Preparing your workspace

Last updated September 5, 2026

Data Processing Addendum

Revision 2026-09-05-draft.1

Draft pending UK specialist review. Not yet a contract.

These documents describe the agreement Tandem intends to offer. Three things are still outstanding: the supplying company’s registered identity and contact details, a signed data processing agreement, and the liability, indemnity and governing-law terms. Until those are settled, acknowledging a notice records only that you read it. It does not form a contract, authorise a charge, or constitute approval for launch.

You can raise a data protection concern with the Information Commissioner’s Office at ico.org.uk/make-a-complaint at any time.

Tandem Data Processing Addendum Version 2026-09-05-draft.1

Draft for product-owner and UK specialist review. This revision does not authorise paid launch or replace a signed customer agreement.

A binding data processing agreement must identify the customer controller and service-provider processor and state the subject matter, duration, nature and purpose of processing, data types and categories of people. This draft is a review outline, not evidence that those parties have signed such an agreement.

Processing must follow documented controller instructions, including transfer instructions, subject to applicable law. Personnel with access must be subject to confidentiality obligations. The agreement must define appropriate security measures and the process for authorising subprocessors, notifying changes and raising objections.

The processor's obligations must cover assistance with individual rights, security, breach notification, impact assessments and regulatory consultation as applicable. The agreement must also cover return or deletion at the end of service, lawful retention exceptions, compliance information, audits and notification of an unlawful instruction.

The processing schedule, security measures, retention periods, subprocessor register, international transfers and incident contacts require confirmation for the actual service before customer launch. A user's receipt of this notice does not execute a Company data processing agreement or approve subprocessors.