Walters Sentinel
Data protection impact and transfers
Last updated: 29 October 2026
If you use Walters Sentinel to handle personal data, you may need to carry out a data protection impact assessment (DPIA), and to check any transfers of that data outside the UK. This page gives you what you need from us for both. It goes with our Data Processing Agreement, which describes what each service holds and about whom, and our sub-processors list.
The processing, in short
- Our role: processor for the data you put into the services, acting on your instructions. You are the controller.
- Where it is held: application servers in London; the database in Ireland (EU); email sent from London.
- Who at Walters Sentinel can reach it: only our technical lead, for running the service and fixing problems, and only with two-step sign-in. Nobody else at the company has access.
- How long it is kept: while your account is open. When you delete data or close your account it is removed from the service, and from our encrypted backups within 30 days as they roll over.
Risks and how they are handled
| Risk to the people in your data | What we do about it |
|---|---|
| Someone gets into your account | Two-step sign-in on every password sign-in, which cannot be turned off; your own company sign-in, required for your domain if you choose; passkeys; sign-in rules limiting where and for how long people can be signed in; a tamper-evident audit log of what your people do. |
| Someone gets into our systems | Personal data is encrypted in the database with keys held apart from it, so a copy of the database alone cannot be read. Our servers allow no password sign-in. Enterprise customers can use their own key, in their own key vault, and withdraw it. |
| Data is lost or unavailable | Encrypted backups every night, each one restored and checked. See our business continuity summary. |
| Data is kept too long | You can export or delete it at any time, and close the account yourself. Backups roll over within 30 days. |
| A supplier misuses data | Each is bound by contract to process only on our instructions. You get 30 days' notice of any new one, and can object. |
| Data is used for something else | We never use your data for advertising, to train AI, or for any purpose of our own. We use no advertising or analytics suppliers. |
Transfers outside the UK
Only these suppliers may handle personal data outside the UK.
| Supplier | Where | What goes there | How the transfer is covered |
|---|---|---|---|
| Turso (database) | Ireland (EU) | All service data, encrypted as described above | UK adequacy regulations for the EEA |
| Stripe (payments) | Ireland (EU) and United States | The billing contact, payment details and invoices. Nothing from inside your services | UK adequacy regulations for the EEA; for the US, the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum |
| Resend (email standby) | Ireland (EU) and United States | Outgoing email, only while our main email provider is failing | As for Stripe |
| Microsoft, Titan Mail (our mailboxes), TextMagic (texts) | UK and EU | Messages you send to us; text message alerts and codes | UK adequacy regulations for the EEA |
| Groq (help guide) | United States | A question typed into the help guide, with email addresses and phone numbers removed. No account or service data. Can be switched off for your whole organisation | As for Stripe |
Our view of the transfer risk: the only data that reaches the United States is payment and billing data at Stripe, email during a failure of our main provider, and help-guide questions with contact details removed. None of it is the content of your services. We consider the risk to the people concerned low, and the safeguards above adequate.
What we will do for your assessment
- Answer your DPIA questions, or fill in your own template, in writing, free.
- Send the transfer paperwork for any supplier above.
- Tell you before anything on this page changes, as our sub-processor terms set out.
Write to contact@walterssentinel.com.
Contact
Walters Sentinel is operated by APW Consulting LTD, a company registered in the United Kingdom, number 06087068, trading as Walters Sentinel, registered office Hillier Hopkins Llp, Radius House First Floor, 51 Clarendon Road, Watford, WD17 1HP, VAT number GB902021393.
Registered in the United Kingdom, number 06087068. Registered office: Hillier Hopkins Llp, Radius House First Floor, 51 Clarendon Road, Watford, WD17 1HP. VAT number GB902021393. Registered with the Information Commissioner's Office, reference ZC277121.