GDS Client Portal
These terms apply to the self-service plan of the GDS Client Portal, provided by GDS Analytics Limited. They form part of the contract when a customer signs an Order Form, together with the Data Processing Agreement below and our Security Statement. They are separate from the terms of use of this website.
Terms of Service
In these terms, “GDS” means GDS Analytics Limited and “Customer” means the organisation named in the Order Form. If these terms conflict with the Order Form, the Order Form takes priority, and the Data Processing Agreement takes priority over these terms on data protection.
Agreement means the Order Form, these Terms of Service, the Data Processing Agreement in Schedule 1 and the Security Statement.
Customer Data means data the Customer or its Users upload to, or create in, the Service.
Monitoring Results means the scores, ratings, findings and automated commentary the Service produces about a supplier’s domain or one of the Customer’s own domains.
Order Form means the order signed by the Customer and GDS that sets out the plan, term and fees.
Service means the self-service plan of the GDS Client Portal described in the Order Form.
Users means the individuals the Customer authorises to use the Service, up to the number in the Order Form.
GDS will provide the Service to the Customer for the term of the Order Form, with reasonable skill and care, and in line with the Security Statement.
The Service includes project plans, a DPIA register and library, supplier monitoring and a Record of Processing Activities, as described in the service description in force on the Start Date.
GDS may improve or change the Service, but will not materially reduce its overall functionality during a term.
Monitoring Results are produced automatically from publicly available information, including GDS scans and third-party sources such as Shodan. They are not reviewed by GDS staff and are labelled “Automated” in the Service.
Monitoring Results are a point-in-time indication of a supplier’s external security posture. They are not an audit, a certification or a guarantee of that supplier’s security, and may be incomplete or inaccurate.
Nothing in the Service is legal, data protection or security advice. The Customer remains the controller of its own processing and is responsible for its own decisions, including whether to use a supplier and whether a Data Protection Impact Assessment (DPIA) is adequate under Article 35 of the UK GDPR.
Review by GDS staff, data protection officer or CISO services, and DPIA drafting are available only under a separate written order and fees.
The Customer is responsible for its Users, for keeping their sign-in details secure and for the accuracy and lawfulness of the Customer Data.
Every User must sign in with an authenticator app. Accounts may not be shared.
The Customer will add only its own domains and the domains of suppliers or prospective suppliers it has a genuine business reason to assess, within the limits in the Order Form, and will not use the Service to target any other organisation.
The Customer will not attempt to gain unauthorised access to the Service, test its security without GDS’s written consent, resell it, or use it to break the law.
The Customer owns the Customer Data and grants GDS a licence to use it only to provide the Service.
GDS owns the Service, its software and its methods. Monitoring Results may be used by the Customer for its own internal purposes and shared with the supplier concerned, but not published or sold.
GDS may use aggregated, anonymised information about use of the Service to improve it.
Where GDS processes personal data on the Customer’s behalf, the Data Processing Agreement in Schedule 1 applies.
Each party will keep the other’s confidential information confidential and use it only to perform the Agreement. This does not apply to information that is public, already known to the recipient, or required to be disclosed by law.
GDS aims to make the Service available 99.5% of each calendar month, excluding planned maintenance notified at least 48 hours in advance. This is a target, not a service credit commitment.
Support is by email at admin@gdsanalytics.co.uk, between 09:00 and 17:00 UK time on working days, with a first response within one working day.
Nothing in the Agreement limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law.
Neither party is liable for loss of profits, revenue, business, goodwill or anticipated savings, or for any indirect or consequential loss.
Subject to clause 8.1, each party’s total liability in each contract year is limited to the fees paid and payable by the Customer in that year.
GDS is not liable for decisions the Customer makes on the strength of Monitoring Results.
GDS may suspend a User or the Service immediately where needed to protect the Service or other customers, and will tell the Customer why as soon as it reasonably can.
Either party may end the Agreement by written notice if the other commits a material breach that is not remedied within 30 days of being notified, or becomes insolvent.
On termination, the Customer may export its Customer Data for 30 days. GDS will then delete it within 90 days, except where the law requires GDS to keep it.
Termination by GDS for the Customer’s breach does not end the Customer’s liability for the fees for the rest of the term.
GDS may update these Terms of Service by giving at least 30 days’ notice by email. A change that materially disadvantages the Customer applies only from the Customer’s next renewal date.
Neither party is liable for delay caused by events beyond its reasonable control.
The Customer may not assign the Agreement without GDS’s consent. GDS may assign it to a successor to its business on notice.
The Agreement is the entire agreement between the parties about the Service. No one else has rights under the Contracts (Rights of Third Parties) Act 1999.
The Agreement and any dispute arising from it are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Schedule 1
GDS processes personal data in the portal as the Customer’s processor. This agreement gives the Customer the terms that Article 28(3) of the UK GDPR and the EU GDPR require. GDS is a separate controller for its own account, billing and marketing data, which its privacy policy covers.
The Customer is the controller and GDS is the processor of the personal data described in Annex A. Where the Customer is itself a processor, GDS is its sub-processor and the Customer confirms that it has its controller’s authority.
“Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and, where it applies to the Customer, Regulation (EU) 2016/679 (the EU GDPR), each as amended, including by the Data (Use and Access) Act 2025.
Instructions. GDS will process the personal data only on the Customer’s documented instructions, which are the Agreement and the Customer’s use of the Service, unless the law requires otherwise, in which case GDS will tell the Customer first unless the law forbids it. GDS will tell the Customer if it believes an instruction breaks Data Protection Law (Article 28(3)(a)).
Confidentiality. GDS will ensure that everyone it authorises to process the personal data is bound by confidentiality (Article 28(3)(b)).
Security. GDS will implement the technical and organisational measures in the Security Statement, which it considers appropriate under Article 32 (Article 28(3)(c)).
Sub-processors. The Customer gives general authorisation for GDS to use the sub-processors in Annex B. GDS will give at least 30 days’ notice by email of any new or replacement sub-processor. The Customer may object on reasonable data protection grounds within that period, and if the parties cannot resolve the objection the Customer may end the Agreement without penalty and receive a refund of any prepaid fees for the unused period. GDS will impose the same data protection obligations on each sub-processor and remains liable for them (Article 28(2) and 28(4)).
Data subject rights. GDS will assist the Customer, through the Service’s features and otherwise as reasonably requested, to respond to requests from individuals exercising their rights under Chapter III, and will pass on promptly any request it receives directly (Article 28(3)(e)).
Assistance. GDS will assist the Customer with its obligations under Articles 32 to 36 (security, breach notification, DPIAs and prior consultation), taking into account the nature of the processing and the information available to GDS (Article 28(3)(f)).
Personal data breaches. GDS will notify the Customer without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting the Customer’s personal data, with the information the Customer needs to meet Articles 33 and 34.
Deletion or return. At the end of the Agreement, GDS will make the personal data available for export for 30 days and then delete it within 90 days, including from backups on their normal cycle, unless the law requires GDS to keep it (Article 28(3)(g)).
Audit. GDS will make available the information necessary to demonstrate compliance with this agreement, including the current Security Statement, and will allow for and contribute to audits by the Customer or its auditor once a year on 30 days’ notice, at the Customer’s cost, or more often after a personal data breach or at a supervisory authority’s request (Article 28(3)(h)).
The Service is hosted in Ireland. Transfers between the United Kingdom and the European Economic Area rely on the UK’s adequacy regulations for EEA states and the European Commission’s adequacy decision for the United Kingdom, renewed on 19 December 2025 until 27 December 2031.
GDS will not transfer the personal data to any other country without an appropriate safeguard under Chapter V, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, and will tell the Customer which applies.
The Customer is responsible for having a lawful basis for the processing, for its instructions complying with Data Protection Law, and for not uploading special category or criminal offence data unless the Service’s purpose requires it.
| Item | Detail |
|---|---|
| Subject matter | Provision of the GDS Client Portal self-service plan |
| Duration | The term of the Agreement, plus the export and deletion periods in paragraph 2.8 |
| Nature and purpose | Hosting, storage, display and processing needed to provide project plans, a DPIA register, supplier monitoring and a Record of Processing Activities |
| Data subjects | The Customer’s Users; staff and contacts named in Customer Data; individuals described in the Customer’s records of processing or DPIAs |
| Personal data | Names, work email addresses and roles; sign-in and authenticator records; audit log entries including IP addresses; personal data the Customer enters in plans, DPIAs and records |
| Special category data | None intended. Any that the Customer enters is its responsibility under paragraph 4.1 |
| Sub-processor | Service | Location |
|---|---|---|
| Hosting Ireland (web hosting for gdsanalytics.co.uk) | Portal hosting, database and file storage | Ireland |
| Hosting Ireland (virtual private server, monitor.gdsanalytics.co.uk) | Virtual server running supplier scans (supplier domains only, no Customer personal data) | Ireland (Dublin) |
| Microsoft (Microsoft 365, Exchange Online) | Sign-in and notification emails | Ireland (Dublin) |
| Stripe (card payments and Bacs Direct Debit); Starling Bank (bank transfers) | Payments (GDS as controller, listed for transparency) | United Kingdom (Stripe also processes data in the United States) |
© 2026 GDS Analytics. All rights reserved.