Adviser Data Processing and Sharing Agreement

earmarkIQ

Version 2026-10 · Last updated: 10 November 2026

This Adviser Data Processing and Sharing Agreement ("Agreement") forms part of the Adviser Terms between earmarkIQ Ltd ("earmarkIQ", "we", "us") and the firm named in the adviser application ("the Firm", "you"). It sets out how each of us handles personal data in connection with the earmarkIQ adviser account and dashboard ("the Adviser Service").

"Data Protection Law" means the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended. "Controller", "processor", "personal data", "processing" and "data subject" have the meanings given there.

In short: a client's earmarkIQ data is shared with you only on that client's instruction. Once you receive it, you are responsible for it as a controller in your own right. For the client email addresses you give us to send invitations, we act as your processor.

1. Our roles

Personal data	earmarkIQ	The Firm
A client's earmarkIQ account and financial data, held in earmarkIQ	Controller	No role until shared
Client data shared with you through the Adviser Service (viewed or exported)	Controller of its own copy	Independent controller of what you receive
Client email addresses you enter to send invitations, before the client redeems	Processor	Controller
Adviser account data (your name, work email, mobile, firm details, sign-in and audit records)	Controller	Not applicable

We are not joint controllers. Each of us decides independently why and how it uses the personal data it controls.

Part A: Data shared with you by your clients

2. Basis and scope of sharing

We disclose a client's data to you only where that client has accepted your invitation in their own earmarkIQ account and chosen what you may see. The client's choice sets the scope.
The categories a client can share are: spending totals by category; individual transactions; balances, pensions, investments, property and net worth; and income and pay dates. The data subjects are your clients and, where a client's transactions show them, other people named in those transactions.
A client can narrow the scope or withdraw at any time, and access through the Adviser Service then ends immediately.
We keep a record of each access and show it to the client.

3. Your obligations as an independent controller

For client data you view or export, you will:

comply with Data Protection Law, including having a lawful basis for your own use and giving clients your own privacy information;
use it only for providing your professional services to that client and meeting your legal and regulatory record-keeping duties, as set out in section 7 of the Adviser Terms;
keep it secure with appropriate technical and organisational measures, and limit access to people in the Firm who need it and are bound by confidentiality;
keep it no longer than your professional and regulatory obligations require;
not transfer it outside the United Kingdom unless Data Protection Law permits the transfer;
respond yourself to data subject requests about the copies you hold; and
stay registered with the ICO for as long as the law requires you to be.

When a client withdraws access, we stop the sharing. Whether you may keep data you already exported is a matter for your own obligations and your relationship with the client.

4. Co-operation

Each of us will give the other reasonable help with data subject requests, regulator enquiries and personal data breaches that concern data shared through the Adviser Service. If you become aware of a personal data breach affecting such data, including unauthorised access to your adviser account, you will tell us without undue delay and in any case within 48 hours, at support@earmarkiq.app. We will tell you without undue delay of a breach on our side that affects data you have received or your adviser account.

Part B: Where earmarkIQ acts as your processor

5. Subject matter

Processing	Storing the client email address you enter with an invitation and sending the invitation email to it
Purpose	To deliver your invitation to your client
Personal data	Client email address; the fact that you invited them; invitation status and dates
Data subjects	Your clients and prospective clients
Duration	Until the invitation is redeemed, withdrawn or expires, and afterwards as part of the audit record of your account

When a client redeems an invitation they do so in their own earmarkIQ account, and we are the controller of that account.

6. Our obligations as processor

For the processing in section 5 we will:

act only on your documented instructions, which are these terms and your use of the invitation feature, unless the law requires otherwise, in which case we will tell you first where the law allows;
ensure that people authorised to process the data are bound by confidentiality;
apply appropriate technical and organisational security measures, described in section 8;
help you, so far as reasonable, to respond to data subject requests and to meet your obligations on security, breach notification and impact assessments;
tell you without undue delay after becoming aware of a personal data breach affecting the data;
delete the data at the end of the processing on your request, unless the law requires us to keep it; and
make available the information reasonably needed to show we meet these obligations, and allow for audits by you or an auditor you appoint, on reasonable notice, no more than once a year, and subject to confidentiality.

7. Sub-processors

You give general authorisation for us to use sub-processors for this processing. The current ones are:

Sub-processor	Purpose	Location
Railway	Hosting of our servers and database	Netherlands (Amsterdam region)
Resend	Delivery of invitation and account emails	United States

We put terms in place with each sub-processor that protect the data to the standard this Agreement requires, and we remain responsible for their performance. We will update this page before adding or replacing a sub-processor; if you object on reasonable data-protection grounds you may stop using the invitation-by-email feature or end the Adviser Service.

Where a sub-processor processes the data outside the United Kingdom, we rely on a transfer mechanism permitted by Data Protection Law, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum.

Part C: General

8. Security measures

Encryption in transit (TLS 1.2 or higher) and at rest.
Mandatory two-factor authentication for every adviser account, with adviser sessions that expire and sign-out after a period of inactivity.
Access to client data checked against the client's current consent on every request.
An audit record of adviser access, visible to the client.
Access to production systems limited to authorised earmarkIQ personnel.

9. Liability

Each of us is responsible for its own compliance with Data Protection Law. The limits and exclusions in the Adviser Terms apply to this Agreement, except where Data Protection Law does not allow liability to data subjects or regulators to be limited.

10. Term and changes

This Agreement applies for as long as you have an adviser account and afterwards for as long as either of us holds personal data covered by it. We may update it in the same way as the Adviser Terms; the version and date at the top show the current one.

11. Governing law

This Agreement is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Contact

Data protection questions: support@earmarkiq.app. earmarkIQ Ltd is registered with the Information Commissioner's Office (registration number CSN2001882).

earmarkIQ Ltd
Company number: 17056081
Registered office: Flat 3, Ash Lodge, Northbourne Road, London, SW4 7DS, United Kingdom