Data Processing Agreement

This agreement forms part of the Terms of Service between [Legal entity name] ("Processor") and the customer ("Controller"). It sets out how the Processor processes personal data in Customer Data. It is intended to meet Article 28 of the UK GDPR.

1. Subject matter and duration

The Processor processes personal data to provide PAT Control for the duration of the Terms of Service, and afterwards for the period in clause 9.

2. Nature and purpose

Hosting, storage, display, export and transmission of Customer Data, as needed to provide the Service and its features (certificates, reminders, client portal, invoicing and accounting connections), and as instructed by the Controller through its use of the Service.

3. Types of personal data and data subjects

• Data subjects: the Controller's staff and users; the Controller's clients and their contacts; engineers named on test records.
• Personal data: names, business contact details (email, phone, address), user identifiers, signatures where recorded, and notes the Controller chooses to enter.
• Special category data is not required by the Service, and the Controller should not enter it.

4. Processor obligations

The Processor will:

1. process personal data only on the Controller's documented instructions (these terms and the Controller's use of the Service), unless the law requires otherwise, in which case it will tell the Controller first where the law allows;
2. make sure that people authorised to process the data are bound by confidentiality;
3. take the security measures in Annex 1;
4. follow clause 5 on sub-processors;
5. help the Controller, taking into account the nature of the processing, to respond to data subject requests (the Service includes export tools for this) and to meet its obligations on security, breach notification, impact assessments and consultation with the ICO;
6. delete or return personal data at the end of the service, as set out in clause 9;
7. make available the information needed to show compliance with this agreement, and allow audits as set out in clause 8.

5. Sub-processors

5.1 The Controller authorises the sub-processors listed in Annex 2.

5.2 The Processor will give at least 30 days' notice of any new sub-processor by email to the organisation's owners. The Controller may object on reasonable data-protection grounds. If the parties cannot resolve the objection, the Controller may terminate the affected service and receive a refund of prepaid fees for the remaining period.

5.3 The Processor will impose data-protection terms on each sub-processor that are equivalent to this agreement, and it remains responsible for them.

6. International transfers

Customer Data is hosted in the United Kingdom. Any transfer outside the UK by a sub-processor will be covered by UK adequacy regulations or by the International Data Transfer Agreement or Addendum.

7. Personal data breaches

The Processor will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will include the information the Controller needs to meet its own obligations to report the breach.

8. Audits

The Processor will answer reasonable written security questionnaires once a year. Where the law or a regulator requires it, or after a breach, the Controller may carry out an audit on 30 days' notice, during business hours, at its own cost, and under confidentiality.

9. Return and deletion

After the agreement ends, the Controller may export its data for 90 days. The Processor will then delete Customer Data, except where the law requires it to be kept. Data in backups is deleted as the backups expire, within 35 days.

Annex 1 — Security measures

• Hosting in UK data centres with ISO 27001-certified providers.
• Encryption in transit (TLS 1.2 or later) and at rest.
• Database row-level security that separates each organisation's data. The application connects with a role that cannot bypass it.
• Mandatory two-step verification for staff users, passkey support, and lockout after repeated failed sign-ins.
• An append-only audit log of changes to records.
• Encrypted credentials for connected services.
• Uploaded files parsed in isolated processes with resource limits.
• Daily encrypted backups with tested restores.
• Least-privilege access for Processor staff, with access logged.

Annex 2 — Sub-processors

Sub-processor	Purpose	Location
[Hosting provider — to be confirmed]	Application hosting, database, file storage	United Kingdom
[Email provider — to be confirmed]	Transactional email	United Kingdom / EEA
Stripe Payments Europe Ltd	Billing (billing contact data only)	EEA / United States (safeguards)
Xero, Intuit (QuickBooks), FreeAgent	Only if the Controller connects one	Per the provider