Data-processing terms for personal data handled within Weetra client engagements, including Article 28 GDPR processor terms where applicable.
Last updated: 14 September 2026
These terms address personal data handled in connection with Weetra client engagements. Industrial or confidential business information that is not personal data remains protected under the engagement’s confidentiality terms, but it is not regulated by the GDPR merely because it is commercially sensitive.
The parties’ GDPR roles depend on the processing activity. For personal data processed by Weetra solely on documented client instructions within an evidence review, the client acts as controller and Weetra acts as processor. For Weetra’s own administration, billing, security and relationship management, Weetra may act as controller. The applicable mandate or contract should identify any activity requiring a different allocation.
Subject matter: controlled intake, storage, examination and organisation of evidence records for the commissioned review. Duration: the engagement and any agreed or legally required retention period. Nature and purpose: documentary review, reconciliation, tracking of questions and corrections, preparation of deliverables, security and engagement administration. Personal-data types may include business contact details, names, professional roles, signatures, correspondence and personal data incidentally contained in industrial or commercial records. Data subjects may include client personnel, supplier/operator personnel, advisers and other professionals appearing in the reviewed evidence.
Weetra applies technical and organisational measures appropriate to the risk and service architecture, including controlled access, secure transmission, confidentiality obligations, access limitation and measures for resilience, backup or recovery where applicable. Algorithm-specific or certification claims are made only where they are verified for the relevant system and engagement.
Where Weetra acts as processor, it assists the controller, taking into account the nature of the processing, with appropriate measures for responding to requests relating to data-subject rights and with the controller’s obligations under Articles 32 to 36 GDPR where applicable.
Where Weetra acts as processor and relies on a sub-processor for the relevant processing, the arrangement is subject to the authorisation mechanism agreed with the controller and equivalent data-protection obligations. Information on relevant service providers can be supplied for procurement onboarding or the applicable engagement documentation.
Where Weetra acts as processor, it notifies the controller without undue delay after becoming aware of a personal-data breach affecting the processing covered by the engagement and provides information reasonably available to support the controller’s legal obligations.
Where required by Article 28 GDPR, Weetra makes available information reasonably necessary to demonstrate compliance with the processor obligations applicable to the engagement and permits audits under proportionate arrangements that protect confidentiality, security and the rights of other clients.
At the controller’s choice and subject to the engagement terms, Weetra deletes or returns personal data after the end of the relevant processing services unless Union or Member State law requires continued storage. The handling of non-personal confidential evidence follows the applicable contractual retention and return provisions.
Processing instructions and privacy enquiries can be sent to privacy@weetra.org.
Where Weetra acts as processor, the binding engagement terms must identify the subject matter and duration of processing, nature and purpose, personal-data types, categories of data subjects, controller rights and obligations, documented instructions, confidentiality, security, sub-processing, assistance, deletion/return and audit obligations required by Article 28 GDPR.
