, is encrypted before it goes. This is listed as a gap below.

Encryption in transit. All connections between a User and the Service use TLS. The application reaches the database over the hosting provider's private network, which is not reachable from the public internet, rather than over an encrypted database connection.

Authentication. Passwords are stored only as salted hashes using a memory hard key derivation function. Time based one time password two factor authentication is available to all Users. Email addresses are verified before an account becomes active.

Access control within the Service. Users see only their own firm's records. Requests to download a stored document are checked against the requesting User's firm on every request, independently of the database policies.

Least privilege for the application. The application serves requests under a database role that holds only the data manipulation rights it needs and cannot bypass the separation described above. A separate administrative credential exists for schema changes and scheduled work. That administrative credential is presently also present in the web application's environment, because the boot sequence and the nightly job use it, so least privilege is not yet complete. Removing it from the request path is a known gap and is listed below.

Personnel. Production access is limited to one named individual, bound by written confidentiality obligations.

Change control. Changes are version controlled and covered by an automated test suite, which includes tests asserting that one Customer cannot read another's data and that the application cannot reach the database without a Customer context. Every change to the application's code runs two suites before it can reach production: a unit suite inside the release build, and a suite of database tests, including those separation tests, against a real database. A failure in either prevents the release. Changes made to configuration rather than to code, such as hosting variables, service settings and storage settings, do not pass through those suites, and are listed as a gap below. There is no second person review step, because Greenlight is a two person company with a single developer.

Infrastructure. Hosting is provided by Railway Corporation in the United States. The underlying infrastructure providers operate recognised physical and environmental security controls.

Off site backups. The database is dumped hourly, encrypted to a public key whose private half is held offline, and uploaded to separate storage at a different provider under a credential that can write but cannot read. That credential cannot retrieve a backup, which is the point: a compromise of the running service does not expose the backups. The backup store applies a retention lock to every object written from 21 October 2026, so that for 35 days the upload credential cannot delete or alter it. That credential remains able to write a newer version or a hide marker alongside a locked backup, which does not change or remove the locked copy; the locked copy stays intact and recoverable. The lock is set in governance mode, so that a Customer's own erasure request can still be honoured within the period promised in clause 12.2A. Not every object written before that date is locked. Stored documents are copied once each, under the owning firm's own prefix, and are checked against their recorded checksum before being copied. A restore drill repeats a full download, decryption and restore, and prints the resulting record counts and checksums for comparison against production by a person. The most recent drill was carried out on 15 October 2026 and passed, with the restored database dump matching the checksum recorded when it was written and every stored document decrypting and matching its own checksum.

Committed but not yet implemented#

Not claimed#

Greenlight does not hold SOC 2, ISO 27001, or any other independent security certification, and does not represent that it does.

Schedule 3. Approved sub processors#

Note. The notification digest carries counts of outstanding items and a link into the Service. It does not contain client names, so no client identity passes through the email providers listed above. This replaces earlier behaviour in which the digest named clients, following counsel's advice that a regulated firm's confidentiality obligations made that unsuitable.

Greenlight Compliance Ltd. Providenciales, Turks and Caicos Islands hello@greenlightamlcompliance.com · greenlightamlcompliance.com

Greenlight Compliance Ltd. is in the course of incorporation in the Turks and Caicos Islands. Its company number and registered office will be added here on incorporation.