Last updated: 2 November 2026
Clear responsibilities, agreed in writing
A brokerage determines the purposes for which it uses its clients’ information and normally acts as the controller. AI Broker Solutions acts as a processor where it processes personal information on that brokerage’s documented instructions to deliver the agreed software services. We act separately as a controller for our own customer and business administration, explained in our privacy notice.
1. Processing scope
The service supports statement review, category suggestions, merchant-rule sharing and associated access and support services. Source statements and exported reports are handled locally in the desktop workflow. Online processing is limited by the service features used and must be documented in the agreed schedule.
The schedule must identify the customer, subject matter, duration, purpose and nature of processing; authorised users; categories of data subjects and personal information; applicable suppliers; locations and transfer safeguards; and deletion or return arrangements.
Relevant data subjects may include customer staff, mortgage applicants and people mentioned in payment descriptions. Screened descriptions are not assumed to be anonymous. Special-category or criminal-offence information must not be deliberately submitted for external processing without an appropriate lawful basis, safeguards and written arrangement.
2. Documented instructions
We process customer personal information only on documented instructions, including instructions about transfers, unless UK law requires otherwise. Where legally permitted, we inform the customer of that requirement before processing. We inform the customer if an instruction appears to infringe applicable data protection law.
3. Confidentiality and security
People authorised to process customer information must be subject to appropriate confidentiality duties. We apply technical and organisational measures appropriate to the processing and risk, including access restrictions and the screening controls described on our data and security page.
The customer remains responsible for its devices, staff permissions, source files, exports, backups and local retention decisions. Security measures and responsibilities should be recorded in the agreed schedule.
4. Sub-processors and transfers
Sub-processors require the customer’s prior specific or general written authorisation. Where general authorisation is used, we provide notice of intended additions or replacements and an opportunity to object under the agreed process. Equivalent data protection obligations must apply to the sub-processor; we remain responsible for our processor obligations.
International transfers require the customer’s authorisation and an applicable lawful transfer arrangement. The provider list identifies service roles; it is not, by itself, evidence of a signed supplier contract or transfer assessment.
5. Assistance and incidents
Taking account of the processing and information available to us, we assist with data-subject rights requests, security obligations, breach assessment, data protection impact assessments and consultation with the regulator where required.
We notify the customer without undue delay after becoming aware of a personal data breach affecting processing on its behalf and provide available information to support the customer’s response. The controller decides its notification obligations.
6. End of service
At the customer’s choice, personal information processed on its behalf must be returned or deleted at the end of the service, including copies, unless UK law requires retention. The agreed schedule sets out practical timing, backup handling and any required evidence. Ending a subscription does not automatically delete files held on the customer’s own computers.
7. Information and audit
We make available the information necessary to demonstrate compliance with the agreed processor obligations and allow and contribute to proportionate audits, including inspections, by the customer or its appointed auditor. Practical arrangements must protect other customers’ information and service security without removing statutory rights.
Request the agreement
Email [email protected] to agree the schedule for your business. Relevant UK sources include UK GDPR Article 28 and the Data Protection Act 2018.