Janus DPIA tool: terms of use

These terms apply when you use the Janus DPIA tool at januscompliance.co.uk/tools/dpia. "We" means Janus Compliance Limited, a company registered in England and Wales under number 16583861, whose registered office is at 167–169 Great Portland Street, London W1W 5PF. "Your organisation" means the organisation for which you carry out the assessment. By starting an assessment, you confirm that you are authorised to agree to these terms for your organisation. The tool is provided to organisations for their business, public-sector or charitable work. It is not offered to consumers.

1. Acceptance

The start screen says "By starting, you agree to the tool terms on behalf of your organisation" and links to these terms. Starting an assessment is acceptance. The tool has no user accounts, so the version of these terms in force when the assessment started, and the time it started, are printed in the footer of the document.

2. What the tool does

The tool helps your organisation carry out a data protection impact assessment by asking questions, reading documents you add and drafting the assessment. It follows the published method at /tools/dpia/method. The tool does not give legal advice, does not state that any processing is compliant or lawful, and does not take decisions for your organisation. The decisions recorded in the assessment are your organisation's. If you want a professional to check the assessment, you can ask for a review, which is a separate service under a separate engagement.

3. Fees and the beta

Completing an assessment is free. Downloading a finished DPIA costs £39, paid through Stripe before the download. No VAT is charged, because Janus Compliance Limited is not registered for VAT. A screening record, where no DPIA is required, is free to download. Before you pay, you are asked to request the download immediately after payment and to acknowledge that you lose the right to cancel once the download starts. The paid invoice we send you by email confirms this. If the download fails and we cannot put it right within a reasonable time after you tell us through our contact form or at michael@januscompliance.co.uk, we will refund the payment in full. Otherwise, provided we have given you that confirmation as the law requires, the payment is not refundable once the download has started. This does not affect your rights under the law if the document is faulty.

Because the tool is in beta, it may change, and a draft may need more correction than usual. Check every draft before your organisation relies on it. When an assessment is finished, we ask for a rating and comments. Sending them is optional. We use them to improve the tool, we may act on them without any obligation to your organisation, and we do not publish them. Please leave out personal data and confidential details of the assessment.

4. Acceptable use

You may use the tool only to assess processing by your organisation, or by an organisation you act for. You must not try to make the tool do anything else, overload it, or extract its method or prompts by automated means.

5. Data protection: our role and your organisation's

5.1 For the content entered into the tool (what you type, the documents you add and the drafts), your organisation is the controller and we act as its processor. If your organisation is itself a processor carrying out the assessment for its own client, we act as its sub-processor, and your organisation confirms that its client has authorised this. We are the controller of our own payment records, of ratings and comments sent to us, of the notice contact details described in our privacy policy, and of information we use to keep the service secure.

5.2 The subject matter of the processing is the preparation of a data protection impact assessment. The processing lasts while you use the tool; if you ask for a private link, until the saved copy is deleted (by you, or by our daily deletion job once 30 days have passed since the last save); and, for copies held by our AI provider, for the period stated in section 7. The personal data are whatever your organisation chooses to include, which may include information about its staff, customers, suppliers or other people mentioned in the documents, and may include special category data if your documents contain it. The purpose is to produce the assessment.

5.3 When we act as processor, we:

1. process the content only on your organisation's documented instructions, which are these terms and its use of the tool, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by law to which we are subject (for processing under the UK GDPR, the law of the United Kingdom or a part of it; for processing under the EU GDPR, Union or Member State law); in such a case, we will inform your organisation of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
2. ensure that anyone we authorise to process the content is bound by confidentiality;
3. take all measures required by Article 32 of the GDPR and the UK GDPR (security of processing), including those described in section 6;
4. use only the sub-processors listed in section 7, which your organisation authorises generally by agreeing to these terms; give notice of any intended addition or replacement at least 30 days before it applies, by email to the address provided for notices and by publishing it on the tool page and in section 7; state in the notice the date from which the change applies; give your organisation the opportunity to object before that date, in which case it may stop using the tool and delete any saved copy before the change applies, so that its content is not processed by the new sub-processor; impose on each sub-processor by contract the same data protection obligations as these terms; and remain fully liable to your organisation for each sub-processor's performance of its obligations;
5. taking into account the nature of the processing, assist your organisation by appropriate technical and organisational measures, insofar as this is possible, in responding to requests from individuals exercising their rights;
6. assist your organisation in meeting its obligations on security, personal data breaches, impact assessments and prior consultation, taking into account the nature of the processing and the information available to us;
7. at your organisation's choice, return or delete the content at the end of the service: the conversation, documents and draft are held in your browser, which your organisation controls, and can be downloaded or kept by it (return) or cleared by starting a new assessment or clearing the browser's site data (deletion); a saved copy is deleted when you use "Delete the saved copy now" or by our daily deletion job once 30 days have passed since the last save; we keep no other copies; our AI provider deletes its copies on the schedule stated in section 7, except where keeping content is necessary to combat harmful use of its services (for up to two years) or where the law requires it. By using the tool, your organisation authorises that retention as part of its authorisation of this sub-processor, and we remain responsible to your organisation for the provider's processing. All of this applies unless the law requires storage of the personal data;
8. make available the information needed to demonstrate that we meet these obligations, and allow for and contribute to audits, including inspections, by your organisation or an auditor it appoints, on reasonable notice. We answer audit requests in writing without charge, using these terms, the security description in section 6 and our sub-processors' own documents. Any further audit, such as a meeting, an inspection or a questionnaire beyond that, is charged at our hourly rate (currently £250), quoted before it starts. Such an audit may take place once a year, and also at any other time when it is reasonably necessary: where a supervisory authority requires it, after a personal data breach affecting your organisation's content, or where your organisation has reasonable grounds to believe that we are not complying with these terms. There is no charge for an audit that a supervisory authority requires or that follows a personal data breach affecting your organisation's content.
9. tell your organisation without undue delay after becoming aware of a personal data breach affecting the content, by email to the address provided for notices, which your organisation confirms is authorised to receive data protection notices on its behalf, and by a notice on the tool page.

5.4 We will tell your organisation immediately if, in our opinion, an instruction infringes data protection law.

6. Security

The conversation is kept in your browser. Messages are sent over encrypted connections to our server, which passes them to our AI provider and does not keep them. Saved copies are encrypted in your browser before storage with a key derived from your private link, which we never receive. Access to our hosting, payment and AI provider accounts is restricted and protected by multi-factor authentication.

7. Sub-processors

• Anthropic (the AI model that writes the replies): our contract is with Anthropic Ireland, Limited, as Anthropic’s commercial terms provide for customers in the UK, and the content may be processed in the United States. Anthropic acts under its data processing addendum (Anthropic as processor; where a restricted transfer requires them, the EU standard contractual clauses, Modules Two and Three, and the UK Addendum). Anthropic deletes inputs and outputs within 30 days of receiving or generating them; because the conversation is sent again with each message, this runs from each message. It may keep content longer where that is necessary to combat harmful use of its services, such as content flagged under its usage policy (up to two years), or where the law requires; section 5 records your organisation's authorisation of that retention. Under its commercial terms it does not use content sent through its API to train its models by default; we do not submit feedback or opt in to training.
• Vercel Inc. (hosting, and storage of encrypted saved copies and notice contact details, Dublin region), United States. Transfers under the EU standard contractual clauses and the UK International Data Transfer Addendum for transfers from the United Kingdom.

8. Liability

Our total liability to your organisation arising from its use of the tool, whether in contract, tort (including negligence) or otherwise, is limited to the greater of the amount your organisation paid us for the tool in the 12 months before the claim and £100. We are not liable for indirect or consequential loss, or for loss of profit, revenue, business or goodwill. These limits do not apply to liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or to any other liability that cannot be limited or excluded by law, and they do not affect any claim an individual may bring under data protection law or your statutory rights as a consumer.

9. Changes and law

We may update these terms; the version in force when you start an assessment applies to it. These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.