Data processing agreement

Last updated: 17 October 2026

This agreement is a schedule to the Marker Customer Terms. It applies when a trainer uses Marker to process personal data about their clients.

1. Parties and definitions

1.1 The parties are Our Man in the Fifth Ltd, a company registered in England and Wales with company number 15759779, whose registered office is at 794 High Street, Kingswinford, West Midlands, DY6 8BQ ("we", "us", "the Processor"); and the person or business that holds a Marker account ("you", "the Controller").

1.2 Our contact for data protection is Ben Hawkes, director, at hello@markerapp.co.uk. We are not yet registered with the ICO. We will add our registration number here once it is issued.

1.3 If this agreement conflicts with the Customer Terms on the processing of personal data, this agreement wins.

1.4 In this agreement:

Data Protection Laws means the UK GDPR, the Data Protection Act 2018 and any other UK law on personal data that applies, as amended from time to time.
Client Data means personal data you put into Marker, or that Marker produces for you, about your clients and other people, as described in Annex 1.
Sub-processor means a supplier we use to process Client Data.
Personal Data Breach, controller, processor, data subject and processing have the meanings in the UK GDPR.
Restricted Transfer means a transfer of Client Data outside the UK that the UK GDPR restricts.

2. Roles

2.1 You are the controller of Client Data. We process it on your behalf as your processor.

2.2 We are the controller of your own account, billing and usage data. Our privacy policy covers that data, not this agreement.

2.3 You are responsible for having a lawful basis for the Client Data, for telling your clients how you use it (including that you record sessions and use an AI service to draft reports), for the accuracy of what you enter, and for paying any ICO fee you owe. We provide recording consent wording you may use, and ready-made wording for your own privacy policy in Settings, under "Text for your privacy policy".

3. Details of the processing

3.1 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

4. Our obligations

4.1 Instructions. We will process Client Data only on your documented instructions, including on transfers outside the UK, unless UK law requires otherwise. If it does, we will tell you before we process, unless the law forbids that. Your instructions are this agreement, the Customer Terms, your use of Marker's features, and any other written instructions we agree.

4.2 Unlawful instructions. We will tell you straight away if we think an instruction breaks Data Protection Laws.

4.3 Confidentiality. Only our directors may access Client Data. They do so only where needed to run, support or repair Marker, at your request, or to meet a legal duty. Each is bound to keep it confidential.

4.4 Security. We will keep in place the technical and organisational measures in Annex 2, as required by Article 32 of the UK GDPR. We may change them, but not so as to lower the overall protection.

4.5 Sub-processors. We will use sub-processors only as clause 5 allows.

4.6 Assistance. We will help you, taking into account the nature of the processing and the information we have, to meet your duties on security, Personal Data Breaches, data protection impact assessments and prior consultation with the ICO (Articles 32 to 36 of the UK GDPR), and to answer data subjects (clause 6).

4.7 Our own use. We will not use Client Data for our own purposes, sell it, or use it to train AI models. Our AI suppliers' terms say they do not train their models on data sent through their APIs (Annex 3).

4.8 End of processing and audits. Clauses 8 and 9 apply.

5. Sub-processors

5.1 You give general written authorisation for us to use the sub-processors listed in Annex 3 and on our sub-processor page.

5.2 Each sub-processor is bound by written data protection terms. These are the supplier's own standard terms, linked on the sub-processor page. We have checked that each covers confidentiality, security, breach notice, help with data subject rights, deletion at the end and audit information.

5.3 We keep the sub-processor list on that web page, with the date of each change. We update it before a new or replacement sub-processor processes Client Data. If we must replace one urgently for security reasons, we update it as soon as we can. We do not send individual email notice of changes.

5.4 If you object to a change, you may cancel your subscription at any time. You keep access to the end of the month you have paid for.

5.5 We remain responsible to you for our sub-processors' performance of their data protection duties.

6. Your clients' rights

6.1 Your clients do not have Marker accounts and do not contact us. If we receive a request from one of your clients, we will pass it to you without undue delay and will not answer it ourselves, other than to say we have passed it on.

6.2 Marker lets you meet most requests yourself. In Settings, under "A client's data", choose the owner from the list. You can then download everything Marker holds about them (a data file, plus a PDF of each report), or delete everything (their reports and saved dogs). You can also open, correct and download any single report, delete a report in Reports, and remove a saved dog in Settings, under Saved dogs. Marker does not keep voice note audio.

6.3 Where the tool cannot do what you need, email us at hello@markerapp.co.uk and we will help by email.

7. Personal Data Breaches

7.1 We will tell you without undue delay after we become aware of a Personal Data Breach affecting Client Data.

7.2 We will tell you, as far as we know them: what happened; the categories and rough numbers of people and records; the likely effects; what we have done and will do; and who to contact. We may give information in stages.

7.3 We will help you meet your own duty to report to the ICO within 72 hours, where required, and to tell affected clients.

7.4 Telling you about a breach is not an admission of fault.

8. When your subscription ends

8.1 We will email you when your subscription ends. For 30 days after it ends you can still sign in, open your reports and download them as PDFs, but not draft new ones.

8.2 When those 30 days end, your account and everything in it is deleted automatically: Client Data (reports, transcripts and saved dogs), your settings, your video library and your usage counts, unless UK law requires us to keep it. Billing records are kept for six years for HMRC, and Stripe holds them, not us.

8.3 Before deletion you can take a copy of Client Data yourself: any report as a PDF, and everything about one owner through Settings, under "A client's data" (a data file plus a PDF of each report).

8.4 Our sub-processors delete under their own terms. Anthropic deletes API inputs and outputs within 30 days, and OpenAI keeps them for up to 30 days. Netlify deletes data under its deletion policies after we delete it. Details are on the sub-processor page. We keep no backups of our own, and Netlify Blobs offers no restore that we control, so deleted data cannot be recovered.

8.5 We will confirm deletion in writing if you ask.

9. Information and audits

9.1 Once a year, on request and free of charge, we will give written answers to a reasonable security and data protection questionnaire. We will also give you this agreement, our sub-processor list and any certificates our sub-processors publish (for example Netlify's SOC 2 Type II report, where Netlify allows it to be shared).

9.2 A formal audit or inspection takes place only if the ICO or another regulator requires it. You must give at least 30 days' notice and pay the cost of the audit. The auditor must be bound by confidentiality, keep to business hours and not access other trainers' data.

9.3 Audits of our sub-processors are limited to the rights each gives us.

10. Transfers outside the UK

10.1 Client Data is stored and processed in the United States, as set out in Annex 3. You authorise those Restricted Transfers. We do not offer storage in the UK or the EU.

10.2 Each transfer relies on the safeguard the sub-processor states, shown in Annex 3: the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.

10.3 We will not make any other Restricted Transfer of Client Data without first updating the sub-processor list under clause 5.

11. Your obligations

Have a lawful basis for recording sessions and for the Client Data you put into Marker, and tell your clients about it.
Put in only what you need for the report. Avoid health or other sensitive details about people unless you need them.
Keep your password safe and do not share your account.
Delete reports and saved dogs when you no longer need them, in line with your own retention policy. Marker deletes transcripts automatically 90 days after the report is made.
Delete the original recordings on your own device. Marker never receives them.

12. Liability, duration and law

12.1 Each party's liability under this agreement is subject to the limits in the Customer Terms.

12.2 This agreement lasts for as long as we process Client Data for you, including the period in clause 8.

12.3 This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1. Details of the processing

Subject matter: Drafting, storing and producing written reports of dog training sessions from session transcripts and notes supplied by the trainer.
Duration: The term of the trainer's subscription, plus the period in clause 8.
Nature: Receiving what the trainer types or pastes; storing it; sending it to AI services to draft the report or type out a voice note; showing it back to the trainer to edit; producing a PDF in the trainer's browser; exporting or deleting everything about one owner when the trainer asks; deleting it.
Purpose: So the trainer can produce, edit, keep and download client reports, and fill in the form when a dog returns. The number of reports drafted is used for billing and fair use, but not their content.
Types of personal data: Owner's name. Dog's name, breed, age band and the date it was recorded, neutered status and neuter age. Session dates, last session date and number of sessions. Names of the trainers. The session transcript: whatever was said in the session, which may include names, family details, home details and anything else spoken. The trainer's typed or spoken note (stored as text). The report: what was taught, behaviour observations, remarks on the dog's health (for example advice to see a vet), and the videos, courses and services recommended.
Special category data: Not intended. A transcript may by chance contain health or other special category information about the owner or their household if it was spoken in the session.
Data subjects: The trainer's clients (dog owners); members of their household and other people present at or mentioned in a session, who may include children; the trainer and their staff named in reports.
Frequency: Continuous, whenever the trainer uses Marker.
Retention: Reports and saved dogs: while you are a customer, until you delete them. Transcripts: deleted automatically 90 days after the report is made; the report is kept. Voice note audio: not stored. Everything: deleted 30 days after the subscription ends.

Annex 2. Security measures

These are the measures in the Marker software as reviewed on 17 October 2026. We do not claim any measure not listed as in place.

HTTPS. Marker is served over HTTPS by Netlify. Calls from Marker's server to its sub-processors use HTTPS.
Hashed passwords. Passwords are stored only as a PBKDF2 SHA-256 hash with a random 16-byte salt for each password and 210,000 iterations. A password must be at least 10 characters.
Signed, time-limited sign-in. Sign-in tokens are signed with HMAC SHA-256 using a secret held on the server. They expire after 1 day, or after 90 days if the trainer ticks "stay signed in". Changing or resetting the password cancels every earlier sign-in.
Sign-in lock-out. Five wrong passwords for an email address lock that address out for 15 minutes. A password reset clears the lock.
Password reset. A reset link carries a random one-time code. It works once, for one hour. The reply is the same whether or not an account exists, so the form cannot be used to find out who has an account.
Separation by account. Each trainer's reports, transcripts, saved dogs, settings and video list are stored under that trainer's account key. The server takes the account from the signed token only, so it reads and writes only that trainer's records. All trainers share one Netlify store; the separation is by key, not by separate databases.
Drafting checks. Each AI draft needs a signed ticket valid for 15 minutes, issued only to a signed-in trainer inside the fair use limit. The drafting function checks the sign-in and the ticket before calling the AI service.
Keys held on the server. The Anthropic, OpenAI, Stripe, Resend and YouTube keys are held as Netlify environment variables and never sent to the browser.
Payments. Card details are entered on Stripe's own Checkout page. Marker never receives or stores card numbers.
Signed Stripe webhooks. Messages from Stripe are accepted only with a valid Stripe signature less than 10 minutes old.
Founder functions. The founders' functions (invitations, account list, status changes) need a separate secret key. Secrets are compared in constant time, and failed founder attempts are slowed by a fixed delay.
Input limits. The server checks the size and type of what it is sent, including logo file types and report size.
Browser headers. The app pages send headers that stop other sites framing them, stop file-type guessing, limit referrer information and ask search engines not to index them.
Voice audio is not kept. A voice note is passed straight to OpenAI to be typed out and is not saved by Marker. Only the text is kept, in the report.
Own fonts. Web fonts are served from Marker's own site. No font service receives visitors' IP addresses.
The host's own measures. Netlify says it encrypts Netlify Blobs at rest and in transit and runs a security programme in line with SOC 2 Type II and ISO 27001.
Automatic deletion. A daily job removes each transcript 90 days after its report is made, and deletes a cancelled account and everything in it 30 days after cancellation.
YouTube data refreshed. The same daily job refreshes each video library every 30 days. Titles and lengths are updated, and removed or private videos are dropped.

Annex 3. Sub-processors

The full list, with the data involved, transfer safeguards and links to each supplier's terms, is on our sub-processor page. In short: Netlify (hosting and storage), Anthropic (drafting), OpenAI (voice notes), Stripe (payments, trainer data only), Resend (emails, trainer data only) and Google (YouTube videos and website analytics, no client data). All are in the United States.

Also see: Privacy policy · Customer terms · Sub-processors.