Data Processing Agreement

1. About this agreement

1.1 This Data Processing Agreement (the "DPA") sets out the terms on which CERTSYNC LIMITED ("CertSync") processes Personal Data on behalf of the Customer (each as defined at clause 2) in connection with the Service.

1.2 This DPA is made under Article 28 of the United Kingdom General Data Protection Regulation (the "UK GDPR") and the Data Protection Act 2018 (the "DPA 2018"). It records the matters required by Article 28(3) UK GDPR and is in writing, in electronic form, as Article 28(9) UK GDPR requires.

1.3 This DPA forms part of the Subscription Agreement between CertSync and the Customer. As clause 1.4 of the CertSync Terms of Service sets out, the Subscription Agreement is made up of: (a) the Terms of Service; (b) the Acceptable Use Policy; (c) this DPA; (d) the Privacy Notice; (e) the Sub-processor List (Schedule 1); (f) the Cookie Policy; (g) the prices and plan terms published at /pricing; and (h) the plan the Customer chooses at sign-up.

1.4 This DPA applies to the processing of Customer Personal Data. It does not govern Service Personal Data, for which CertSync is controller; that is covered by the Privacy Notice at /privacy.

1.5 If this DPA and the Subscription Agreement conflict on a matter of data protection, this DPA prevails to the extent of the conflict, as set out at clause 16.

2. Definitions

2.1 In this DPA the following terms apply. Where a term is also defined in the Privacy Notice at /privacy, the definition in this DPA controls for the purposes of this DPA.

2.1.1 "Active Subscription" means a CertSync account with a paid subscription that has not been cancelled or expired.

2.1.2 "Customer" means the legal person that has entered into the Subscription Agreement with CertSync.

2.1.3 "Customer Personal Data" means Personal Data that the Customer (as controller) provides to CertSync, or that CertSync processes on the Customer's behalf, in connection with the Service. It includes Certificate Content, certificate-delivery records created on the Customer's instruction, certificate verification records, and the customer, site, installation and contractor details the Service saves so that the Customer's users can pre-fill later certificates ("Cross-Certificate Memory").

2.1.4 "Data Protection Laws" means the UK GDPR, the DPA 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), each as amended from time to time (including by the Data (Use and Access) Act 2025), and any other law that applies to the processing of Personal Data in the United Kingdom.

2.1.5 "Personal Data" has the meaning given in Article 4(1) UK GDPR.

2.1.6 "Personal Data Breach" has the meaning given in Article 4(12) UK GDPR.

2.1.7 "Read-Only Grace Period" means the 90-day period that begins on the day after the Customer's billing cycle ends following cancellation, during which the Customer keeps read-only access to its account data and may reactivate the account at any time.

2.1.8 "Schedule 1" means the Sub-processor list published at /sub-processors, which is incorporated into this DPA by reference.

2.1.9 "Service" means the CertSync software-as-a-service platform, the CertSync website, and the related products and integrations CertSync operates, as described in the Subscription Agreement.

2.1.10 "Service Personal Data" means Personal Data for which CertSync is controller in operating the Service, including Account Data, Audit and Security Data, Payment Metadata, and Cookie, Analytics and Attribution Data, as those categories are described in the Privacy Notice.

2.1.11 "Sub-processor" means a person CertSync engages to process Customer Personal Data on CertSync's behalf, as contemplated by Article 28(2) UK GDPR.

2.1.12 "Subscription Agreement" has the meaning given at clause 1.3.

2.1.13 "Supervisory Authority" means the Information Commission (known as the "ICO"), or any other competent supervisory authority under Data Protection Laws.

2.2 Terms used but not defined in this DPA have the meaning given to them in the UK GDPR or the Subscription Agreement.

3. Subject matter, duration, nature and purpose of processing

3.1 Subject matter. The subject matter of the processing is Customer Personal Data that CertSync processes on the Customer's behalf to provide the Service.

3.2 Duration. Processing under this DPA continues for the duration of the Customer's Active Subscription and during the Read-Only Grace Period. On the day after the Read-Only Grace Period ends (day 91) it ends, except that copies remaining in CertSync's encrypted backups expire as set out at clause 11.2.3.

3.3 Nature of the processing. The processing operations are those described in Schedule 2 paragraph 3, including the storage, organisation, retrieval, transmission, generation, adaptation and deletion of Customer Personal Data, and the production of certificate documents in PDF form for delivery to the Customer's clients.

3.4 Purpose of the processing. The purpose of the processing is to provide the Service to the Customer under the Subscription Agreement, so that the Customer can prepare, sign, store, search, retrieve, deliver and export electrical and related certificates and records, and so that the Customer's users can re-use details they have previously entered to pre-fill later certificates (Cross-Certificate Memory).

3.5 AI accuracy records. Where the Service offers an Authorised User the option, on an individual AI board scan review, to share what the scan got wrong, and the Authorised User elects to do so on that review, CertSync may retain, as an independent controller and for the sole purpose of measuring and improving the accuracy of its AI-assisted features, the fixed-list options suggested and recorded for the fields of that review. CertSync retains no free text, photograph or address under this clause, deletes those records with the Authorised User and with the Customer's account, and uses them only in aggregate. That processing is described in the Privacy Notice at clauses 5.9 and 7.6.

4. Types of Personal Data and categories of data subjects

4.1 The types of Customer Personal Data and the categories of data subjects are set out in Schedule 2.

4.2 In summary, the data subjects are: (a) the Customer's clients, including homeowners, tenants, occupiers, landlords and managing agents whose installations the Customer is certifying; (b) the individual users within the Customer's organisation; and (c) the Customer where the Customer is a sole trader or a named individual user.

5. Customer obligations as controller

5.1 The Customer is the controller of Customer Personal Data within the meaning of Article 4(7) UK GDPR and is responsible for complying with its obligations as controller under Data Protection Laws.

5.2 The Customer warrants and undertakes that:

5.2.1 it has a lawful basis under Article 6 UK GDPR (and, where applicable, Article 9 UK GDPR) for the processing it instructs CertSync to carry out;

5.2.2 it has given any notice, and obtained any consent, required under Articles 7, 13 and 14 UK GDPR to the data subjects whose Personal Data appears in Customer Personal Data;

5.2.3 the instructions it gives CertSync (including by configuring the Service, entering data into it, and contacting support) comply with Data Protection Laws and the Subscription Agreement;

5.2.4 it keeps its own records of processing under Article 30(1) UK GDPR where Article 30(5) does not exempt it; and

5.2.5 it responds to data-subject requests about Customer Personal Data in accordance with Articles 12 to 22D UK GDPR.

5.3 Where CertSync assists under clause 6.5 or 6.6, the Customer remains the controller and remains responsible for the lawfulness of its response to a data subject and for any decision it takes on the basis of CertSync's assistance.

6. CertSync obligations as processor

6.1 Article 28(3)(a) — documented instructions. CertSync shall process Customer Personal Data only on documented instructions from the Customer, including with regard to transfers of Customer Personal Data to a third country, unless required to do so by United Kingdom law to which CertSync is subject. In that case CertSync shall inform the Customer of the legal requirement before processing, unless the law prohibits this on important grounds of public interest. The Customer's documented instructions are: (a) the Subscription Agreement; (b) the Customer's configuration and use of the Service, through its user interface and application programming interfaces; (c) any addendum the parties agree in writing; and (d) any further written instruction the Customer sends to privacy@certsync.co.uk. If CertSync considers that an instruction infringes Data Protection Laws, it shall inform the Customer immediately.

6.2 Article 28(3)(b) — confidentiality. CertSync shall ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. CertSync shall: (a) limit access to Customer Personal Data to personnel who need it to perform CertSync's obligations under this DPA and the Subscription Agreement; (b) tell those personnel that Customer Personal Data is confidential and what their obligations are; and (c) ensure the obligation of confidentiality continues after their employment or engagement ends.

6.3 Article 28(3)(c) — security. CertSync shall take all measures required under Article 32 UK GDPR. The technical and organisational measures it applies are described in Schedule 3. CertSync shall keep them under review having regard to the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, and the risks to the rights and freedoms of natural persons. CertSync may update the measures provided the overall level of security is not materially reduced.

6.4 Article 28(3)(d) — Sub-processors. The Customer authorises CertSync to engage Sub-processors on the terms of this clause 6.4 and clause 7.

6.4.1 General authorisation. The Customer gives general written authorisation, under Article 28(2) UK GDPR, for CertSync to engage as Sub-processors the persons listed in Schedule 1 from time to time.

6.4.2 Equivalent obligations. Where CertSync engages a Sub-processor to carry out specific processing on behalf of the Customer, CertSync shall impose on it by contract data protection obligations no less protective than those in this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of the UK GDPR (Article 28(4) UK GDPR).

6.4.3 Liability for Sub-processors. CertSync remains fully liable to the Customer for the performance of each Sub-processor's obligations (Article 28(4) UK GDPR).

6.4.4 Changes. CertSync shall notify the Customer of any intended addition or replacement of a Sub-processor, and the Customer may object, in accordance with clause 7.

6.5 Article 28(3)(e) — data-subject rights. Taking into account the nature of the processing, CertSync shall assist the Customer by appropriate technical and organisational measures, insofar as this is possible, to respond to requests from data subjects exercising their rights under Articles 15 to 22D UK GDPR. That assistance comprises:

6.5.1 tools within the Service that let the Customer find, export, correct, restrict and delete Customer Personal Data itself, supporting requests under Article 15 (access), Article 16 (rectification), Article 17 (erasure), Article 18 (restriction) and Article 20 (portability);

6.5.2 the exports described at clause 11.1.2, available during an Active Subscription and the Read-Only Grace Period;

6.5.3 a written response, within fifteen (15) calendar days, to a request for assistance sent to privacy@certsync.co.uk that the tools cannot meet; and

6.5.4 reasonable efforts to prioritise a request where the Customer tells CertSync of a deadline it faces (for example, the one-month period under Article 12(3) UK GDPR).

6.6 Article 28(3)(f) — assistance with controller obligations. Taking into account the nature of the processing and the information available to it, CertSync shall assist the Customer to comply with Articles 32 to 36 UK GDPR. In particular, CertSync shall:

6.6.1 provide reasonable information about its technical and organisational measures, including answering standard security questionnaires within thirty (30) calendar days;

6.6.2 notify the Customer of a Personal Data Breach affecting Customer Personal Data in accordance with clause 8;

6.6.3 provide reasonable information for a Data Protection Impact Assessment under Article 35 UK GDPR, in accordance with clause 9; and

6.6.4 cooperate with the Customer in any prior consultation with the ICO under Article 36 UK GDPR.

6.7 Article 28(3)(g) — return or deletion at the end of the Service. At the choice of the Customer, CertSync shall return or delete all Customer Personal Data after the end of the provision of the Service, and shall delete existing copies, unless United Kingdom law requires storage of the Customer Personal Data. Clause 11 sets out how this works. The exports the Customer downloads are its own permanent record: CertSync is not the system of record for Customer Personal Data; the Customer is.

Any obligation to keep certificate records for a fixed period (for example under competent-person scheme conditions or for the Customer's own legal or insurance purposes) rests on the Customer as controller of Certificate Content. CertSync, as processor, returns or deletes Customer Personal Data on the Customer's instructions under this clause 6.7. The records described at clause 11.3 are Service Personal Data for which CertSync is itself controller; they are not Customer Personal Data kept on the Customer's behalf.

6.8 Article 28(3)(h) — information and audits. CertSync shall make available to the Customer all information necessary to demonstrate compliance with Article 28 UK GDPR and shall allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer, in accordance with clause 12.

7. Sub-processors detail

7.1 Schedule 1 is incorporated by reference. The current Sub-processor list, with each Sub-processor's legal entity, country of processing, categories of Personal Data, UK transfer mechanism, and the status of its data processing agreement, is published at /sub-processors and is updated as Sub-processors change.

7.2 Notice of change. CertSync will disclose any addition or replacement of a Sub-processor by updating Schedule 1 and its Last Updated date. Where CertSync reasonably considers a change material (for example, a new Sub-processor gaining access to Customer Personal Data, or a change to a Sub-processor's country of processing or transfer mechanism), CertSync will also email the Customer's billing contact before, or as soon as reasonably practicable after, the change takes effect.

7.3 Customer's right to object. The Customer may object to a Sub-processor change by writing to privacy@certsync.co.uk, in good faith and on reasonable data-protection grounds, within a reasonable time of the change being published or notified. If the Customer objects:

7.3.1 CertSync may withdraw the change;

7.3.2 the parties shall use reasonable efforts to agree an acceptable alternative; and

7.3.3 if they cannot agree one within fifteen (15) calendar days of CertSync's response to the objection, the Customer may terminate the Subscription Agreement on written notice without penalty, and the Read-Only Grace Period then starts from termination on the terms of clause 11.

7.4 Emergency changes. CertSync may add or replace a Sub-processor without advance notice where needed to deal with an active security incident, to comply with a legal obligation, or because an existing Sub-processor has suddenly stopped providing its service. CertSync will update Schedule 1 and notify the Customer as soon as reasonably practicable afterwards, and the Customer's right to object under clause 7.3 applies.

7.5 Partner arrangements. Some Sub-processors are bought through a partner rather than directly (for example, the data store used for rate limiting and sign-in sessions is provided through the Vercel Marketplace, under that provider's own data processing addendum). Schedule 1 records the arrangement, transfer mechanism and data processing agreement for each.

8. Personal Data Breach notification

8.1 CertSync shall notify the Customer of a Personal Data Breach affecting Customer Personal Data without undue delay and in any event within seventy-two (72) hours of becoming aware of it.

8.2 The notification shall include, so far as the information is available to CertSync at the time, the matters required by Article 33(3) UK GDPR:

8.2.1 the nature of the breach, including where possible the categories and approximate number of data subjects and of Personal Data records concerned;

8.2.2 the name and contact details of CertSync's data-protection contact;

8.2.3 the likely consequences of the breach; and

8.2.4 the measures taken or proposed by CertSync to address the breach, including, where appropriate, measures to reduce its possible adverse effects.

8.3 Where it is not possible to provide all of that information at once, it may be provided in phases without further undue delay.

8.4 The Customer remains responsible, as controller, for: (a) notifying the ICO within seventy-two (72) hours of becoming aware of the breach, where it is likely to result in a risk to the rights and freedoms of natural persons (Article 33(1) UK GDPR); and (b) telling affected data subjects without undue delay where it is likely to result in a high risk to them (Article 34(1) UK GDPR). CertSync shall give the Customer reasonable assistance with both.

8.5 CertSync gives notice under this clause 8 by email to the billing contact on file, copied to any data-protection contact the Customer has notified to privacy@certsync.co.uk.

9. DPIA assistance

9.1 Where the Customer must carry out a Data Protection Impact Assessment under Article 35 UK GDPR for processing CertSync performs as processor, CertSync shall provide reasonable assistance, taking into account the nature of the processing and the information available to it.

9.2 That assistance includes information about the Service's processing operations, the security measures CertSync applies, and the locations and transfer mechanisms of Sub-processors, and answers to the Customer's specific questions about its assessment.

9.3 Where the Customer must consult the ICO under Article 36 UK GDPR before processing, CertSync shall cooperate with the Customer in that consultation.

10. International transfers

10.1 Where Customer Personal Data is transferred outside the United Kingdom, the transfer complies with Chapter V of the UK GDPR, as amended by the Data (Use and Access) Act 2025, and the safeguard used is recorded against the relevant Sub-processor in Schedule 1. The mechanisms and safeguards relied on are:

10.1.1 transfers approved by regulations under Article 45A UK GDPR ("adequacy"), including transfers to the European Economic Area, which are treated as approved under paragraphs 4 and 5 of Schedule 21 to the DPA 2018;

10.1.2 the United Kingdom extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge"), in force from 12 October 2023, where the recipient is certified;

10.1.3 the International Data Transfer Agreement (the "IDTA") issued under section 119A of the DPA 2018 and in force from 21 March 2022;

10.1.4 the International Data Transfer Addendum to the EU Standard Contractual Clauses (the "UK Addendum") issued under section 119A of the DPA 2018 and in force from 21 March 2022; and

10.1.5 where CertSync relies on clause 10.1.3 or 10.1.4, a transfer risk assessment, consistent with ICO guidance, that the data protection test in Article 46 UK GDPR is met, with supplementary technical and organisational measures where that assessment requires them.

10.2 On the Customer's reasonable request, CertSync will provide a copy of the safeguard relied on for transfers to a particular Sub-processor.

10.3 The primary CertSync database (MongoDB Atlas, London region) holds Customer Personal Data in the United Kingdom. Where a Sub-processor processes Customer Personal Data outside the United Kingdom, clause 10.1 applies to that Sub-processor.

10.4 AI processor. Where the Customer invokes an AI-assisted feature, the Customer Personal Data selected for that invocation is processed by Google Cloud EMEA Limited (Ireland), through Google Cloud Vertex AI, as recorded in Schedule 1. CertSync sends those requests only to Google's European Union endpoint (the Vertex AI “eu” multi-region). Google states that processing on that endpoint stays in the European Union for the models it lists; for the Claude model, CertSync is awaiting Google's written confirmation that processing stays in the European Union. CertSync relies on clause 10.1.1 (adequacy in respect of the European Economic Area) for that transfer. Google Cloud EMEA Limited processes the data under the Google Cloud Data Processing Addendum, which governs any onward transfer by Google to its own sub-processors, and Google's terms for that service state that it does not use customer data to train or fine-tune any artificial-intelligence or machine-learning model without the customer's prior permission or instruction. CertSync has given no such permission or instruction.

11. Return or deletion — full 90-day workflow

11.1 During the Read-Only Grace Period.

11.1.1 The Read-Only Grace Period begins on the day after the end of the Customer's cancelled billing cycle and lasts ninety (90) calendar days.

11.1.2 During the Read-Only Grace Period, and at any time during an Active Subscription, the Customer may download, free of charge: (a) a data export, as a ZIP archive containing a structured, machine-readable JSON record of all Customer Personal Data the Customer has entered into the Service, with a JSON file for each certificate; (b) a certificate export, as a ZIP archive of PDF copies of the certificates the Customer selects, with photographs and other attachments appended to each certificate PDF; and (c) a certificate list in CSV format. These are three separate downloads.

11.1.3 The Customer may reactivate the subscription at any point during the Read-Only Grace Period. Reactivation restores full access and stops deletion.

11.1.4 CertSync emails deletion warnings to the address on file before the scheduled day-91 deletion, as clause 3 of the Data Retention Policy at /data-retention sets out.

11.2 Day 91 deletion. On the day after the Read-Only Grace Period ends (day 91):

11.2.1 CertSync deletes all Customer Personal Data in its primary systems;

11.2.2 CertSync instructs each Sub-processor to delete the Customer Personal Data CertSync has placed with it on the Customer's behalf, in accordance with the relevant Sub-processor agreement; and

11.2.3 copies of that data remaining in CertSync's encrypted backups are not used for any purpose and are deleted as those backups expire on their rotation schedule, which is set out in clause 7 of the Data Retention Policy at /data-retention and ends no later than 190 days after the day-91 deletion. If CertSync ever restores a backup, it deletes that data from the restored copy again.

11.3 Records CertSync keeps as controller. The following records may be kept beyond day 91. In CertSync's hands they are Service Personal Data for which CertSync is itself controller, not Customer Personal Data kept on the Customer's behalf:

11.3.1 Payment records. Stripe issues the invoices for the Customer's subscription and keeps them, with the payment history, in CertSync's Stripe account (see clause 11.4). Each invoice shows the billing name, email address, amount and date. CertSync's own systems keep no copies of invoices and no separate payment ledger. CertSync keeps these invoice records for 6 years after the end of the accounting period in which the payment was made, and longer only while an HMRC enquiry into that period is open (Finance Act 1998, Schedule 18, paragraph 21), and then deletes or anonymises the personal elements; clause 4.2 of the Data Retention Policy gives the detail.

11.3.2 Anonymised security audit logs. When a user is deleted, the user identifier, email address, IP address and device details in that user's audit-log entries are replaced with a fixed redacted marker, and Stripe references that could identify a person are removed. The anonymised log is kept for six years from anonymisation, to protect the integrity of CertSync's security record and so that CertSync can bring or defend legal claims within the limitation period under the Limitation Act 1980. Once anonymised, the log no longer identifies anyone and is not Personal Data (UK GDPR Recital 26).

11.3.3 Complaint records. A record of any privacy complaint made to CertSync about its own handling of Personal Data, and of how CertSync handled it, is kept for six years after the complaint is closed, as the Privacy Notice describes.

11.4 Stripe-side data. At day 91 CertSync deletes the customer at Stripe and removes the Stripe customer identifier from the user's account; the subscription's Stripe references and the invoices in clause 11.3.1 are kept for the period set out there. Stripe holds card data and card-transaction records as a controller in its own right and keeps them under its own privacy policy and its obligations as a regulated payment provider; CertSync cannot require Stripe to delete them. The Privacy Notice explains this.

11.5 Cross-Certificate Memory. Cross-Certificate Memory is Customer Personal Data, and CertSync processes it as processor on the Customer's instructions. CertSync uses it only to offer each of the Customer's users the details that user has previously entered, so that they can pre-fill later certificates. It is held against the user who entered it, is never shown to or used for any other Customer, and is deleted when that user's account is deleted and in any event with the Customer's account under clause 11.2. A user can pause it or clear it from their account settings.

12. Audit rights detail

12.1 Frequency. The Customer may exercise its audit right under clause 6.8 no more than once per calendar year, unless: (a) a Personal Data Breach affecting Customer Personal Data has occurred and CertSync reasonably needs to demonstrate compliance for the Customer's investigation or notification; or (b) the ICO or another Supervisory Authority has directed an audit.

12.2 Notice. The Customer shall give CertSync at least thirty (30) calendar days' written notice of an audit, stating its proposed scope, dates and auditor.

12.3 Scope. The audit shall be reasonable in scope, limited to what is necessary to demonstrate compliance with this DPA and Article 28 UK GDPR, and shall not extend to: (a) information about CertSync's other customers; (b) CertSync's source code, internal pricing or commercial contracts, so far as they are not relevant to compliance with this DPA; or (c) information whose disclosure would breach a duty of confidence CertSync owes to a third party.

12.4 Auditor. The auditor shall be a reputable independent third party agreed by both parties (agreement not to be unreasonably withheld) and bound by written confidentiality terms with the Customer.

12.5 Documents first. CertSync may meet the audit obligation by providing: (a) its most recent independent audit report or certification, if any; (b) a written answer to the Customer's standard audit questionnaire within thirty (30) calendar days; and (c) reasonable access to CertSync's data-protection contact for follow-up questions. Audits shall be carried out by document review first, with on-site inspection only where document review is reasonably insufficient to demonstrate compliance.

12.6 Costs. CertSync may charge the Customer at its standard professional rates for time its personnel spend supporting an audit beyond eight (8) person-hours. It shall not charge where the audit finds a material breach of this DPA by CertSync.

12.7 Confidentiality. Audit findings are confidential between the parties. The Customer shall not disclose them except: (a) to the auditor; (b) to its professional advisers under written confidentiality terms; (c) where required by its regulators or by law; or (d) with CertSync's prior written consent.

13. Liability

13.1 Each party's liability in connection with this DPA, including for any breach of Data Protection Laws by that party, is limited and apportioned in accordance with the limitation-of-liability and indemnity provisions of the Subscription Agreement.

13.2 Nothing in this DPA or the Subscription Agreement excludes or limits a party's liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) any liability that cannot lawfully be excluded or limited under the laws of England and Wales; or (d) a data subject's right to compensation under Article 82 UK GDPR.

14. Insurance

14.1 CertSync holds professional indemnity insurance and cyber liability insurance appropriate to the nature and scale of the Service and the Personal Data processed under this DPA. Details are available to the Customer on reasonable request.

15. Term and termination

15.1 This DPA takes effect when the Customer accepts the Subscription Agreement, or, if earlier, when the Customer first uses the Service under it.

15.2 This DPA continues for as long as CertSync processes Customer Personal Data on the Customer's behalf, including during the Read-Only Grace Period.

15.3 The following clauses survive termination of the Subscription Agreement and of this DPA so far as needed to give effect to them: clause 6.2 (confidentiality), clause 6.7 (return or deletion), clause 6.8 (audits), clause 8 (breach notification, for any breach occurring during the term), clause 11 (return or deletion workflow), clause 12 (audit rights detail), clause 13 (liability), clause 17 (governing law and jurisdiction), and this clause 15.3.

15.4 Acceptance and form. This DPA is in writing in electronic form within the meaning of Article 28(9) UK GDPR. It forms part of the Subscription Agreement under clause 1.3, so the Customer accepts this DPA by accepting the Subscription Agreement. No separate signature, countersignature or checkbox is needed.

15.4.1 The Customer may also confirm acceptance from the in-app DPA page. CertSync then records the date and time, the version accepted, and the user who accepted on the Customer's behalf.

15.4.2 The in-app DPA page offers a PDF of the current version of this DPA. When CertSync publishes a new version, the version the Customer accepted remains identifiable from the record at clause 15.4.1, and the Customer should keep its own downloaded copy.

15.5 Variation. CertSync may vary this DPA. For a material variation, CertSync shall give the Customer at least thirty (30) calendar days' notice in the same way as a Sub-processor change under clause 7.2. Continued use of the Service after the notice period is acceptance of the varied DPA. If the variation is unacceptable, the Customer may terminate the Subscription Agreement during the notice period as described in clause 7.3.3.

16. Order of precedence

16.1 If this DPA and the Subscription Agreement conflict on a matter of data protection (including the matters required by Article 28(3) UK GDPR), this DPA prevails to the extent of the conflict.

16.2 If Schedule 1 and the body of this DPA conflict on the identity of a Sub-processor, its country of processing or its transfer mechanism, Schedule 1 prevails as the operative current record.

16.3 If Schedule 2 and clause 4 conflict, Schedule 2 prevails.

16.4 If Schedule 3 and the Privacy Notice conflict, Schedule 3 prevails for the purposes of this DPA.

17. Governing law and jurisdiction

17.1 This DPA is governed by, and shall be construed in accordance with, the laws of England and Wales.

17.2 The parties submit to the exclusive jurisdiction of the courts of England and Wales in respect of any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with this DPA or its subject matter or formation.

Schedule 1 — Sub-processors

Schedule 1 is the Sub-processor list published at /sub-processors and is incorporated into this DPA by reference. For each active Sub-processor it sets out: the legal entity and jurisdiction; the service provided to CertSync; the categories of Customer Personal Data processed; the country of processing; the UK transfer mechanism that applies; and the data processing agreement that applies.

Schedule 1 also identifies Sub-processors that are dormant or not currently engaged (including any generative-artificial-intelligence service other than the AI processor listed as active, any session-replay tool other than Sentry Session Replay, or any other category that CertSync has elected not to engage at the date of this DPA). The published Schedule 1 is the operative current record.

This DPA does not duplicate the contents of Schedule 1. If the Customer needs a copy of Schedule 1 as at a specific date, CertSync will provide it on reasonable request to privacy@certsync.co.uk.

Schedule 2 — Description of processing

This Schedule 2 sets out the matters required by Article 28(3) UK GDPR for the processing of Customer Personal Data under this DPA.

1. Subject matter of the processing. The provision of the Service to the Customer under the Subscription Agreement: the preparation, signature, storage, search, retrieval, delivery and export of electrical and related certificates and records.

2. Duration of the processing. The Customer's Active Subscription, plus the Read-Only Grace Period of ninety (90) calendar days, plus the expiry of backup copies under clause 11.2.3.

3. Nature and purpose of the processing. Provision of a software-as-a-service platform for electrical certification, including offering each of the Customer's users the customer, site, installation and contractor details that user has previously entered, so that they can pre-fill later certificates (Cross-Certificate Memory). The processing operations include: collection, storage, organisation, structuring, adaptation, retrieval, consultation, use, transmission, dissemination (where the Customer instructs delivery to a third party), restriction, erasure, and destruction. Where the Customer invokes an AI-assisted feature, the processing operations additionally include transmission of the specific Customer Personal Data the Customer selects for that invocation (a photograph, text the Authorised User enters for that invocation, or existing certificate content) to a third-party AI processor identified in Schedule 1, for the sole purpose of generating a suggestion that the Customer's Authorised User then reviews. That transmission occurs only on the Authorised User's instruction, only for the item they select, and is not a background or bulk operation. CertSync does not retain the transmitted content or the generated suggestion once the request ends, save that: (a) a value, wording or photograph the Authorised User accepts or attaches becomes certificate content in the ordinary way; (b) the photographs taken for an AI board scan are saved with the certificate as its photographic evidence once the scan request has been sent, even when the scan fails, and are retained and deleted with that certificate; and (c) for 24 hours after a board scan is delivered, CertSync retains, so that a free retry can be tied to that scan, a one-way hash of each photograph (from which no photograph can be rebuilt), the number of ways and way numbers the scan found and the board details it read, which may include text read from the board's labels, and then deletes that record automatically. The AI request itself stores no photograph. CertSync does not use any of this to train any model; the AI processor's own commitment on training is recorded at clause 10.4. CertSync would use Customer Personal Data to train, fine-tune or otherwise improve a model only through an option that the Customer's account administrator turns on, and only after this DPA has been updated to describe that processing.

4. Types of Personal Data.

4.1 Identifiers and contact data. Names, postal addresses, email addresses and telephone numbers of: the Customer's clients (typically homeowners, tenants, occupiers, landlords or managing agents); the individual users within the Customer's organisation; and the Customer where the Customer is a sole trader.

4.2 Property data. Inspection or installation addresses, property descriptions, distribution-board layouts, circuit lists, and photographs of installations and equipment.

4.3 Professional data. Professional qualifications and registration numbers entered by the Customer's users on certificate signatory blocks; competent-person scheme membership details; signatory titles.

4.4 Test and observation data. Test readings, observation codes, recommendations and risk classifications, together with the signature applied to the certificate.

4.5 Delivery data. Recipient email addresses, delivery status, the delivery-record identifier, and certificate verification events (QR-code scans and postcode-checked verification).

4.6 AI-assisted processing data. Where the Customer invokes an AI-assisted feature: the photograph, text or certificate content the Authorised User selects or enters for that invocation, which may include any of the categories at 4.1 to 4.5 above and any person or property detail incidentally visible in a photograph; a usage record comprising the feature invoked, the outcome, and the credit cost; and, for an AI board scan only, the 24-hour retry record described in paragraph 3. The usage record contains no part of the transmitted content and no part of the generated suggestion.

5. Categories of data subjects. (a) The Customer's clients, including homeowners, tenants, occupiers, landlords and managing agents whose installations the Customer is certifying; (b) the individual users within the Customer's organisation, including electricians, supervisors, office staff and administrators; and (c) the Customer where the Customer is a sole trader or a named individual user.

6. Special categories of personal data. No special category Personal Data (Article 9 UK GDPR) is intended to be processed, and the Service is not designed to capture it. The Customer shall not knowingly enter such data into the Service. Photographs taken of installations may incidentally show people; the Customer is responsible for having an appropriate basis under Articles 6 and 9 UK GDPR for any such incidental capture.

7. Criminal-conviction data. No data relating to criminal convictions and offences (Article 10 UK GDPR) is intended to be processed.

8. Frequency of processing. Continuous, for the duration of the Active Subscription and the Read-Only Grace Period.

9. Location of processing. Primary database in the United Kingdom (MongoDB Atlas, London region). The processing location and transfer mechanism for each Sub-processor are recorded in Schedule 1.

10. Retention. As set out in clause 11: full retention during the Active Subscription; read-only access for the 90-day Read-Only Grace Period; deletion of Customer Personal Data on day 91, with backup copies expiring as set out at clause 11.2.3.

Schedule 3 — Technical and organisational measures

This Schedule 3 sets out the technical and organisational measures CertSync applies to ensure a level of security appropriate to the risk, as Article 32 UK GDPR requires. If it conflicts with the Privacy Notice, this Schedule 3 prevails for the purposes of this DPA.

1. Encryption. Multi-factor authentication backup recovery codes are encrypted with AES-256-GCM. All Customer Personal Data in the primary database (MongoDB Atlas) is encrypted at rest by Atlas's storage-layer encryption. Backups are encrypted. Data in transit is encrypted using TLS 1.2 or higher. Passwords are stored only as salted hashes (bcrypt).

2. Pseudonymisation and anonymisation. Error reports sent to CertSync's error-monitoring service identify a user only by an internal identifier. Personal identifiers in audit-log entries are anonymised when a user is deleted (clause 11.3.2).

3. Access control. Role-based access control on Customer Personal Data within the Service, with four default roles (Installer, Supervisor, Office, Admin) and tenant isolation enforced at the data layer, so one Customer's data is never available to another. The Office role is a read-only back-office role: it may read and export the team's certificates and view the team and its settings, and it may not create, amend, approve, sign, delete or share a certificate; it is not a level of seniority and has less certificate authority than the Installer role. Multi-factor authentication is on by default for every account at sign-in, using emailed one-time codes, with backup recovery codes and audit-logged challenge events; a user can turn it off only by confirming their password and re-verifying their identity, and a device the user chooses to trust is not asked again for up to 30 days. Sensitive operations require the user to re-verify, and those events are audit-logged. Access to Customer Personal Data by CertSync administrative personnel is restricted to authorised site-owner accounts, is limited to the minimum necessary to perform the task in hand, and is recorded in the audit log, with those records available for access review.

4. Network and application security. Rate limiting on sign-in and other requests, the ability to revoke sign-in sessions, and logging of security events. Security headers set at the edge, including Content-Security-Policy, Strict-Transport-Security and X-Content-Type-Options. Input validation on every API route.

5. Operational measures. Audit logging of security-relevant events, with personal identifiers anonymised when a user is deleted (clause 11.3.2). Monitoring of software dependencies for vulnerabilities and prompt application of security updates. An incident-response procedure with the notification commitments in clause 8. A documented backup schedule, with backups encrypted and access restricted to authorised personnel.

6. Confidentiality of personnel. Written confidentiality undertakings from all CertSync personnel and contractors who may access Customer Personal Data, with access limited to what their duties require.

7. Resilience and recovery. The primary database is held in the United Kingdom (MongoDB Atlas, London region). Documented disaster-recovery and backup-restoration procedures, tested periodically.

8. Review. CertSync reviews these measures periodically, having regard to the matters at clause 6.3, records changes to them, and notifies the Customer of any change that materially affects the Customer through the mechanism at clause 7.2.

Contact

Customers may download a PDF of the current DPA (version 2.3) from the in-app DPA page in account settings. If you need a copy of a superseded version your organisation accepted, contact privacy@certsync.co.uk and we will provide it on reasonable request.