Data Processing Agreement

Between: the Customer named in the Order (the "Controller"), and

APXS-UK LTD, trading as ApexSpark, company number 17467844, registered office 71–75 Shelton Street, London, WC2H 9JQ (the "Processor").

Effective date: 30 September 2026

Last updated: 5 October 2026

Processor contact for this DPA (instructions, rights requests, breach notices, sub-processor objections): help@apexspark.co.uk.

This Data Processing Agreement ("DPA") forms part of the ApexSpark Terms of Service (the "Terms") and meets the requirements of Article 28 of the UK GDPR. Words defined in the UK GDPR (such as "personal data", "processing", "personal data breach" and "data subject") have the same meaning here. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and PECR, as amended or replaced.

1. Roles

1.1 The Controller is the controller and ApexSpark is the processor of the personal data described in Annex 1 ("Customer Personal Data").

1.2 The Controller is responsible for the lawfulness of the processing, including having a lawful basis (and, for health data, an Article 9 condition), giving privacy information to data subjects, and carrying out any data protection impact assessment (in particular before enabling clocking, on-site attendance or other location features).

2. Subject matter, duration, nature and purpose

2.1 Subject matter: providing the ApexSpark platform (office web app, company workspace, engineer apps) to the Controller.

2.2 Duration: the term of the Terms plus the period needed to return and delete data under section 11.

2.3 Nature: hosting, storage, organisation, retrieval, display, transmission (including email and push notifications), backup, export and deletion, and, where the Controller switches on drawing take-off, automated analysis of uploaded drawings, including an automatic check of small symbol cut-outs by a specialist AI service provider.

2.4 Purpose: to provide, secure and support the Service in line with the Controller's configuration and instructions.

3. Processor obligations

ApexSpark will:

(a) process Customer Personal Data only on the Controller's documented instructions (these Terms, the Controller's configuration of the Service and any written instructions from an authorised person), including for transfers outside the UK, unless the law requires otherwise (in which case it will tell the Controller first unless the law forbids that);

(b) tell the Controller immediately if, in its opinion, an instruction breaches Data Protection Law;

(d) implement the security measures in Annex 2;

(e) follow section 4 when using sub-processors;

(f) assist the Controller with data subject requests (section 7);

(g) assist the Controller with security, breach notification, data protection impact assessments and prior consultation with the ICO, taking into account the nature of the processing and the information available to ApexSpark;

(h) delete or return Customer Personal Data at the end of the Service (section 11);

(i) make available the information needed to demonstrate compliance with Article 28 and allow audits (section 10).

4. Sub-processors

4.1 The Controller gives general authorisation for ApexSpark to use the sub-processors listed in Annex 3.

4.2 ApexSpark will give the Controller at least 30 days' notice by email before adding or replacing a sub-processor, and will publish the current list on request. A list of our sub-processors is available to customers on request (help@apexspark.co.uk).

4.3 The Controller may object on reasonable data protection grounds within that notice period. The parties will discuss the objection in good faith. If it cannot be resolved, the Controller may terminate the affected part of the Service without penalty and receive a pro-rata refund of prepaid fees for it.

4.4 ApexSpark will impose data protection obligations on each sub-processor that are no less protective than this DPA and remains liable to the Controller for its sub-processors' performance.

4.5 Services that the Controller itself chooses to connect (for example its own email account) are not ApexSpark sub-processors; ApexSpark sends data to them on the Controller's instruction.

5. International transfers

5.1 Customer Personal Data is hosted in the United Kingdom.

5.2 ApexSpark will not transfer Customer Personal Data outside the UK except to the sub-processors in Annex 3 or as otherwise instructed, and only where the transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified recipients) or by appropriate safeguards (the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses), with a transfer risk assessment where required.

6. Security

ApexSpark will implement and maintain appropriate technical and organisational measures under Article 32 UK GDPR, including those in Annex 2, and will review them regularly.

7. Data subject requests

7.1 If ApexSpark receives a request from a data subject about Customer Personal Data, it will pass it to the Controller within 5 working days and will not respond directly except to confirm the request has been passed on, unless the Controller instructs otherwise.

7.2 ApexSpark will provide reasonable help so the Controller can respond to access, rectification, erasure, restriction, portability and objection requests within legal time limits, including by providing exports or deleting specific records where the Controller cannot do this itself in the Service.

8. Personal data breaches

8.1 ApexSpark will notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will aim to do so within 48 hours.

8.2 The notice will include, as far as then known: what happened, the categories and approximate number of data subjects and records, likely consequences, the measures taken or proposed, and a contact point. ApexSpark will provide further information as it becomes available.

8.3 ApexSpark will take reasonable steps to contain and remedy the breach and will cooperate with the Controller's notifications to the ICO and data subjects. ApexSpark will not notify the ICO or data subjects about Customer Personal Data on the Controller's behalf unless instructed or required by law.

9. Confidentiality and staff

Access to Customer Personal Data is limited to ApexSpark staff and contractors who need it to provide or support the Service, who are bound by confidentiality and trained on their data protection responsibilities.

10. Audits and information

10.1 ApexSpark will provide, on reasonable request, the information necessary to demonstrate compliance with this DPA, including written answers to security questionnaires.

10.2 Where that information is not enough, the Controller (or an independent auditor bound by confidentiality) may carry out an audit once a year, on at least 30 days' notice, during business hours, at the Controller's cost, and in a way that does not compromise other customers' data or ApexSpark's security. Additional audits are allowed after a personal data breach or where the ICO requires.

11. Return and deletion

11.1 For 30 days after the end of the Service, ApexSpark will on request provide an export of Customer Personal Data in a commonly used format.

11.2 ApexSpark will then delete Customer Personal Data from the live Service within 60 days after the end of the Service, and from backups as they roll over (daily backups within 30 days, monthly backups within 12 months), unless UK law requires it to be kept. Retained data stays protected by this DPA.

11.3 ApexSpark will confirm deletion in writing on request.

12. Liability and precedence

12.1 Liability under this DPA is subject to the limits in the Terms.

12.2 If this DPA conflicts with the Terms on data protection, this DPA prevails.

Annex 1: Details of processing

Categories of data subject

Controller's employees, engineers, apprentices, office staff and subcontractors (Users);
emergency contacts of those people;
homeowners, tenants and occupants of properties where the Controller carries out work, including Customer Care visits;
contacts at the Controller's clients (builders, developers, landlords) and suppliers;
any other individuals whose details the Controller chooses to record (for example in notes or emails).

Categories of personal data

identity and contact: name, email, phone, home address, date of birth, job role;
employment and payroll: start date, National Insurance number, UTR, subcontractor company details, bank sort code, account number and account name, timesheets, clock-in/out times, holidays, overtime, tool allocations, jobs worked;
qualifications and compliance: driving licence and expiry, ECS/qualification card details, uploaded documents, training assignments, quiz answers and completion certificates;
location: position and accuracy at clock-in and clock-out; on-site position checks while clocked in; where on-site attendance is enabled, arrival, departure and heartbeat events (coordinates only when inside the site boundary);
property and visit data: addresses, plot, access notes, issue reported, work carried out, contact attempts, photos, occupant name and signature;
electrical certificates: installation address, test results, engineer and countersigner names and signatures;
device data: device identifier, device name, platform, app version, first/last seen, Apple push token;
communications: notifications, and emails in any mailbox the Controller connects;
sign-in data: hashed passwords, session and token records, sign-in and security logs;
drawings and plans the Controller uploads for take-off: these are building drawings. Their notes may incidentally include names or contact details of the builder, architect or site. They are kept in private storage. The drawing file is deleted 90 days after sign-off, or 90 days after upload if never signed off.

Special category data: optional health information about Users (medical conditions, allergies, medication) entered for health and safety on site.

Frequency: continuous while the Service is in use.

Annex 2: Security measures

Encryption in transit: all web, app and API traffic over HTTPS/TLS.
Authentication: passwords hashed with bcrypt; web sessions held in Secure, HttpOnly, SameSite=Lax cookies, signed with a separate secret per workspace, expiring after 24 hours; app access via short-lived tokens that can be revoked per device; archived or deleted users signed out on their next request.
App storage: sign-in credentials kept in the iOS Keychain and Android Keystore-encrypted storage.
Isolation: each Customer workspace runs as a separate application instance with its own database and file store.
Access control: role-based permissions within each workspace; uploaded files (documents, photos, invoices, certificates) held in private storage and served only to authorised signed-in users.
Location minimisation: off-site coordinates from background attendance checks are discarded by the server and never stored; no location collected before clock-in or after clock-out.
Staff access: administrative access to servers limited to named staff with individual credentials; least privilege.
Backups: a consistent nightly backup of every workspace database, stored in the UK with restricted administrator-only access, each copy integrity-checked with a recorded SHA-256 checksum; daily copies kept 30 days and monthly copies 12 months; restores tested regularly.
Monitoring and patching: service health monitoring, and security updates applied to the operating system and dependencies.
Incident response: documented breach process in line with section 8.
Encryption at rest: bank details, National Insurance numbers, UTRs and medical information encrypted with AES-256-GCM using a separate key per workspace, held outside the database; readable only by the office roles that already have access to them.

Annex 3: Authorised sub-processors

Sub-processor	Service	Data	Location / transfer safeguard
Fasthosts Internet Ltd	Server hosting, storage	All Customer Personal Data	United Kingdom
Resend (Plus Five Five, Inc.)	Transactional email delivery	Recipient name and email, email content (e.g. sign-in links, notifications, reports the Controller sends)	United States: UK-US data bridge if certified, otherwise IDTA / UK Addendum
Apple Inc.	Push notifications to iPhones (APNs)	Push token, notification title and text	United States: UK-US data bridge / Apple's transfer terms
Google LLC	Google Play services location and geofencing on Android devices (attendance only)	Device location, processed on the device through Google's APIs	United States: UK-US data bridge / Google's transfer terms
A specialist AI service provider (data may be processed in the EU and the US, with UK-approved safeguards for any transfer outside the UK). Its name and address are given to the Controller on request.	Automated analysis for the optional drawing take-off. It runs only when the Controller switches the feature on.	Cut-outs of electrical symbols from drawings the Controller uploads (about 0.4 m × 0.4 m of a plan each) and the drawings' electrical notes text; it returns suggestions only. No whole drawings are sent. The provider may not train models on the data. It deletes the data within 30 days, unless it must keep it longer to enforce its usage policy (flagged items up to 2 years) or by law.	EU (EEA): UK adequacy regulations. Any United States transfer: the ICO International Data Transfer Addendum to the EU Standard Contractual Clauses, as incorporated in the provider's data processing terms, with a transfer risk assessment.

A list of our sub-processors is available to customers on request (help@apexspark.co.uk).

Also involved, but not processing Customer Personal Data on our behalf in the ordinary course: Apple App Store and Google Play (app distribution under their own terms with the user); Google Fonts, cdnjs (Cloudflare) and OpenStreetMap (receive the browser's IP address when certain pages load; OpenStreetMap address search receives the typed search text).

Not currently used: Stripe. If ApexSpark begins taking card payments it will notify the Controller under section 4.2.