Plio Data Processing Addendum (DPA)
This Data Processing Addendum ("DPA") forms part of the Plio User Agreement between Paylists LTD ("Processor" or "Paylists") and the business customer ("Controller" or "Customer") for processing of personal data on behalf of Customer through Plio. It does not apply to processing for which Paylists acts as independent controller, described in the Privacy Policy.
1. Definitions and scope
"Customer Personal Data" means personal data processed by Paylists on Customer's behalf through Plio, including personal data in R&D records, project assignments, staff or contractor information, cost evidence, uploaded files and Lister prompts and outputs. "Data Protection Laws" means the UK GDPR and Data Protection Act 2018, and any other data protection legislation applicable to the relevant processing. Other terms have their meanings in the UK GDPR.
The processing described in Schedule 1 will continue for the duration of the Services and subsequent deletion period. Customer determines the purposes and lawful basis for Customer Personal Data and is responsible for instructing Processor lawfully.
2. Documented instructions
2.1 Processor will process Customer Personal Data only on documented Customer instructions, including this DPA, the User Agreement, configuration selections and authorised use of Plio, unless required otherwise by applicable law. Where law requires other processing, Processor will notify Customer beforehand unless law prohibits notice.
2.2 Processor will promptly inform Customer if, in its opinion, an instruction infringes applicable data protection law.
3. Confidentiality and security
3.1 Processor will ensure that persons authorised to process Customer Personal Data are bound by appropriate confidentiality obligations.
3.2 Processor will implement appropriate technical and organisational measures under Article 32 UK GDPR, proportionate to risk, including access controls, secure transmission, managed infrastructure controls, incident handling and backup/recovery measures, as detailed in Schedule 2 and the Security Statement.
4. Subprocessors
4.1 General authorisation
Customer grants general written authorisation for Processor to engage the subprocessors identified in the Subprocessor List, limited to providers actually engaged to process Customer Personal Data in connection with Plio.
4.2 Subprocessor obligations
Processor will enter into binding agreements with its subprocessors imposing data protection obligations that provide substantially equivalent protection to those applicable to Processor under this DPA. Processor remains responsible to Customer for the performance of its subprocessors' data protection obligations, as required by applicable law.
4.3 Changes to subprocessors
Processor will provide at least 30 days' advance notice of intended additions or replacements of subprocessors by email to the Customer's registered contact address or through an in-service notification.
Customer may object within 15 days of receiving the notice on reasonable grounds relating to the protection of Customer Personal Data.
Processor will consider the objection in good faith and seek a reasonable resolution. If the objection cannot be resolved, Customer may terminate the affected Services before the new subprocessor begins processing Customer Personal Data, without an early termination penalty, and receive a pro-rata refund of prepaid fees for the unused portion of the affected Services.
Where an urgent change is necessary to maintain security or service continuity, Processor may provide shorter notice, explaining the reason and preserving Customer's opportunity to object as far as reasonably practicable.
5. Assistance with rights and compliance
5.1 Taking into account the nature of the processing and information available, Processor will reasonably assist Customer with data subject requests and with obligations concerning security, breach notifications, data protection impact assessments and supervisory authority consultations, where required by applicable law.
5.2 Processor will not independently respond to requests about Customer-controlled data except on Customer's instructions or where legally required.
6. Personal data breaches
6.1 Processor will notify Customer without undue delay after becoming aware of a personal data breach concerning Customer Personal Data. Processor will provide reasonably available information about the nature of the breach, likely consequences and mitigation measures, with further information as it becomes available.
6.2 Customer remains responsible for deciding whether it must notify the ICO or affected individuals as controller.
7. International transfers
7.1 Customer authorises processing in the UK, EEA and other locations identified in the current Subprocessor List, subject to the requirements of applicable data protection law.
7.2 When restricted transfers require safeguards, Processor will implement an applicable adequacy basis, UK International Data Transfer Agreement, UK Addendum to EU Standard Contractual Clauses, EU Standard Contractual Clauses or other valid mechanism as relevant. The parties will provide additional safeguards where required after appropriate assessment.
8. Deletion or Return of Data
8.1 Upon termination or expiry of the Services, Processor will, at Customer's choice, return or delete Customer Personal Data processed on Customer's behalf and delete existing copies, unless applicable law requires continued storage.
8.2 Customer may request an export of Customer Personal Data before account closure, using the export procedures made available by Plio. Processor will provide reasonable assistance where required under applicable data protection law.
8.3 Personal Data remaining in backups will be securely protected, excluded from ordinary operational use and deleted in accordance with the documented backup retention cycle. If backup data must be restored before deletion, the applicable deletion requirements will be reapplied.
8.4 Where Processor is legally required to retain Personal Data, such data will remain protected, access will be restricted and processing will be limited to the purposes permitted by applicable law.
9. Audit and compliance information
Processor will make available information necessary to demonstrate compliance with Article 28 UK GDPR and permit and contribute to audits, including inspections, by Customer or its appointed auditor where legally required, subject to reasonable advance notice, confidentiality, proportionality and protections for other customers' data and platform security. Where appropriate, relevant third-party audit reports or documentation may be used first.
10. Liability, priority and changes
The User Agreement governs general commercial liability to the extent compatible with mandatory data protection law. This DPA takes priority where there is a conflict concerning processor obligations. Material amendments to this DPA will be handled in accordance with applicable law and the User Agreement.
Schedule 1 — Processing details
| Item | Description |
|---|---|
| Subject matter | Hosting and operation of Plio's business R&D project, evidence and AI-assisted workflow software |
| Duration | Subscription term and applicable deletion/retention period |
| Nature and purpose | Collection, storage, organisation, retrieval, display, analysis, export, security and deletion of Customer Content on Customer instructions |
| Data subjects | Customer's employees, contractors, business users, relevant technical professionals and other individuals named in records |
| Data categories | Business contact data, names, roles, work histories/qualifications, task and activity descriptions, recorded costs and allocations, uploaded documents, prompts, output, logs |
| Sensitive data | Not intended; must not be submitted without written agreement and appropriate protections |
| Controller responsibilities | Lawful basis, notices, minimisation, accuracy, user permissions, responding to rights requests and determining necessary retention |
Schedule 2 — Technical and Organisational Measures
Paylists LTD implements technical and organisational measures designed to protect Customer Personal Data processed through Plio against unauthorised access, loss, alteration and disclosure.
These measures are reviewed and updated as the Service evolves. Paylists LTD may modify individual measures, provided that the overall level of protection is not materially reduced.
1. Access Control
1.1 Access to Plio is controlled through user authentication and role-based permissions.
1.2 Customer users may access business information according to their authorised membership and assigned permissions.
1.3 Administrative access is restricted to authorised personnel with a legitimate operational need.
1.4 Authentication and sensitive operations are protected through appropriate access controls and measures against unauthorised activity.
2. Customer Data Separation
2.1 Plio operates a multi-tenant environment. Customer data is logically separated using database-level access policies and application-level authorisation controls.
2.2 Uploaded customer files are stored in private storage areas with access restricted to authorised users and services.
3. Encryption
3.1 Data transmitted between users and Plio is protected using encrypted HTTPS connections.
3.2 Customer data stored in managed database and file storage services is protected using the encryption-at-rest capabilities of the relevant hosting providers.
4. Credentials and Secrets
4.1 Sensitive service credentials and API keys are managed through protected configuration environments and are not intentionally exposed through public application code.
4.2 Access to privileged credentials is restricted to authorised services and personnel.
5. Logging and Monitoring
5.1 Plio maintains application activity records and audit information to support accountability, investigation and security monitoring.
5.2 Infrastructure and access logging is provided through the relevant hosting services, subject to their configured retention periods.
5.3 Access to logs is restricted according to operational responsibilities.
6. Software Development and Deployment
6.1 Plio uses controlled development, testing and deployment processes to reduce the risk of unauthorised or unintended changes.
6.2 Application and database changes are managed through version-controlled development processes.
7. Backup and Recovery
7.1 Plio uses backup and recovery capabilities provided by its managed infrastructure providers, according to the applicable service configuration.
7.2 Backup access is restricted, and backup data is protected through applicable provider security measures.
8. Vulnerability Management
8.1 Paylists LTD reviews security risks affecting Plio, including application dependencies, access controls and infrastructure configuration.
8.2 Identified vulnerabilities are assessed and addressed according to their severity and potential impact.
9. Personnel Confidentiality
9.1 Access to Customer Personal Data is limited to what is reasonably necessary for authorised operational purposes.
10. Incident Management
10.1 Paylists LTD maintains procedures for identifying, investigating and responding to suspected security incidents and Personal Data Breaches.
10.2 Personal Data Breaches affecting Customer Personal Data are handled in accordance with the notification and assistance obligations set out in the main Data Processing Addendum.
Schedule 3 — Subprocessors
Paylists LTD uses authorised subprocessors to provide Plio services. The current list of subprocessors, including their processing activities, is available in our Subprocessor List.
We will provide notice of intended additions or replacements and give customers an opportunity to object in accordance with this DPA.
Data protection contact: privacy@plio.co.uk.