Data processing terms
The Article 28 agreement between you as controller and us as processor for the claimant data you enter into a schedule.
Last updated: 13 October 2026
Scope
These data processing terms form part of, and are incorporated into, our terms of service and sale. They are the written contract required by Article 28(3) of the UK GDPR (and of the EU GDPR where it applies) between you as controller and us as processor. Where these terms conflict with the terms of service and sale on the subject of personal data, these terms take precedence.
1. The parties and their roles
You (the firm, chambers or practitioner using the service) are the controller. You decide whose personal data goes into a schedule and why, and you are responsible for having a lawful basis for it.
We are the processor: Yeti Trading and Holding Company Limited, trading as Posttime, a company registered in England & Wales (no. 16962101), registered office Garden Flat, 48 Lower Oldfield Park, Bath, BA2 3HP. ICO registration number ZC157856.
We act as a controller only for our own business records — your account, sign-in and purchase details, and our support correspondence with you. That is covered by our privacy notice, not by these terms.
2. What we process for you
| Item | Detail |
|---|---|
| Subject matter | Providing the PI Calculator for Schedule of Loss: the calculator, the schedule builder and the documents it generates. |
| Duration | For as long as the schedule exists in your account, ending when you delete it or your account is closed, plus the backup period in section 9. |
| Nature and purpose | Storing, retrieving, displaying, calculating from, backing up and deleting the data you enter into a schedule, and generating the schedule of loss and multipliers appendix you ask for. Nothing else. |
| Types of personal data | Determined by you. Typically: claimant names, dates of birth, sex, accident and injury details, summaries of medical and other expert evidence, life expectancy, care and assistance needs, employment history and earnings, and other financial losses. |
| Special category data | Yes. Schedules contain data concerning health, which is special category data under Article 9. You remain responsible for the Article 9 condition that permits it. |
| Categories of data subject | Claimants; their family members and carers; and witnesses and other individuals named in the narrative of a schedule. |
3. Our obligations
We will:
- Process only on your documented instructions, including on international transfers, unless we are required to do otherwise by law — in which case we will tell you first, unless the law forbids it. Your use of the service, and these terms, are your instructions. We will tell you if we think an instruction breaches data protection law.
- Keep it confidential. Everyone we authorise to process your data is bound by a duty of confidence and is told what they may and may not do with it.
- Secure it with appropriate technical and organisational measures under Article 32 — see section 5.
- Not use your data for our own purposes. We do not sell it, we do not profile claimants, and we do not use it to train any model.
4. Sub-processors
You give us general authorisation to appoint sub-processors. We impose the same data protection obligations on each of them by contract, and we remain fully liable to you for their performance.
The current list of sub-processors is published and is also available from privacy@posttime.uk. We will give you at least 30 days’ notice before adding or replacing one. If you reasonably object on data protection grounds within that period, you may close your account, and have your schedules deleted, before the change takes effect.
5. Security
Our measures include: encryption in transit (HTTPS/TLS everywhere, enforced by HSTS); a strict Content Security Policy; access to each schedule limited to the account that owns it; sign-in and session tokens stored only in hashed form; per-IP rate limiting; payment card data handled by Stripe and never reaching our servers; and access to production systems limited to named personnel using key-based authentication. We review these measures as the service changes.
6. Helping you meet your own obligations
Taking into account the nature of the processing and what we know, we will give you reasonable assistance with:
- Data subject rights. The service is built so you can find, correct and delete schedules yourself. If a request reaches us instead of you, we will not respond to it directly — we will pass it to you promptly.
- Security, breach notification and impact assessments under Articles 32 to 36.
7. Personal data breaches
We will notify you without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach affecting your data. We will tell you what we know — what happened, which categories and roughly how many records are affected, the likely consequences, and what we are doing about it — and will keep you updated as we learn more, so that you can meet your own 72-hour deadline to the ICO.
8. International transfers
Your data is stored and processed on servers in Germany, within the EEA. We do not transfer it outside the UK or EEA except where a sub-processor on our published list requires it — in which case we rely on UK adequacy regulations, the UK International Data Transfer Addendum, or Standard Contractual Clauses with appropriate supplementary measures.
9. Return and deletion
You can delete a schedule at any time, and download its documents while a case pass for it is running. A deleted schedule is removed from the live database immediately. When your account is closed, all of its schedules are deleted. Backups age out within 14 days and remain protected until they do. We keep no copy beyond that, except to the extent we are required by law to keep it.
10. Audit and information
We will make available the information reasonably necessary to demonstrate compliance with Article 28, and will allow and contribute to audits, including inspections, by you or an auditor you appoint. In practice we ask that you first accept the documentation we can provide; where that is not enough, audits are on reasonable notice, during business hours, no more than once a year unless a breach or a regulator says otherwise, and subject to confidentiality.
11. Contact
Data protection questions, sub-processor lists, breach notifications and audit requests: privacy@posttime.uk.
You may also complain to the Information Commissioner’s Office at ico.org.uk.
Contains public sector information licensed under the Open Government Licence v3.0. Terms, privacy and data processing. Built by Guy Mitchell, powered by Posttime. Yeti Trading and Holding Company Limited, trading as Posttime, company number 16962101.