Data Processing Agreement

Where Philip George Advisory processes personal data on your behalf — the content you put into the service — we act as your processor under Article 28 GDPR. This page summarises the terms; a signed agreement is available on request for organisations that need one.

1. Subject matter and duration

We process the personal data contained in your answers, tool register and generated documents, for as long as your account is active and for the retention period set out in our Privacy Notice.

2. Nature and purpose

Processing is limited to hosting your content, generating documents from it, and providing the service. We do not use your content to train models or for any purpose other than providing the service to you.

3. Our obligations as processor

• Process personal data only on your documented instructions.
• Ensure people authorised to process it are bound by confidentiality.
• Apply appropriate technical and organisational security measures.
• Engage subprocessors only under equivalent terms — see our subprocessor list.
• Assist you with data-subject requests and breach notifications.
• Delete or return personal data at the end of the service, subject to legal retention.
• Make available information needed to demonstrate compliance.

4. International transfers

Data is hosted in the EU/EEA. Any transfer outside the EEA relies on an adequacy decision or Standard Contractual Clauses, as set out in the subprocessor list.

5. Requesting a signed DPA

Email privacy@pgadvisory.io and we will provide a countersigned Article 28 agreement.