Core Thoughts AssuredContinuous cloud assurance for the UK public sector

Legal

Data processing addendum

Last updated 12 November 2026

This addendum applies where we process personal data on a Customer's behalf, including any personal data present in cloud configuration metadata (for example administrator usernames).

Roles

The Customer is controller; Core Thoughts Assured Ltd is processor.

Processing details

  • Subject matter: security assurance of the Customer's cloud services.
  • Data subjects: Customer staff and administrators.
  • Data: names, usernames, email addresses, MFA status.
  • Duration: the term of the agreement plus 30 days.

Our commitments (Art. 28(3))

  • Process only on documented instructions.
  • Ensure staff are bound by confidentiality.
  • Apply appropriate technical and organisational measures, including encryption, read-only access and UK hosting.
  • Use sub-processors only as listed on our sub-processors page, with 30 days' notice of changes and a right to object.
  • Assist with data subject requests and DPIAs.
  • Notify personal data breaches without undue delay and within 24 hours of becoming aware.
  • Delete or return data at the end of the service.
  • Make information available for audits.

International transfers

Only under the UK IDTA, the UK Addendum to the EU SCCs, or adequacy regulations.