Data Processing Agreement

1. Roles

You determine the purposes and means of processing your customers' personal data and are the Controller. We process it only to provide the service, as your Processor. Each party will comply with its obligations under UK data protection law.

2. Subject-matter, duration, nature & purpose

Subject-matter & purpose: processing your customers' and properties' personal data so you can record inspections/tests, produce and store electrical certificates, and manage related jobs, diary entries and invoices. Nature: collection, storage, organisation, retrieval, AI-assisted extraction from photos, and erasure. Duration: for as long as your account is active or until you delete the data.

3. Categories of data & data subjects

• Data subjects: your customers, landlords, occupiers and site contacts.
• Personal data: names, addresses, postcodes, phone numbers, email addresses, occupier names, and property/certificate details. No special-category data is required or intended.

4. Our obligations as Processor

We will:

• process personal data only on your documented instructions (using the app constitutes your instructions), unless required by law;
• ensure persons authorised to process it are bound by confidentiality;
• implement appropriate technical and organisational security (Article 32) - see §6;
• engage sub-processors only under §5;
• assist you, taking account of the nature of processing, in responding to data-subject requests and in meeting your security, breach-notification and DPIA obligations;
• notify you without undue delay on becoming aware of a personal-data breach;
• at your choice, delete or return the personal data at the end of the service (the in-app "Delete my data" satisfies this), and delete existing copies unless retention is legally required;
• make available the information needed to demonstrate compliance and allow for audits, on reasonable notice.

5. Sub-processors

You give general authorisation for us to use the sub-processors needed to run the service. Current sub-processors:

• Supabase - database, authentication & photo storage (EU / Paris).
• Cloudflare - hosting & content delivery; Cloudflare Workers AI additionally transcribes assistant voice notes (audio processed transiently on Cloudflare's global network, not retained, not used for training).
• Anthropic - AI extraction from scanned photos and from assistant voice/typed note text (US; inputs not used for model training).
• Resend - transactional sign-in email.
• Stripe - payment processing for invoice pay-links (your customers' payment details; PCI-DSS compliant).

Each is engaged under terms imposing data-protection obligations equivalent to these. We will give notice of intended changes and you may object on reasonable data-protection grounds.

6. Security measures (Article 32)

• Encryption of personal data in transit (HTTPS/TLS) and at rest.
• Per-account authentication and row-level access isolation (you access only your own workspace).
• A strict content-security policy and standard hardening of the hosting.
• Ability to restore availability, and a process to delete data on request with an audit record.

7. International transfers

Where a sub-processor processes personal data outside the UK/EEA (notably US providers), such transfers are made under the UK Extension to the EU-US Data Privacy Framework and/or UK Standard Contractual Clauses (the UK IDTA/Addendum) within their agreements.

8. General

This Agreement is governed by the laws of England and Wales. If there is a conflict between this Agreement and the Terms of Service on data-protection matters, this Agreement prevails. Questions: privacy@earlyfinish.co.uk.