Data processing agreement

"Data Protection Laws" means UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended or replaced from time to time.

Processing of personal data for the EHSync applications the Controller orders (for example EHSync Safety, EHSync Projects, EHSync ISO, EHSync Hauldesk, EHSync Waste, EHSync Carbon, and related suite services), for the term of the main agreement and any wind-down period the parties agree.

Hosting, storage, transmission, display, and support of tenant data the Controller (and its authorised users) enter into the apps, so the Controller can operate safety, project, ISO, haulage, waste, energy, or related workflows.

As determined by the Controller. Typical categories may include names, contact details, employment or contractor identifiers, location data (for example a driver's phone during a Hauldesk run), job or site references, and account credentials. Special category data (for example injury details) is not requested by EHSync product defaults; if the Controller chooses to enter it, the Controller remains responsible for a lawful basis and any DPIA.

The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country, unless required to do so by UK law. The main service agreement and this schedule constitute those instructions, as updated in writing.

Persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Taking into account the state of the art, costs, and risks, the Processor implements appropriate technical and organisational measures. Hosting practice is described on the public Security page.

The Controller authorises the Processor to use the sub-processors listed below (general written authorisation). The Processor will inform the Controller of intended changes so the Controller can object on reasonable grounds within 30 days.

Transactional mail is sent from an EHSync no-reply address.

Other service providers are described by category on our service providers page. The named list is available to customers on request.

The Processor assists the Controller, by appropriate technical and organisational measures, insofar as possible, for the fulfilment of the Controller's obligation to respond to requests for exercising data subject rights.

The Processor will promptly, and in any event within 5 working days, pass to the Controller any complaint it receives from a data subject about the Controller's personal data. It will not respond to the complaint itself unless instructed to, and will give the Controller reasonable help to meet its duties under section 164A of the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), including the duty to acknowledge complaints within 30 days.

The Processor assists the Controller in ensuring compliance with UK GDPR Articles 32 to 36, taking into account the nature of processing and information available to the Processor. Personal data breach: the Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with enough detail for the Controller to meet its own notification duties.

At the choice of the Controller, the Processor deletes or returns all personal data after the end of the provision of services, and deletes existing copies, unless UK law requires storage.

The Processor makes available information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits by the Controller or an auditor mandated by the Controller, subject to reasonable notice, confidentiality, and frequency limits.

Hosting transfers rely on UK adequacy. The UK International Data Transfer Addendum, or an equivalent approved tool, is used only if a later provider is in a country the UK does not recognise as adequate.

England and Wales. Courts of England and Wales have exclusive jurisdiction, unless the main agreement says otherwise.