Data Processing Agreement

Parties: FD Check Ltd · English and Welsh registered company number 14646975 · registered office 63-65 Heworth Road, York, YO31 0AA · VAT registered: VAT number GB 491 2658 70 (registration number 491 2658 70) (FD Check), and [Customer legal name], [Customer company / registration number], [Customer registered office] and [Customer contact] (Customer).

[REVIEW: rebuilt section — confirm against latest source document]

1 Background and application

This Data Processing Agreement (DPA) applies where FD Check processes Personal Data for the Customer in providing the Services. It is intended to satisfy Article 28 of the UK GDPR.

The Customer is the Controller and FD Check is the Processor for Customer Personal Data. FD Check may use authorised Sub-processors as described below. This DPA forms part of the Terms of Service. If there is a conflict on data protection matters, this DPA prevails.

2 Definitions

• Applicable Data Protection Law means the UK GDPR, Data Protection Act 2018, PECR and other applicable UK data protection law.
• Controller means the person who determines the purposes and means of Processing.
• Customer Personal Data means Personal Data Processed by FD Check on the Customer's documented instructions.
• Data Protection Officer means the person appointed as data protection officer, if any.
• Data Subject means an identified or identifiable individual.
• Data Subject Request means a request or complaint from a Data Subject exercising a legal right.
• DPA means this Data Processing Agreement and its Annexes.
• Personal Data has the meaning in Applicable Data Protection Law.
• Personal Data Breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
• Processing has the meaning in Applicable Data Protection Law.
• Restricted Transfer means a transfer of Personal Data that is restricted by Applicable Data Protection Law.
• Services means the FD Check Platform and related services under the contract.
• Sub-processor means a processor appointed by FD Check to process Customer Personal Data.
• Supervisory Authority means the ICO or another competent data protection authority.
• UK GDPR means the UK General Data Protection Regulation as supplemented by UK law.

3 Subject matter, nature, purpose and duration of Processing

FD Check will process Customer Personal Data to provide, secure, support and improve the Services, including user administration, inspection records, photographs, reports, scheduling, portals, maintenance records, approvals, exports, support, backups and requested AI-assisted report imports. The nature, purpose, categories and duration are detailed in Annex 1.

FD Check shall not sell Customer Personal Data, use it for advertising, combine it across customers to identify individuals, or use it to train AI or machine-learning models without the Customer's documented instructions and a lawful basis.

Processing begins when the Services start and continues until the contract ends, subject to the export, return and deletion requirements in this DPA.

4 Categories of Data Subjects

Data Subjects may include the Customer's employees, engineers, contractors, inspectors, administrators, tenants, residents, clients, visitors, building occupants, portal users, approvers and other people incidentally captured in photographs or records.

5 Types of Personal Data

Personal Data may include names, contact details, roles, account and login information, permissions, building and door identifiers, inspection findings, photographs, signatures and approval history, GPS and device data, support messages, audit logs and uploaded report content.

Special Category Data and criminal offence data are not intentionally required. If either is inadvertently captured, the Customer must notify FD Check, avoid further unnecessary disclosure and provide documented instructions. FD Check will apply appropriate safeguards and process it only as required to provide the Services or comply with law.

6 Customer obligations

The Customer must have a lawful basis for Processing, provide fair processing information, respect Data Subject rights, give lawful documented instructions, limit data to what is necessary, configure permissions appropriately and ensure its Personal Data and instructions do not infringe law or another person's rights.

The Customer is responsible for deciding whether to collect GPS data, photographs, signatures or other information, informing its engineers, contractors and other people, and carrying out any required Data Protection Impact Assessment.

7 FD Check obligations

FD Check shall:

• process Customer Personal Data only on documented instructions, including those in the contract and this DPA, unless required by law;
• ensure people authorised to process it are bound by confidentiality;
• implement measures appropriate to the risk under Article 32, as described in Annex 2;
• assist the Customer with Data Subject Requests and Articles 32 to 36, taking account of the nature of Processing;
• notify the Customer of a Personal Data Breach without undue delay and, where practicable, within 48 hours of becoming aware;
• maintain records and provide information reasonably needed to demonstrate compliance;
• use only authorised Sub-processors and remain responsible for their performance;
• return or delete Customer Personal Data at the end of the Services as instructed, subject to legal retention and backups.

Data protection contact: alex@fdcheck.com, [FD Check DPO details if applicable]. Security contact: [Security contact email].

8 Assistance with Data Subject Requests

FD Check will, taking account of the nature of Processing, provide reasonable technical and organisational assistance for access, rectification, erasure, restriction, objection, portability and other Data Subject Requests. The Customer must not ask FD Check to disclose data directly to a Data Subject unless agreed or required by law; the Customer remains responsible for responding.

9 Personal Data Breach

FD Check's notice will include, where available: the nature of the breach; categories and approximate numbers of Data Subjects and records affected; likely consequences; measures taken or proposed; and a contact point. FD Check may provide information in stages where all details are not immediately available.

The parties will cooperate to investigate, contain, remediate and document the breach. The Customer decides whether to notify a Supervisory Authority or Data Subjects unless FD Check is required to notify by law. Neither party will make public statements about the other without consultation unless legally required.

10 Confidentiality and personnel

FD Check will ensure that personnel with access to Customer Personal Data are trustworthy, trained and bound by confidentiality duties that continue after their role ends. Access will be limited to what is necessary to provide the Services and support.

11 Sub-processors

The Customer gives general authorisation for the Sub-processors listed in Annex 3. FD Check will keep an up-to-date list and give at least 30 days' notice of a proposed change where practicable. The Customer may object on reasonable data protection grounds within that period.

The current Sub-processor list is available at [Sub-processor list URL].

The parties will work in good faith to resolve an objection. If no reasonable solution is available, the Customer may terminate the affected Services without penalty after [Objection resolution period]. FD Check will impose written obligations on Sub-processors providing an equivalent level of protection and remains responsible for them.

12 International transfers

FD Check shall not make a Restricted Transfer without the Customer's documented instruction and a lawful mechanism. Mechanisms may include adequacy, the UK IDTA, the UK Addendum to the EU SCCs, SCCs with UK safeguards, BCRs or another valid mechanism.

Where required, FD Check will carry out and document a transfer risk assessment and apply supplementary measures. The arrangements and instruments are set out in Annex 4.

13 Security and technical and organisational measures

FD Check will maintain technical and organisational measures appropriate to the risk, including governance, access control, encryption and pseudonymisation where appropriate, secure application and infrastructure practices, logging, device controls, personnel security, availability, resilience, backup, testing, secure disposal and incident response. The current measure set is in Annex 2 and may be updated to reflect improvements without reducing protection.

14 Data Protection Impact Assessments and regulatory assistance

FD Check will provide reasonable information and assistance for Data Protection Impact Assessments, prior consultations and responses to Supervisory Authorities, taking account of the nature of Processing and information available. The Customer is responsible for completing its own assessment and decisions.

15 Compliance information, audits and inspections

FD Check will make available information reasonably needed to demonstrate compliance. The Customer may audit once in any 12-month period, after a Personal Data Breach, where it reasonably believes there is material non-compliance, or where required by a Supervisory Authority.

Audits require [Audit notice period] notice, occur during normal business hours, avoid disruption and protect confidential information. The scope, auditor qualifications, security requirements and cost allocation are [Audit scope and cost provisions]. The Customer will first consider available reports and certifications before an on-site inspection.

16 Return, export and deletion of Customer Personal Data

On termination, the Customer may request an export within [Export window]. FD Check will delete Customer Personal Data from active systems within [Active deletion period], unless law requires retention.

Backups will be isolated from ordinary use and rotated or overwritten within [Backup deletion period]. On request, FD Check will provide written certification of deletion, subject to legally required retention and technical limitations disclosed to the Customer.

17 Fees and assistance costs

Routine processing assistance is included in the Subscription unless the order states otherwise. FD Check may charge reasonable costs for unusually extensive requests, audits, exports or assistance at the rate of [Assistance rate], provided it gives an estimate and the law permits recovery.

18 Liability and indemnities

Liability and indemnities are governed by the Terms of Service and any order. Nothing limits liability that cannot lawfully be limited. The parties will consider each party's role, fault, instructions and contribution when allocating losses arising from data protection failure. Any specific allocation or cap is [DPA liability and indemnity terms].

19 Termination and suspension

This DPA begins when Processing begins and ends when FD Check no longer Processes Customer Personal Data. FD Check may suspend Processing on a lawful instruction where necessary to address a security or legal risk and will notify the Customer where permitted. Termination of the Services does not remove obligations that must continue for retained data.

20 Governing law and jurisdiction

This DPA is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction, subject to mandatory legal rights.

Annex 1 Details of Processing

Annex 2 Technical and Organisational Measures

• Governance and accountability: policies, assigned responsibilities, risk assessment, supplier review and data protection training.
• Access control: unique accounts, role-based access, least privilege, authentication, access reviews and prompt leaver removal.
• Encryption and pseudonymisation: encryption in transit and at rest where appropriate, key management and pseudonymisation where proportionate.
• Application and infrastructure security: secure development, dependency management, vulnerability handling, network protections, segregation and change control.
• Logging and audit trails: security and access logs, event monitoring, approval history and protection against unauthorised alteration.
• Field devices and offline data: device controls, screen locks, secure storage, remote management where available, minimised offline data and synchronisation conflict handling.
• Personnel security: confidentiality, onboarding, training, background checks where lawful and access removal.
• Availability, resilience and backup: tested backups, recovery procedures, redundancy and continuity planning.
• Testing and assurance: security testing, remediation tracking, reviews and [Assurance report or certification].
• Secure disposal: deletion from active systems, secure device disposal, backup rotation and deletion records.
• Incident response: detection, escalation, containment, investigation, recovery, evidence preservation and notification.

Annex 3 Approved Sub-processors

Annex 4 Standard Contractual Clauses and International Transfers

Any transfer arrangements will be documented before a Restricted Transfer starts. The parties will use an applicable adequacy decision, UK IDTA, UK Addendum to the EU SCCs, SCCs with UK safeguards, BCRs or another lawful instrument, and will complete a transfer risk assessment where required.

The relevant instrument has priority for the transfer it covers. If transfer law changes, the parties will cooperate to update the mechanism, safeguards and Annex 4. [Transfer law change process]

Signature block

Template status: this document is pending review by a qualified solicitor and is not yet final.