Data-processing agreement

Last updated 23 October 2026.

This agreement explains how Spring Incubator Limited (“we”, the processor) handles personal information on behalf of your charity (the controller) when you use Trustee Meetings. It meets the requirement in UK data-protection law (UK GDPR, Article 28) for a written agreement between a controller and its processor, and forms part of our terms of use.

What we process, and why

• Subject matter & purpose: running your board’s governance — signing trustees in, sharing papers, recording decisions and sending reminders.
• Duration: for as long as your charity has an active account (see retention in the privacy notice).
• Types of personal data: trustees’ names, roles, email addresses, and the content your board chooses to upload (which may include sensitive material such as safeguarding or personnel information).
• Categories of people:your charity’s trustees, staff and anyone named in the content you upload.

Our obligations to you

• We only process your information on your documented instructions — in practice, by providing the features of the service — and not for our own purposes.
• Everyone with access is bound by a duty of confidentiality.
• We keep your information secure using appropriate technical and organisational measures (summarised in how we protect your data), including database-level separation of each charity, encryption in transit and at rest, and access limited to your board.
• We help you respond to requests from individuals (such as access or deletion) and to meet your own duties to keep data secure and report any breach. We will tell you without undue delay if we become aware of a personal-data breach.
• When your account closes, we delete or return your information as described in the privacy notice.
• We make available the information you reasonably need to show this agreement is being met.

Other providers (sub-processors)

We use a small number of trusted providers to run the service — currently Supabase (database & storage), Vercel (hosting) and Resend (email). Our AI features, provided by Anthropic, are switched off; while they were on, Anthropic processed the text of any papers or minutes they were used on. Our providers are listed, with what each does, in our privacy notice. Each is bound by equivalent data-protection obligations, and we will tell you in advance of any change so you can object.

Where your information is held

Your board’s records are stored in Ireland, in the EU. Some of our providers, including Vercel (our host), Resend (email) and Stripe (payments), are US companies and may process information in the United States; where they do, the transfer is protected by the UK Extension to the EU-U.S. Data Privacy Framework or the UK International Data Transfer Addendum.

Contact

Questions about this agreement can be sent to Spring Incubator Limited at brad@trusteemeetings.co.uk.