Data Processing Agreement (DPA)

This is not an audit and not legal advice. This page summarises how ComplianceForge acts as a processor and how you can obtain a DPA.

Operator: UGS Ltd — Universal Global Services Ltd, registered in England and Wales, Company No. 17423506 · Registered address: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom · EU/UK VAT via Ireland OSS · Last updated: 19 September 2026

1. Roles

When you use ComplianceForge with personal data of your own customers or employees, you are the controller and ComplianceForge (Universal Global Services Ltd) acts as a processor for the data you enter into the service.

2. Subject matter and duration

Processing lasts for the term of your use of the service. Categories of data subjects and personal data follow what you enter: typically identification and contact data and service usage data.

3. Our duties as processor

Process personal data only on your documented instructions.
Bind personnel to confidentiality.
Apply technical and organisational measures (encryption in transit, access control, audit logging).
Assist with data subject requests and breach notification without undue delay.
Delete or return personal data on termination, unless retention is required by law.

4. Sub-processors

The service runs on EU-hosted infrastructure and uses an AI gateway for the assistive gap feature. A current sub-processor list is available on request at [email protected].

5. How to obtain the full DPA

Email [email protected]. If you have a paid or pilot engagement, we provide the full agreement for signature. This page itself is not a signed DPA and not legal advice.