Data Processing Agreement

This Data Processing Agreement (“DPA”) sets out the terms required by Article 28 of the UK GDPR. It forms part of the Terms of Service (/terms) and applies to all Customers.

The Customer is the controller of personal data in Customer Data. Adam Francis, trading as Kintex Software (sole trader, England) (“Kintex Software”, “we”) is the processor. Where this DPA and the Terms conflict on the processing of personal data, this DPA prevails.

Subject matter: hosting and processing of Customer Data in Kintex AIS. Duration: the term of the Customer’s use of the Service plus the deletion period in section 9. Nature: hosting, storage, retrieval, transmission and backup. Purpose: providing the Service.

Types of personal data:

• User name, email address and role
• Inspection records, notes, task assignees and certificate holder names
• Photos, which may show people
• Device push tokens
• Data subjects: the Customer’s users, staff and contractors, and people who appear in photos or records
• Special category data: not intended; the Customer should not enter it into the Service

We process personal data only on the Customer’s documented instructions. The Terms and the Customer’s configuration of the Service are those instructions. We will tell the Customer if an instruction appears to us to be unlawful.

Anyone we authorise to process personal data is bound by an obligation of confidentiality.

We implement the technical and organisational security measures listed in Annex 2 (security measures) below.

The Customer gives general written authorisation for us to use subprocessors. The current list is published at /subprocessors.

We give 30 days’ notice by email to each Organisation’s system administrators before adding or replacing a subprocessor. Customers may object to the change, and if we cannot resolve the objection they may terminate. We impose the same data protection obligations on each subprocessor as this DPA imposes on us, and we remain liable to the Customer for their performance.

Taking into account the nature of the processing, we assist the Customer in responding to data subject requests, and with its obligations under Articles 32 to 36 of the UK GDPR (security of processing, personal data breach notification, data protection impact assessments and prior consultation with the ICO).

We notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information available to us at the time, and provide further information as it becomes available.

On request made within 30 days of termination, we return Customer Data in a common machine-readable format (CSV or JSON). We then delete live Customer Data. Firestore backups expire within 14 weeks (point-in-time recovery 7 days; daily backups kept 7 days; weekly backups kept 14 weeks).

We make available the information reasonably needed to demonstrate compliance with this DPA. The Customer may carry out a reasonable audit on 30 days’ notice, no more than once in any 12 months, at the Customer’s cost unless the audit finds a breach of this DPA by us.

Processing locations are listed at /subprocessors (inspection photos: europe-west2 (London)). Where personal data is processed outside the UK, it is protected by Google’s data processing terms, which incorporate the UK International Data Transfer Addendum (IDTA/Addendum) to the EU Standard Contractual Clauses.

Liability under this DPA is subject to section 11 (Limitation of liability) of the Terms. This DPA is governed by the laws of England and Wales.

We maintain the following measures:

• TLS encryption in transit
• Google-managed encryption at rest
• Organisation-scoped access enforced server-side (Firestore and Storage security rules and callable function checks)
• Role-based permissions
• App Check on mobile and web
• Rate limiting on public endpoints
• Firestore delete protection, point-in-time recovery and scheduled backups
• Developer-only platform tools gated by a developer claim
• Signed release builds
• Production access limited to the sole trader
• 2-Step Verification (MFA) enforced on the Google admin accounts used to operate the Service