Data processing agreement
These terms apply where ProfitM8 processes personal data on behalf of the practice (the controller). Jigsaw Consulting Limited is the processor. They form part of the terms of business and take effect when those are accepted.
Where we process data for our own purposes — your own staff logins, our mailing list — we are the controller and the privacy policy applies instead, not this agreement.
1. What is being processed
| Required detail | For ProfitM8 |
|---|---|
| Subject matter | Providing the ProfitM8 pricing service to the controller and its clients. |
| Duration | For as long as the subscription is open, plus the 90-day period after cancellation set out in the terms. |
| Nature and purpose | Storing, calculating with, displaying and emailing the data so that jobs can be priced and quotes and invoices issued. |
| Types of personal data | Names and email addresses; pay rates, National Insurance rates and working hours of a business's staff; subcontractor names, trades and rates; the names and email addresses of that business's own customers, and what they were quoted. |
| Categories of data subject | Employees, directors, subcontractors and freelancers of the controller's clients; those clients' own customers; and users of the controller's account. |
| Special category data | None. ProfitM8 neither asks for nor expects it, and it should not be entered. |
2. Our obligations as processor
We will:
- process personal data only on your documented instructions — using ProfitM8 as intended is such an instruction — unless the law requires otherwise, in which case we will tell you first unless prohibited;
- make sure anyone with access is under a duty of confidentiality;
- apply the security measures described in section 4;
- not engage another sub-processor without telling you first (section 3);
- help you respond to requests from individuals (section 5);
- help you with security, breach notification and impact assessments, taking account of what we know and what you do not;
- delete or return the data at the end, as section 6 sets out;
- give you the information you need to show this is being done, and allow audits (section 7).
3. Sub-processors
You agree to our using the following, each under written terms no less protective than these:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting the application and database | Germany (EU) |
| Our email delivery provider | Sending quotes, invoices and account email | United Kingdom |
| GoCardless Ltd | Collecting the controller's own subscription | United Kingdom |
| Off-site backup storage | Daily encrypted backups | United Kingdom |
| Xero, Intuit, FreeAgent, Sage | Only where the controller connects one for a client | Various |
We will give you at least 30 days' notice before adding or replacing one. If you reasonably object on data protection grounds, you may cancel without penalty for the remainder of the term.
4. Security
- Encryption in transit (HTTPS) for everything, and for backups leaving the server.
- Passwords stored only as one-way hashes; access tokens for accounting packages stored encrypted.
- Access control enforced on every request at the server, not merely hidden in the interface, and scoped so one practice can never reach another's data.
- An audit trail of any occasion when a platform administrator views an account as another user, written before access is granted so it cannot be bypassed.
- A record of every email sent, so delivery can be evidenced.
- Daily off-site backups, with restores tested rather than assumed.
5. Requests from individuals
If someone contacts us directly about data we hold for you, we will not respond substantively ourselves. We will tell them to contact you, and tell you promptly.
We will help you meet access, correction, deletion, restriction, portability and objection requests within the time you have to answer them. Most of it you can do yourself in the application; where you cannot, ask us.
6. Breaches
We will tell you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting your data, with what we know, what we are doing, and what we suggest — so that you can meet your own 72-hour deadline to the ICO. We will not wait until we have the full picture before telling you.
7. Return and deletion
At the end of the agreement you may export your data. 90 days after cancellation we delete it from live systems; it then ages out of backups on the rolling backup cycle. We will confirm deletion in writing if you ask. If the law requires us to keep something, we will tell you what and why.
8. Audit
We will make available the information needed to demonstrate compliance with Article 28, and allow an audit by you or an auditor you appoint, on reasonable notice, not more than once a year unless there has been a breach or a regulator requires it. We will answer a reasonable due-diligence questionnaire without charge.
9. International transfers
We will not transfer personal data outside the UK or EEA without an appropriate safeguard — the UK International Data Transfer Agreement, or the EU standard contractual clauses with the UK Addendum — and will tell you where that applies.