Version 1.2 · Last updated: 13 October 2026 · Onevia Technology Ltd, trading as ClearStatement
This Data Processing Agreement ("DPA") forms part of the ClearStatement Terms of Service (the "Terms") between:
| Processor | Onevia Technology Ltd, trading as ClearStatement. Company number 17386326. Registered office: 18 Turpins Way, Baldock, England, SG7 6LW. ICO registration ZC220692. |
|---|---|
| Controller | The firm that holds the ClearStatement subscription. |
It applies by acceptance of the Terms, or as a standalone agreement when signed by both parties.
1.1 "Applicable Data Protection Laws" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended or replaced. "Controller", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", "Processor" and "Sub-processor" have their UK GDPR meanings.
1.2 "Client Data" means Personal Data of the Controller's clients and other individuals that the Processor Processes in providing the Service, namely transaction descriptions, amounts and directions sent for AI-assisted categorisation.
1.3 "Account Data" means Personal Data about the Controller's own users (names, email addresses, roles, login records) held to provide accounts and billing.
2.1 This DPA applies to Client Data, for which the Processor acts as processor. The Processor is a controller of Account Data, governed by its Privacy Policy.
2.2 Statement files, account holder names, account numbers, sort codes, balances and dates are read only within the Controller's own browser and are not Processed by the Processor.
3.1 The Controller is the controller and the Processor is a processor of Client Data.
3.2 The Controller is responsible for its lawful basis for Processing Client Data, and for giving privacy information to the individuals concerned, including joint account holders who are not applicants. On request the Processor will supply suggested wording describing the Service for the Controller's client privacy notice.
3.3 Transaction descriptions can incidentally reveal special category data (for example, payments to a health provider, union or place of worship). The Processor does not seek or use such data but acknowledges it may be present.
4.1 The Processor will Process Client Data only on the Controller's documented instructions, being this DPA, the Terms and the Controller's use of the Service, unless required by law.
4.2 Everyone authorised to Process Client Data is bound by confidentiality.
4.3 The Processor will maintain the measures in Schedule 3.
4.4 The Processor will give reasonable help with data subject requests, security, breach notification, data protection impact assessments and prior consultation (UK GDPR Articles 32–36). Because the Processor retains no Client Data, most requests can be met by the Controller from its own records.
4.5 The Processor will make available the information reasonably needed to show compliance with this DPA (clause 8).
5.1 The Controller authorises the Sub-processors in Schedule 2.
5.2 The Service reads each statement in the Controller's browser and first categorises transactions against the Controller's own category rules. Only for transactions those rules do not match, and only after the user confirms (once per browser session), the description, amount and direction of each transaction are sent over HTTPS to the Processor's relay on Cloudflare, which forwards them to Anthropic's Claude API and returns a category. The relay does not log, cache or store this data.
5.3 Anthropic Processes this data under its Commercial Terms, which incorporate its Data Processing Addendum with Standard Contractual Clauses. Under those terms Anthropic does not use the data to train its models by default and deletes API inputs and outputs within 30 days, save where it must retain them to enforce its usage policy or comply with law. No zero-data-retention arrangement is currently in place.
5.4 The Processor will impose data protection obligations on each Sub-processor equivalent to this DPA (UK GDPR Article 28(4)) and remains liable for their performance.
5.5 The Processor will give at least 30 days' notice by email to the account's administrator before adding or replacing a Sub-processor. The Controller may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Controller may terminate the affected Service without penalty.
6.1 The relay runs on Cloudflare's global network, normally at the data centre nearest the user. Anthropic may route inference to the US, Europe, Asia or Australia and stores data in the US.
6.2 Transfers outside the UK rely on the safeguards in Schedule 2: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the recipient is certified.
6.3 On request the Processor will configure AI categorisation to run on US-only infrastructure.
7.1 The Processor will notify the Controller without undue delay, and in any event within 48 hours of becoming aware of a Personal Data Breach affecting Client Data.
7.2 The notice will give, so far as known: the nature of the breach, the categories and approximate numbers of Data Subjects and records, likely consequences, and the measures taken or proposed. Further detail will follow as it becomes available.
8.1 The Processor will answer reasonable written security questionnaires once a year and provide its security summary, sub-processor list and, once held, its Cyber Essentials certificate and penetration test summary.
8.2 Where those are not enough to show compliance, the Controller may carry out an audit on 30 days' notice, at its own cost, during business hours, no more than once a year, subject to confidentiality.
9.1 Client Data passes through the Processor's relay in transit only and is not retained, so there is no Client Data to return or delete at the end of the Service.
9.2 The relay keeps no request logs containing Client Data. Cloudflare may record standard request metadata (such as IP address and time) for security, under its own terms.
9.3 Account Data is kept while the subscription is active. Within 30 days of a written request after termination, the Processor will delete it, except billing records kept for up to 7 years to meet tax and accounting obligations.
10.1 Each party's liability under this DPA is subject to the limitation of liability in the Terms, under which the Processor's total liability in any 12-month period is capped at the subscription fees paid by the Controller in that period.
11.1 The current version is published at clearstatement.co.uk/dpa.
11.2 The Processor will give at least 30 days' notice of any material change by email to the account administrator, except where a shorter period is needed for an urgent security or legal reason. Continued use after the change takes effect is acceptance; a firm on a signed standalone DPA must agree changes in writing.
12.1 This DPA runs for as long as the Controller has an account and until the Processor has completed clause 9.
13.1 Governed by the laws of England and Wales; the courts of England and Wales have exclusive jurisdiction.
13.2 If this DPA and the Terms conflict on the Processing of Personal Data, this DPA prevails.
13.3 Notices to the Processor go to help@clearstatement.co.uk; notices to the Controller go to its account administrator's email address.
| Subject matter | AI-assisted categorisation of bank statement transactions in the ClearStatement service |
|---|---|
| Duration | Transient: only for the time taken to categorise each batch; nothing is retained by the Processor |
| Nature and purpose | Relaying unmatched transaction lines to an AI model and returning a category, so the Controller can prepare income and expenditure analysis for mortgage applications |
| Data subjects | Mortgage applicants, joint account holders, and payers or payees named in transaction descriptions |
| Personal data | Transaction description, amount and direction (money in or out). Excluded: statement files, account holder names, account numbers, sort codes, balances, dates. May incidentally include special category data (clause 3.3) |
| Frequency | Each time a user chooses AI categorisation for unmatched lines |
| Sub-processor | Service | Location | Transfer safeguard |
|---|---|---|---|
| Anthropic PBC | AI categorisation (Claude API) | Inference in the US, Europe, Asia or Australia; stored in the US; US-only on request | Anthropic Data Processing Addendum with Standard Contractual Clauses |
| Cloudflare, Inc. | Hosting and the AI relay (Workers); account storage (Workers KV); cookie-free visit statistics (Web Analytics) | Global network | Cloudflare Data Processing Addendum |
| Stripe | Subscription billing and customer portal | UK, EU and US | Stripe Data Processing Agreement |
| Brevo (Sendinblue SAS) | Transactional email | EU | Brevo Data Processing Agreement |
| Google LLC (Workspace) | Support inbox | Global | Google Workspace Data Processing Amendment |
Stripe, Brevo and Google process Account Data rather than Client Data; they are listed for completeness.
To sign this DPA as a standalone agreement, email help@clearstatement.co.uk.