This is Pillar2OS's standard Data Processing Agreement (DPA) pursuant to Article 28 of the UK GDPR and EU GDPR. Enterprise customers may request a countersigned copy for their procurement records.
Version 1.0 — October 2026
Note: This is a template DPA. Enterprise customers requiring a signed DPA for their compliance records should email privacy@pillar2os.com to receive a countersigned PDF. This document is not legal advice; you should seek your own legal counsel to confirm it meets your requirements.
Parties
Clause 1
This Data Processing Agreement ("DPA") is entered into between:
Data Controller: The organisation that has entered into a subscription agreement with Pillar2OS (the "Controller"), and Data Processor:Ilumis Limited, a company incorporated in England and Wales, trading as Pillar2OS (the "Processor").
This DPA supplements and forms part of the main subscription or services agreement between the parties (the "Agreement"). In the event of conflict, this DPA prevails over the Agreement in respect of data protection matters.
Annex I — Details of Processing
Element
Details
Subject matter
Processing of personal data in connection with the provision of the Pillar2OS GloBE / Pillar Two tax compliance software platform.
Duration
For the term of the Agreement, plus any post-termination retention period required by applicable law or agreed in writing.
Nature of processing
Collection, storage, retrieval, computation, aggregation, transformation, and deletion of personal data as necessary to operate the platform and provide the services.
Purpose
Providing GloBE ETR computation, GIR filing support, Pillar Two compliance reporting, and related platform features as described in the Agreement.
Types of personal data
Name and email address of users; financial and tax identification data embedded in uploaded corporate data (e.g. TINs of reporting entities, names of jurisdictions and group members).
Categories of data subjects
Employees and contractors of the Controller who access the platform; employees and officers of group entities whose data is included in uploaded financial data.
Processor Obligations
Clause 2
The Processor shall:
Process personal data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by applicable law.
Ensure that persons authorised to process personal data are bound by confidentiality obligations.
Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the measures described in Annex II.
Not engage sub-processors without prior general or specific written authorisation from the Controller. Where general authorisation is given, the Processor will notify the Controller of intended sub-processor changes and allow the Controller 14 days to object.
Impose equivalent data protection obligations on any sub-processor by way of written contract.
Assist the Controller in ensuring compliance with obligations under Articles 32–36 GDPR (security, breach notification, DPIA, prior consultation).
At the Controller's choice, delete or return all personal data to the Controller after the end of the provision of services, unless retention is required by applicable law.
Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits conducted by the Controller or an auditor mandated by the Controller.
Notify the Controller without undue delay (and in any case within 48 hours) upon becoming aware of a personal data breach involving the Controller's personal data.
Controller Obligations
Clause 3
The Controller shall:
Ensure it has a lawful basis for processing personal data uploaded to the platform.
Ensure it has notified data subjects about the use of Pillar2OS as a data processor, as required by applicable privacy law.
Provide the Processor with clear and documented instructions for processing.
Not upload sensitive personal data (as defined in Article 9 GDPR / Schedule 1 DPA 2018) to the platform unless specifically agreed in writing.
Be responsible for the accuracy and lawfulness of personal data submitted to the platform.
Annex II — Approved Sub-processors
The Controller hereby grants general authorisation for the following sub-processors as at the date of this DPA. The Processor will notify the Controller of any additions or replacements at least 14 days in advance.
Standard Contractual Clauses (SCCs) / EU–US Data Privacy Framework
Database / infrastructure hosting
Persistent storage and compute for platform data
EEA / UK
Contractual DPA with hosting provider; data does not leave EEA/UK
Annex III — Technical and Organisational Security Measures
The Processor implements the following measures in accordance with Article 32 GDPR:
Encryption in transit: TLS 1.2 or higher on all connections.
Encryption at rest: AES-256 for all stored data.
Access control: Role-based access control (RBAC); principle of least privilege; multi-factor authentication required for all administrative access.
Authentication: Passwords hashed with bcrypt (cost factor ≥ 12); TOTP two-factor authentication available and enforced for admin roles.
Tenant isolation: All database queries are scoped to the Controller's organisation ID; cross-tenant data access is architecturally prevented.
Audit logging: All data access, modifications, and administrative actions are logged with user identity, timestamp, and action type; logs retained for 7 years.
Vulnerability management: Dependencies monitored via automated scanning (Dependabot); critical/high vulnerabilities patched within 7 days of disclosure.
Incident response: A documented incident response plan is in place; the Controller will be notified within 48 hours of any confirmed data breach.
Data minimisation: Only data necessary for the contracted services is collected and retained.
Business continuity: Regular automated backups; documented recovery time objectives.
Personal data is not transferred outside the UK or EEA except as described in Annex II. Where transfers occur to a third country, they are carried out on the basis of Standard Contractual Clauses approved by the UK ICO (IDTA) or European Commission, or on another transfer mechanism permitted by applicable data protection law.
Liability
Clause 5
Each party's liability under this DPA is subject to the liability limitations set out in the main Agreement. Nothing in this DPA limits either party's liability to data subjects or supervisory authorities under applicable data protection law.
Governing Law
Clause 6
This DPA is governed by the laws of England and Wales. Any dispute shall be subject to the exclusive jurisdiction of the courts of England and Wales, except where applicable data protection law requires otherwise.
Execution
To obtain a countersigned copy of this DPA for your records, email privacy@pillar2os.com with the subject line "DPA request" and your organisation name. We aim to return a signed PDF within 3 business days.
For the Data Processor
Ilumis Limited t/a Pillar2OS
Signature: ___________________
Name: ___________________
Title: ___________________
Date: ___________________
For the Data Controller
[Controller organisation]
Signature: ___________________
Name: ___________________
Title: ___________________
Date: ___________________