Data processing agreement

1. Who this agreement is between

This agreement is between the business that uses Capstone ("you", the controller) and Tredgold Digital Ltd, company number 16955781, registered at Tredgold Avenue, Leeds, LS16 9BS ("we", the processor). It meets the requirements of Article 28 of the UK GDPR and forms part of your agreement to use Capstone.

Words such as personal data, processing, controller, processor, data subject and personal data breach have the meanings given in UK data protection law (the UK GDPR and the Data Protection Act 2018).

2. What we process for you

We process personal data only to provide Capstone to you. The details are in Annex 1. You decide what data you put into Capstone and why. You're responsible for having a lawful basis for it, and for telling your clients and team how their data is used.

3. Our commitments

1. Your instructions. We process the data only on your documented instructions. Using Capstone's features, and this agreement, are your instructions. If the law requires us to process it otherwise, we'll tell you first unless the law forbids that. We'll tell you if we think an instruction breaks data protection law.
2. Confidentiality. Everyone we authorise to process the data is bound by confidentiality.
3. Security. We keep the technical and organisational measures in Annex 2, and may improve them, but never reduce the overall level of protection.
4. Sub-processors. You give us general permission to use the sub-processors in Annex 3. We'll give you at least 30 days' notice of any new one, by email to the business owner. You can object on reasonable data protection grounds. If we can't resolve it, you can end your use of Capstone before the change takes effect. We impose the same data protection obligations on each sub-processor, and remain responsible to you for them.
5. Transfers outside the UK. Capstone is hosted in the European Union, which UK law recognises as giving adequate protection. We transfer data anywhere else outside the UK only with the safeguards UK law requires, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
6. Helping you with requests. Capstone lets you view, correct and delete your data, and we'll export it for you on request. Where you need more, we'll help you respond to data subjects exercising their rights. If a data subject contacts us directly, we'll pass the request to you.
7. Breaches. We'll tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data. We'll give you the information you need to meet your own duties, and help you deal with it.
8. Other help. We'll give you reasonable help with data protection impact assessments and with consulting the ICO, as far as they concern our processing.
9. At the end. When you stop using Capstone, we'll give you an export of your data if you ask. We'll then delete it within 90 days, and from backups as they expire, unless the law requires us to keep it.
10. Showing we comply. We'll make available the information you reasonably need to show we meet this agreement. We'll answer reasonable written questions, and allow an audit by you or an auditor you appoint, at your cost, with reasonable notice, no more than once a year unless the ICO requires it or there's been a breach.

4. Your commitments

You'll give us lawful instructions, have a lawful basis for the data you put into Capstone, tell your clients and team what you need to (including that you use Capstone), and keep your team's sign-in details safe.

5. Liability and changes

Each party's liability under this agreement is as set out in your agreement to use Capstone. If we need to change this agreement, for example to reflect a change in the law, we'll give you notice and update the version date above.

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption in transit (TLS) for the website, the crew app and the database connection, and at rest for the database, file storage and backups.
• Every business's data is kept separate in the application, with automated tests for this separation.
• Role-based access within each business (owner, office, crew lead, crew). Passwords stored as secure hashes. Rate limits on sign-in.
• Photos and files are private and served only to people allowed to see them. Client portal links can be revoked and expire.
• Hosted in the European Union (AWS Stockholm, Sweden) on private infrastructure. The database isn't reachable from the internet. No long-lived cloud access keys.
• Daily database backups, kept for 7 days. Server logs leave out email addresses, sign-in links and portal links.
• Location is recorded only at clock in, clock out and when a photo is taken, never tracked in the background.
• Staff access to customer data is limited to what's needed to run and support the service.

Annex 3: Sub-processors