Data Processing Addendum

For the personal data your business enters about its clients and staff, you are the controller and we are the processor. This addendum forms part of the Public Offer and prevails over it on any conflict about processing.

We process client contact details, appointment and visit records, payment references, and staff records, for as long as your workspace exists plus the retention window in the Public Offer. Processing is limited to providing the service and to what you instruct through it.

Process only on your instructions; keep the data confidential and bind our staff to the same; apply the technical measures in section 5; assist you with data subject requests, impact assessments and regulator enquiries; and delete or return the data at the end of processing.

The current list is published as the Sub-processors document and forms part of this addendum. We give 30 days notice before adding one, and you may object on reasonable data protection grounds — if we cannot resolve the objection you may terminate and take a pro-rata refund.

Encryption in transit and at rest; integration credentials encrypted with a separate key and write-only once saved; three-layer tenant isolation ending in Postgres row-level security; role and record-scoped access; a full audit log; continuous backup with point-in-time restore; and support access only under a time-boxed grant you issue.

Processing takes place in the EEA. Where a sub-processor operates outside it, the transfer relies on Standard Contractual Clauses together with a transfer impact assessment, both available on request.

We notify you without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting your workspace, with what we know, what we are doing, and what we recommend you tell your clients.

On reasonable notice, once a year, you may review our security documentation and the results of our own testing. Where a regulator requires more, we will co-operate with a proportionate on-site audit at your cost.