Obligary Data Processing Addendum

This Data Processing Addendum applies where a customer organisation uses Obligary to store, manage or process personal data inside its workspace.

For that customer workspace content, the customer organisation is normally the controller and Web Wonderland Ltd, trading as Obligary, acts as processor by providing the platform.

Where Web Wonderland Ltd processes personal data for its own business purposes, such as billing, account administration, support, service security or sales, it acts as controller as described in the Privacy Policy.

Obligary processes customer workspace data to provide, secure, maintain and support the service.

Customer workspace data may include:

• organisation, workspace and membership records
• task, reminder, calendar and completion records
• evidence files and file metadata
• controlled documents, document versions, approvals, reviews and acknowledgements
• ISO management-system records, audit records, findings, actions and objectives
• notes, comments, review outcomes and activity history
• reports, exports and audit-pack data
• user names, business email addresses, roles and permissions

Obligary may also process public UK company data from Companies House when a user chooses to search for and apply company details to a workspace.

Web Wonderland Ltd processes customer workspace data only to provide Obligary, follow the customer's lawful configuration and instructions, comply with these terms, meet legal obligations, and keep the service secure and reliable.

Product actions taken by authorised users, such as uploading evidence, inviting users, creating reports, assigning tasks, sending reminders or deleting records, are treated as customer instructions.

Customers are responsible for:

• deciding what personal data is placed in Obligary
• making sure their use of Obligary is lawful
• providing privacy information to employees, suppliers, clients or other individuals where needed
• choosing appropriate workspace roles and permissions
• removing access when users no longer need it
• checking reports and exports before sharing them
• avoiding unnecessary sensitive personal data unless there is a clear and lawful reason to store it

Obligary uses selected service providers for hosting, database hosting, authentication, private file storage, transactional email and billing.

The current customer-facing list is maintained on the subprocessors page.

Companies House is used as a public company lookup source. It is not used as a processor for private customer workspace content.

Obligary is built around authenticated access, organisation-scoped permissions, role-based controls, private evidence storage, signed download URLs, audit logging and operational logging.

People supporting the service should only access customer data where needed to operate, support, secure, troubleshoot or improve the platform.

Customers remain responsible for their own user access decisions, device security, password hygiene and the content they upload.

Some service providers may process personal data outside the United Kingdom or European Economic Area.

Where required, Web Wonderland Ltd uses appropriate safeguards such as adequacy regulations, approved contractual terms, the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses, or equivalent protections.

Web Wonderland Ltd will provide reasonable assistance, through the product and support process, for customer requests relating to access, export, deletion, security, data subject requests and regulator enquiries.

Where a request relates to personal data inside a customer workspace, the customer remains responsible for deciding how to respond unless Web Wonderland Ltd is required by law to act directly.

Customers can use available product features to export workspace records and download files during an active subscription or access period.

Deletion, export and retention requests can also be raised through support so the correct organisation, billing and operational context can be checked.

Backup, billing, security and operational records may be retained for limited periods where required for legal, accounting, security, dispute-resolution or legitimate business purposes.

Obligary supports organisation, evidence, document-control, ISO preparation and reporting workflows. It does not provide legal advice, certify organisations, decide what obligations apply, or replace professional advisers.