Data Processing Agreement

1. Introduction and Parties

This Data Processing Agreement ("DPA") forms part of the Terms of Service governing the use of ExpiryTrack.

It applies where ExpiryTrack processes personal data on behalf of a business customer.

The parties are:

Data Processor: Stuart Howitt trading as ExpiryTrack, Elderflower House, Carbrooke, Thetford, IP25 6SS, United Kingdom.

Data Controller: The business or organisation that registers for and uses ExpiryTrack to manage its equipment, inspection, certification and renewal records.

By accepting the ExpiryTrack Terms of Service, the customer also accepts this Data Processing Agreement.

Where the customer is itself acting as a processor for another organisation, references to the controller's instructions include lawful instructions passed through that customer by the relevant controller.

2. Purpose and Scope

ExpiryTrack processes customer information for the purpose of delivering equipment inspection and renewal tracking services.

Processing may include:

• Storing equipment and asset records.
• Recording inspection and renewal dates.
• Maintaining inspection and maintenance histories.
• Storing uploaded certificates and associated documents.
• Generating reminder notifications.
• Producing reports and exports.
• Associating records with customer accounts.
• Maintaining and securing the service.

Processing is limited to activities reasonably necessary to provide the contracted service and comply with applicable legal obligations.

3. Roles and Responsibilities

The customer is responsible for determining the purposes and lawful basis for processing personal data entered into ExpiryTrack.

The customer must ensure that it has the necessary authority to collect, upload and manage personal information.

ExpiryTrack acts as a data processor in relation to personal data contained within customer-managed business records.

ExpiryTrack acts as an independent data controller for personal data it processes for its own account administration, billing, customer support, security and legal compliance purposes. Such processing is covered by the ExpiryTrack Privacy Policy.

Both parties shall comply with their respective obligations under applicable UK data protection legislation.

4. Processing Instructions

ExpiryTrack shall process customer personal data only in accordance with the customer's documented instructions, including instructions concerning international transfers, unless otherwise required by applicable law.

The customer's use of the application, account configuration, uploaded records and written support requests constitute documented instructions within the scope of the service.

Where legally required to process information contrary to an instruction, ExpiryTrack shall notify the customer before doing so unless prohibited by law.

ExpiryTrack shall promptly inform the customer if, in its opinion, an instruction infringes applicable data protection legislation.

5. Confidentiality

ExpiryTrack shall ensure that individuals authorised to process customer personal data are subject to appropriate confidentiality obligations.

Customer information shall not be disclosed to unauthorised third parties.

Access to customer information shall be limited to individuals and service providers who require it for legitimate operational, support, security or legal purposes.

Confidentiality obligations shall continue following termination of the service.

6. Security Measures

ExpiryTrack shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures shall be proportionate to the nature of the information, the available technology and the risks involved.

These may include, as appropriate:

• Access controls and authentication.
• Restrictions on access to customer records.
• Encryption in transit and, where appropriate, at rest.
• Secure hosting and data storage.
• Security updates and vulnerability management.
• Appropriate backup and recovery arrangements.
• Procedures for identifying and responding to security incidents.

ExpiryTrack shall periodically review the appropriateness of its security measures.

7. Sub-processors

The customer grants general written authorisation for ExpiryTrack to engage third-party sub-processors where reasonably necessary to operate and deliver the service.

These may include providers of application hosting, database services, file storage, authentication, email delivery and technical infrastructure.

ExpiryTrack shall:

• Use sub-processors providing appropriate data protection and security assurances.
• Ensure that applicable data processing obligations are imposed contractually on sub-processors.
• Remain responsible for the performance of its sub-processors' relevant data protection obligations.
• Maintain an accessible list of sub-processors and their relevant processing activities (Schedule 2).
• Inform customers of intended additions or replacements, giving them a reasonable opportunity to object on data protection grounds.

If an objection cannot reasonably be resolved, the customer may terminate the affected service without penalty for future subscription periods.

8. International Data Transfers

ExpiryTrack shall ensure that any transfer of customer personal data outside the United Kingdom complies with applicable UK data protection legislation.

Where required, appropriate safeguards shall be implemented, such as an applicable UK adequacy regulation, the UK International Data Transfer Agreement or a valid UK Addendum to approved standard contractual clauses.

ExpiryTrack shall not make restricted international transfers without a valid legal mechanism.

9. Personal Data Breaches

ExpiryTrack shall notify the customer without undue delay after becoming aware of a personal data breach affecting information processed on the customer's behalf.

The notification shall provide available information concerning:

• The nature of the incident.
• The categories of personal data potentially affected.
• The likely consequences, where known.
• Measures taken or proposed to contain and address the incident.

ExpiryTrack shall provide reasonable assistance to the customer in investigating and responding to the breach.

The customer remains responsible for making regulatory or individual notifications where required in its capacity as data controller.

10. Data Subject Rights

ExpiryTrack shall provide reasonable assistance to customers responding to lawful requests from individuals concerning their personal data.

This may include requests for access, rectification, erasure, restriction or portability.

Where an individual contacts ExpiryTrack directly concerning information controlled by a customer, ExpiryTrack shall, where appropriate and lawful, direct the request to the relevant customer.

ExpiryTrack shall not independently respond to such requests on behalf of the customer unless authorised or legally required to do so.

11. Compliance Assistance

Taking into account the nature of the processing and the information available to it, ExpiryTrack shall provide reasonable assistance to customers with relevant obligations under UK data protection legislation.

This includes, where applicable:

• Data security requirements.
• Personal data breach assessments and notifications.
• Data protection impact assessments.
• Prior consultation with the Information Commissioner's Office.

The scope of assistance shall be proportionate to the processing activities and the information reasonably available to ExpiryTrack.

12. Data Ownership and Retention

Customer records and uploaded documents remain the property of the customer or their respective lawful owners.

ExpiryTrack does not acquire ownership of customer content.

Customer records shall be retained within the active service while the account remains open, subject to the Terms of Service and applicable law.

Customers are responsible for maintaining independent copies of records they are legally required to retain.

ExpiryTrack shall not use customer-managed personal data for unrelated marketing, commercial resale or other purposes outside the customer's lawful instructions.

13. Account Closure, Return and Deletion

Upon termination of the processing services, ExpiryTrack shall, at the customer's choice, return or securely delete personal data processed on the customer's behalf, unless applicable law requires continued retention.

Customers should request or complete any available export of their records before account closure.

Where the customer selects deletion, closing the ExpiryTrack account removes the account and its associated information from the active application, including equipment records, inspection histories and reminder settings. A customer can do this themselves from Settings using Delete my account, or by emailing appsupport@stuarthowitt.co.uk. Uploaded certificates and documents are no longer accessible through the closed account; copies held in underlying storage are removed in line with the platform's storage arrangements.

Deletion from active systems may not immediately remove information held within protected system backups.

Where immediate deletion from backups is not technically possible, ExpiryTrack shall keep the relevant data protected and beyond ordinary use until it is removed under the applicable backup retention and deletion arrangements.

Remaining copies shall be securely deleted unless continued storage is legally required.

Separate billing, accounting and transaction records processed by ExpiryTrack as an independent data controller may be retained where necessary to comply with applicable law.

14. Audits and Information

ExpiryTrack shall make available information reasonably necessary to demonstrate compliance with its obligations under this Agreement and Article 28 of the UK GDPR.

ExpiryTrack shall allow and contribute to audits and inspections conducted by the customer or an appropriately authorised auditor, subject to reasonable arrangements protecting service security, confidential information and other customers' data.

Where suitable independent assurance or documentation is available, this may be used to support the assessment of compliance.

Neither party is required to provide unrestricted access to unrelated systems, confidential third-party information or another customer's records.

15. Duration

This Agreement takes effect when the customer accepts the ExpiryTrack Terms of Service and remains applicable for as long as ExpiryTrack processes personal data on the customer's behalf.

Obligations relating to confidentiality, data protection, secure deletion and retained information shall survive termination to the extent necessary.

16. Relationship with the Terms of Service

This Agreement forms part of the ExpiryTrack Terms of Service.

Where there is a conflict between this Agreement and the Terms of Service concerning the processing of personal data on behalf of a customer, this Agreement shall take precedence in relation to that processing.

Nothing in the Terms of Service shall override obligations that cannot lawfully be restricted under applicable data protection legislation.

Schedule 1 — Details of Processing

Subject matter: Equipment inspection, maintenance, certification and renewal records.

Duration: For the period during which the customer uses ExpiryTrack, together with any applicable deletion, backup or legally required retention period.

Nature of processing: Collection, recording, organisation, storage, retrieval, modification, transmission, export and deletion.

Purpose: Providing the equipment record-management, inspection tracking, document storage and reminder functionality requested by the customer.

Categories of data subjects:

• Customer employees and authorised users.
• Equipment inspectors and competent persons.
• Contractors and service providers.
• Other individuals identified in customer-uploaded records.

Types of personal data:

• Names and business contact details.
• Job titles and professional roles.
• Inspector or contractor identification details.
• Information contained within uploaded certificates.
• Inspection histories associated with identifiable individuals.
• Other incidental personal data entered by customers.

The service is not intended for the storage of special-category personal data or information unrelated to equipment and compliance management.

Processing instructions: The customer's use of ExpiryTrack in accordance with the Terms of Service, together with any lawful documented instructions accepted by ExpiryTrack.

Schedule 2 — Sub-processors

The providers below are used to operate ExpiryTrack. This list is kept up to date and customers will be told of intended additions or replacements as described in section 7.

Processing locations and the transfer safeguards used by each provider are described in that provider's published data protection documentation. Further details can be requested from appsupport@stuarthowitt.co.uk.

17. Contact

Stuart Howitt trading as ExpiryTrack

Elderflower House
Carbrooke
Thetford
IP25 6SS
United Kingdom

Email: appsupport@stuarthowitt.co.uk

This Agreement is governed by the laws of England and Wales, subject to applicable mandatory data protection legislation.