Data Processing Agreement
Last updated: [date]
This agreement forms part of the Terms of Service between you (the business using Zonespan, the “Controller”) and [Company legal name] (the “Processor”). It sets out the terms required by Article 28 of the UK GDPR for personal data we process for you. If it conflicts with the Terms on data protection, this agreement wins.
1. Roles and instructions
1.1 You are the controller of the personal data you and your users put into the Service (“Customer Personal Data”). We are your processor.
1.2 We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this agreement, and the way you and your users use the Service's features. If we are required by law to do anything else, we will tell you first unless the law forbids it.
1.3 We will tell you straight away if we think an instruction breaks data protection law.
1.4 The details of the processing (subject matter, duration, purpose, types of data and people) are in Schedule 1.
2. Our people
We make sure anyone at [Company legal name] who can access Customer Personal Data is bound to keep it confidential, and only accesses it when needed to provide or support the Service (for example, importing your records during setup, or when you ask for help).
3. Security
We take the technical and organisational measures in Schedule 2, as required by Article 32 of the UK GDPR, and keep them under review. We may improve them but will not make them less protective.
4. Sub-processors
4.1 You give general written authorisation for us to use the sub-processors listed in Schedule 3.
4.2 We will tell you at least 30 days before adding or replacing a sub-processor. You may object on reasonable data protection grounds; if we cannot resolve it, you may end the contract and receive a refund of any prepaid fees for the remaining period.
4.3 We put a written contract in place with each sub-processor giving the same level of protection as this agreement. We remain responsible to you for their work.
5. Helping you meet your obligations
5.1 Requests from individuals. The Service lets you find, correct, export and delete the records you hold. If we receive a request directly about Customer Personal Data, we pass it to you without delay and do not respond ourselves unless you tell us to.
5.2 Other help. Taking into account the information available to us, we help you with security, breach notification, data protection impact assessments and consultation with the ICO.
6. Personal data breaches
6.1 We tell you without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting Customer Personal Data.
6.2 We give you what we know at the time (what happened, the data and people likely to be affected, the likely consequences and what we are doing) and update you as we learn more, so you can meet your own 72-hour reporting duty to the ICO.
7. International transfers
We only transfer Customer Personal Data outside the UK where the protection is not materially lower than in the UK, as required by Chapter 5 of the UK GDPR (as amended by the Data (Use and Access) Act 2025). We rely on UK adequacy regulations or the ICO's International Data Transfer Agreement or Addendum, with a transfer risk assessment where needed. Schedule 3 shows where each sub-processor operates.
8. Records, information and audits
8.1 We give you the information reasonably needed to show we are meeting this agreement, including summaries of our security measures and our sub-processors' certifications.
8.2 If that is not enough, you (or an independent auditor bound by confidentiality) may audit our compliance once a year on 30 days' notice, during working hours, at your cost, and in a way that does not expose other customers' data. Extra audits are allowed after a breach or if the ICO requires one.
9. End of the contract
9.1 For 30 days after the contract ends you can download Customer Personal Data using Backup Everything, or ask us for a copy.
9.2 After that we delete Customer Personal Data from the live system, including stored files. Copies in encrypted backups are deleted as the backups expire, within [35] days, and are not used in the meantime.
9.3 We keep data longer only where the law requires it, and keep protecting it while we do.
10. Liability
Each of us is liable under this agreement as set out in the liability section of the Terms, except where the UK GDPR does not allow liability to be limited.
Schedule 1: Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing Zonespan, job management software for fire and security businesses |
| Duration | The length of the contract, plus up to 30 days to download data and [35] days for backups to expire |
| Nature and purpose | Storing, organising, displaying, sending and deleting records so the Controller can run its jobs, customers, paperwork, stock and staff admin; importing the Controller's existing records during setup |
| People the data is about | The Controller's customers and their site contacts; the Controller's engineers and office staff; quote prospects |
| Types of personal data | Names, job titles, phone numbers, email and postal addresses, site addresses; job notes, photos, signatures and certificates; engineers' timesheets, holiday requests, expenses and van stock; login and activity records |
| Special category data | None expected. The Controller should not enter health or other special category data unless needed and lawful |
Schedule 2: Security measures
| Area | Measures in place |
|---|---|
| Keeping companies apart | Every record is tied to one company. Database rules stop any user reading or changing another company's data, checked by automated tests before every release |
| Signing in | Individual logins; compulsory two-step login for office logins with an authenticator app, re-checked every 30 days and enforced by the database and server; office passwords reset only by us after a phone call-back; engineer phones locked with a PIN after first sign-in |
| Access within a company | Engineers see only their own jobs, van and records; only office logins manage customers, money and settings; only we can remove logins |
| Files | Stored privately per company; shared only through short-lived signed links |
| In transit and at rest | Encrypted connections (HTTPS) everywhere; data encrypted at rest by our hosting provider; phone notifications encrypted end to end |
| Records that must not change | Issued certificates and the stock history cannot be edited or deleted; changes to key records are written to an audit log |
| Secrets | Server keys kept only in the hosting provider's secret store, never in the apps |
| Backups | [backup frequency and how long they are kept] |
| Our staff | Access only when needed to provide setup or support; confidentiality obligations; our own control centre login needs two-step login |
Schedule 3: Authorised sub-processors
| Sub-processor | What they do | Location | Transfer safeguard |
|---|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | UK (London) | Not needed: stored in the UK |
| Resend | Sending emails for the Controller | United States | Resend's Data Processing Addendum with UK transfer terms |
| Cloudflare | Hosting the apps and protecting them from attacks | Global network | Cloudflare's Data Processing Addendum with UK transfer terms |
| Phone push services (Apple, Google, Mozilla, Microsoft) | Delivering encrypted job notifications to engineers' phones | Global | Message content encrypted so the service cannot read it |