Legal

Data Processing Agreement

Last updated: 2026-04-23

Placeholder copy pending legal review. Do not rely on this as the final agreement.

This Data Processing Agreement governs the processing of personal data by Prism as processor on behalf of the Customer as controller. It incorporates the UK Standard Contractual Clauses where applicable.

Scope

Prism processes personal data solely on the documented instructions of the Customer for the purpose of providing the Prism service. We do not use Customer personal data for any other purpose.

Subprocessors

Amazon Web Services (UK regions only) — infrastructure
GoCardless — UK direct debit
Stripe — card processing
Resend — transactional email

We notify customers of new subprocessors 30 days in advance and accept objection in writing.