Data processing agreement
Draft, not yet in force. This draft has not been reviewed by a solicitor and has no legal effect until it is published as final.
Items marked [TO CONFIRM] are open points for the owner to settle before this agreement is used.
1. Parties and purpose
This agreement forms part of the Terms of service between the Customer ("Controller") and Connor Brown trading as Delvair, of 21 Denton Road, Peterborough, PE2 8PD ("Processor"). It applies where Delvair processes personal data on the Customer's behalf under UK data protection law (the UK GDPR and the Data Protection Act 2018).
2. Details of the processing
| Item | Detail |
|---|---|
| Subject matter | Providing the Delvair platform |
| Duration | The term of the agreement, plus the 90 day return and deletion period |
| Nature and purpose | Storing, organising and displaying data so the Customer can create quotes, invoices, certificates, RAMS and O&M packs and run jobs with its engineers |
| Types of personal data | Names, contact details, addresses, job and site information, and user login details of the Customer's staff, customers and contacts |
| Data subjects | The Customer's staff and engineers, the Customer's clients and their contacts |
| Special category data | None is intended. The Customer should not enter it. |
3. Processor obligations
The Processor will:
- process personal data only on the Customer's documented instructions, which are the agreement and the Customer's use of the Service, unless the law requires otherwise (and will tell the Customer where it can);
- make sure everyone authorised to process the data is bound by confidentiality;
- keep appropriate technical and organisational security measures, described in section 5;
- help the Customer respond to requests from individuals exercising their rights, taking into account the nature of the processing;
- help the Customer with its security, breach notification, impact assessment and regulator consultation duties;
- tell the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting its data;
- at the Customer's choice, delete or return the personal data when the agreement ends. Unless asked sooner, the Processor deletes it within 90 days, except where the law requires it to be kept;
- give the Customer the information needed to show compliance, and allow reasonable audits on 30 days' notice, no more than once a year, at the Customer's cost and without disrupting the Service.
4. Controller obligations
The Customer confirms that it has a lawful basis for the personal data it puts into the Service, has given any notices required to individuals, and will not enter special category data.
5. Security measures
The measures include:
- encryption of data in transit and at rest through the hosting provider;
- access controls so users see only their own organisation's data;
- limited administrative access to production data;
- regular backups handled by the hosting provider;
- prompt application of security updates.
[TO CONFIRM: any further measures to list, such as two-factor authentication or audit logging]
6. Sub-processors
The Customer gives general authorisation for the sub-processors below. The Processor will give at least 30 days' notice of any addition or replacement, and the Customer may object on reasonable data protection grounds. The Processor remains responsible for its sub-processors and binds them by written terms with equivalent obligations.
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud / Firebase (Google LLC) | Hosting, database and platform infrastructure | London, United Kingdom (europe-west2) |
| [TO CONFIRM: email delivery provider] | Sending notifications and emails | [TO CONFIRM] |
7. International transfers
Primary data storage is in the United Kingdom. If personal data is transferred outside the UK, the Processor will make sure an appropriate safeguard applies, such as the UK adequacy regulations or the International Data Transfer Addendum.
8. Liability and law
Liability under this agreement is subject to the limits in the Terms of service. This agreement is governed by the law of England and Wales.