Data Processing Agreement

1. Roles

You are the controller of the personal data you put into ScaffBase about your staff, workers and customers. Uniti Scaffolding Ltd is the processor, acting on your documented instructions (which include your use of the service and these terms).

2. Scope of processing

• Subject matter: provision of the ScaffBase software service.
• Duration: for as long as your account is active, plus any agreed retention period.
• Nature and purpose: hosting, storing, organising and transmitting your data so you can run compliance, scheduling, quoting, pay and contract administration.
• Types of data: names, contact details, phone numbers, job roles, competencies/certifications, pay-related data, photos, messages and operational records.
• Data subjects: your staff, workers, gang members, site contacts and customers.

3. Our obligations

• Process personal data only on your instructions, unless required by law.
• Ensure people authorised to process the data are bound by confidentiality.
• Apply appropriate technical and organisational security measures (see section 6).
• Assist you, so far as reasonable, with data-subject requests, breach notifications and data protection impact assessments.
• On end of service, delete or return personal data at your choice, except where law requires us to keep it.
• Make available information needed to show compliance with Article 28.

4. Sub-processors

You authorise us to use the sub-processors below to deliver the service. Each is bound by data-protection terms consistent with this DPA. We will give reasonable notice of any intended change so you can object on legitimate grounds.

• Supabase — Database, authentication and encrypted file storage (EU / USA).
• Vercel — Application hosting and content delivery (EU / USA).
• Twilio — WhatsApp and SMS messaging (EU / USA).
• Resend — Transactional and notification email (EU / USA).
• Anthropic — AI features (drafting, pricing assistance, document review) (USA).
• Xero — Accounting export — only if you connect your Xero account (UK / EU).

5. International transfers

Where a sub-processor processes data outside the UK, we ensure an appropriate transfer mechanism is in place (UK adequacy regulations, or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses).

6. Security measures

• Encryption of data in transit and at rest.
• Role-based access control and per-business data isolation (row-level security).
• Private, access-controlled file storage.
• Access limited to authorised personnel on a need-to-know basis.
• Regular review of access and security configuration.

7. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide the information you reasonably need to meet your own notification obligations to the ICO and affected individuals.

8. Your responsibilities

You are responsible for having a lawful basis to process the personal data you add, for informing your workers and customers how their data is used, for setting access correctly within the app, and for the accuracy of the data you upload.

9. Liability and precedence

This DPA is governed by the law of England and Wales. Liability under it is subject to the limits in the Terms of Service. If there is a conflict on data-protection matters, this DPA prevails over the rest of the terms. Contact for data-processing matters: andy@unitiscaffolding.co.uk.