Data Processing Agreement

This Data Processing Agreement (the DPA) forms part of the agreement between the business that uses SubClik (you, the Customer) and the provider of SubClik (we, us) under our Terms of Service. It sets out the terms required by Article 28 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (together, Data Protection Law).

1. Roles

1.1 You are the controller of the personal data you and your Users put into SubClik, or that your customers submit through it (the Customer Personal Data). We process it as your processor, only to provide the service.

1.2 Where we use account contact and billing details to manage our relationship with you, we do so as an independent controller under our Privacy Policy, not under this DPA.

2. Details of the processing

• Subject matter and purpose: providing the SubClik service: service jobs and engineer visits, customer sites and machines, meter readings, quotes, contracts, invoices, job sheets, internal chat, calendar and the related emails and customer pages.
• Nature of the processing: collection through the service, storage, organisation, retrieval, display, transmission by email at your request, export, backup and deletion.
• Duration: for as long as the agreement lasts, and afterwards only as set out in section 10.
• Categories of data subjects: your staff, engineers and freelancers; your customers’ contacts; people who sign job sheets, approve quotes, report faults through machine labels or send meter readings.
• Types of personal data: names, work email addresses and phone numbers, site addresses, job notes, chat messages, photos and files uploaded, signatures on job sheets, times, mileage and job activity recorded by engineers, and sign-in and security records.
• Special category data: none intended. SubClik is not designed for it; please do not put it into job notes, chat or files.

3. Your obligations

3.1 You are responsible for having a lawful basis for the processing, for giving the people concerned the information Data Protection Law requires (for example, telling engineers that working time, mileage and job activity are recorded), and for the accuracy of the Customer Personal Data.

3.2 Your instructions to us must comply with Data Protection Law. You are responsible for deciding which Users can see which data, using the roles the service provides.

4. Our obligations

4.1 Instructions. We process the Customer Personal Data only on your documented instructions, which are given by the agreement and by your use and configuration of the service, unless the law requires otherwise; in that case we will tell you before processing unless the law forbids it. We will tell you if we believe an instruction breaks Data Protection Law.

4.2 Confidentiality. Everyone we authorise to process the Customer Personal Data is bound by a duty of confidentiality.

4.3 Security. We use the technical and organisational measures described in Annex 1, which are designed to give a level of security appropriate to the risk. We may update them, provided the overall level of security is not reduced.

5. Sub-processors

5.1 You give us general authorisation to use sub-processors. The current sub-processors are listed in Annex 2.

5.2 We will tell you at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we cannot resolve the objection, you may end the agreement before the change takes effect and we will refund any Fees paid in advance for the period after it ends.

5.3 We impose data protection obligations on each sub-processor that are at least as protective as those in this DPA, and we remain responsible to you for their performance.

6. International transfers

The Customer Personal Data is stored in the United Kingdom. Some sub-processors are based in, or may access data from, other countries (see Annex 2). Where personal data is transferred outside the UK, we make sure it is protected by a safeguard recognised under Data Protection Law, such as a UK adequacy regulation (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified), the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses.

7. Helping you

7.1 Taking into account the nature of the processing, we will help you respond to requests from people exercising their rights. The service lets you find, correct and export records yourself; we will delete records on your instruction where you cannot do so in the service.

7.2 We will also give reasonable help with security, breach notifications, data protection impact assessments and consultations with the Information Commissioner, taking into account the information available to us. We may charge reasonable costs for help that goes beyond what the service already provides.

8. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer Personal Data. We will give you the information we have, update you as we learn more, and take reasonable steps to contain the breach and reduce its effects. Telling you about a breach is not an admission of fault.

9. Information and audits

9.1 We will make available the information reasonably needed to show that we meet this DPA, including by answering reasonable security questionnaires.

9.2 If that information is not enough to show compliance, or if a regulator requires it, you (or an independent auditor you appoint who is bound by confidentiality) may carry out an audit, including an inspection, once in any 12 months, with at least 30 days’ notice, during business hours and in a way that does not disrupt our business or put other customers’ data at risk. You bear your own costs of an audit.

10. At the end

When the agreement ends you can export your data for 30 days. After that period we delete the Customer Personal Data from the live service, unless the law requires us to keep it. Copies in backups are deleted as the backups expire in the normal backup cycle, and are kept secure and out of use until then.

11. Liability and order of precedence

11.1 Each party’s liability under or in connection with this DPA is subject to the limitations and exclusions in the Terms of Service, to the extent permitted by Data Protection Law.

11.2 If this DPA conflicts with the rest of the agreement on the processing of personal data, this DPA applies.

Annex 1: Security measures

• Encryption in transit (HTTPS) for all access to the service, and encryption at rest by our database and storage provider.
• Separation of each customer firm’s data enforced in the database (row-level security), so one firm cannot read another firm’s records.
• Role-based access within your account (owner, admin, dispatcher, engineer, client viewer). Engineers see only the jobs assigned to them and the conversations they belong to.
• Two-step sign-in for owners and administrators, on by default; also required for platform administrators.
• Passwords handled by the authentication service and never stored in readable form; rate limits on sign-in related actions, website forms and public customer pages.
• Files (photos, documents, signatures) kept in private storage and shown only through short-lived links to people allowed to see them.
• An audit log of changes to jobs, times, prices, invoices, payments and approvals, recording who made them.
• Error logs that leave out form contents, query strings, email addresses and tokens, kept for 90 days.
• Regular encrypted backups of the database, and a tested restore procedure.
• Access to production systems limited to the people who need it to run the service.

Annex 2: Sub-processors

• Supabase, Inc.: database, file storage, authentication and live updates. Data is stored in the London (United Kingdom) region.
• Vercel, Inc.: hosting of the application and website. Application servers run in London (United Kingdom); content may pass through its global network to reach users.
• Resend, Inc.: delivery of emails sent by the service, such as invitations, job sheets, invoices, quote links and meter reading requests. Based in the United States.
• GitHub, Inc.: secure storage of encrypted database backups. Based in the United States. (Applies once backups to GitHub are switched on.)

Contact

Questions about this DPA or about data protection: the contact address will be shown here.