Data-processing agreement

Last updated 3 June 2026.

This agreement explains how Spring Incubator Limited (“we”, the processor) handles personal information on behalf of your charity (the controller) when you use Trustee Meetings. It meets the requirement in UK data-protection law (UK GDPR, Article 28) for a written agreement between a controller and its processor, and forms part of our terms of use.

What we process, and why

• Subject matter & purpose:running your board’s governance — signing trustees in, sharing papers, recording decisions and sending reminders.
• Duration: for as long as your charity has an active account (see retention in the privacy notice).
• Types of personal data:trustees’ names, roles, email addresses, and the content your board chooses to upload (which may include sensitive material such as safeguarding or personnel information).
• Categories of people:your charity’s trustees, staff and anyone named in the content you upload.

Our obligations to you

• We only process your information on your documented instructions — in practice, by providing the features of the service — and not for our own purposes.
• Everyone with access is bound by a duty of confidentiality.
• We keep your information secure using appropriate technical and organisational measures (summarised in how we protect your data), including database-level separation of each charity, encryption in transit and at rest, and access limited to your board.
• We help you respond to requests from individuals (such as access or deletion) and to meet your own duties to keep data secure and report any breach. We will tell you without undue delay if we become aware of a personal-data breach.
• When your account closes, we delete or return your information as described in the privacy notice.
• We make available the information you reasonably need to show this agreement is being met.

Other providers (sub-processors)

We use a small number of trusted providers to run the service — currently Supabase (database & storage), Netlify (hosting), Anthropic (the optional summary feature) and Resend (email). They are listed, with what each does, in our privacy notice. Each is bound by equivalent data-protection obligations, and we will tell you in advance of any change so you can object.

Where your information is held

Your information is stored in the UK / European Union, or under equivalent legal safeguards where a provider operates elsewhere.

Contact

Questions about this agreement can be sent to Spring Incubator Limited at brad@trusteemeetings.co.uk.