You are the controller. We are the processor. That is not a formality.

What each role means here

The operator decides why personal data is processed and what happens to it: which checks run, which thresholds apply, how long evidence is kept, and what a player is told. We carry those decisions out and do nothing with the data outside them.

The practical consequence is that a player's request reaches us through you. We will not act on an instruction about a player's record from anyone other than the controller, because doing so would itself be a breach.

What the agreement covers

Subject matter and duration, the nature and purpose of processing, the categories of data and data subjects, our obligations and the operator's rights, and the standard clauses on confidentiality, security, sub-processing, assistance, breach notification, deletion and audit.

• Processing only on documented instructions
• Staff bound by confidentiality
• Technical and organisational measures, described rather than asserted
• Sub-processors listed, with advance notice of changes and a right to object
• Assistance with subject requests and with impact assessments
• Breach notification without undue delay
• Deletion or return at the end of the engagement, less what retention law requires
• Information and audit rights

Sub-processors

The platform routes checks to data sources, and those sources are sub-processors. The current list is supplied with the agreement and maintained for the term. Changes are notified in advance with a right to object, which is the point at which the orchestration layer becomes a contractual benefit as well as a technical one: a source can be replaced without your integration changing, but not without you being told.

International transfers

Processing happens in the region chosen for the operator — United Kingdom or European Union — and data does not leave it. Where a transfer is nonetheless required for a specific check, it is covered by the appropriate safeguards and identified in the agreement rather than discovered in a log.

How to get it

Ask, and say which entity will be the controller and which region you want. We will send the agreement in the first exchange rather than after a qualification call; procurement teams are entitled to read the terms before anyone books a meeting.