TermsPrivacyData processingCookiesDPIA template
Data processing agreement
Last updated 22 October 2026
This agreement forms part of the terms of service between the customer (controller) and Joe Moore, trading as JobGate, Swansea, Wales (full postal address on request) (processor). It meets the requirements of Article 28 of the UK GDPR. It applies automatically when you use JobGate. If you need a signed copy, email hello@jobgate.uk.
1. Subject matter
| Nature and purpose | Providing the JobGate site sign-in, induction, timesheet, safety reporting and records service |
| Duration | While the customer uses JobGate, plus the deletion period below |
| Data subjects | The customer's employees, subcontractors, subcontractor workers, visitors and office users |
| Personal data | Names, mobile numbers, company, sign-in/out times, location at sign-in, signatures and acknowledgements, daily check answers, reports and photos, uploaded documents and tickets, device sign-in keys |
| Special category data | Not intended. Injury details may appear in accident reports entered by the customer's workers; the customer is responsible for its basis for recording these |
2. Processor obligations
JobGate will:
- process the personal data only on the customer's documented instructions (these terms and the customer's use of the service are the instructions), unless UK law requires otherwise, in which case we'll tell the customer first unless the law forbids it;
- make sure anyone authorised to process the data is bound by confidentiality;
- take appropriate technical and organisational security measures (see section 4);
- use only the sub-processors listed below, with written contracts giving equivalent protection, give at least 30 days' notice by email of any new sub-processor, and let the customer object; if we can't resolve the objection, the customer may cancel without penalty. We remain responsible for our sub-processors;
- help the customer respond to data subject requests, as far as reasonably possible;
- help the customer with security, breach notification, data protection impact assessments and ICO consultation, taking into account the information available to us;
- notify the customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting the customer's data, with the information we have;
- at the end of the service, let the customer export its data for 30 days, then delete it within 90 days (backups roll off within a further 30 days), unless UK law requires us to keep it;
- make available the information needed to show compliance with this agreement, and allow reasonable audits (normally by written questionnaire, at most once a year, with reasonable notice).
3. International transfers
Where personal data is transferred outside the UK, we make sure it's covered by UK adequacy regulations, the UK International Data Transfer Agreement, or standard contractual clauses with the UK addendum.
4. Security measures
- Encryption in transit (HTTPS) and at rest by our hosting provider
- Each customer's data separated by account; access checked on every request
- Office passwords stored using salted key stretching (PBKDF2); worker sign-in by one-time text codes or device passkeys, with rate limits
- Uploaded files served safely and only to people with access to that job
- Signed records protected from editing; changes logged with who, when and why
- Weekly copies of records emailed to the customer, so the customer always holds its own copy
5. Sub-processors
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, security | Global network (incl. US) | UK IDTA / EU SCCs + UK addendum |
| Twilio Inc. | Sending text message sign-in codes | US | UK IDTA / EU SCCs + UK addendum |
| Stripe Payments Europe Ltd / Stripe, Inc. | Billing and payments (customer firm details only) | EU / US | UK IDTA / EU SCCs + UK addendum |
| Resend (Plus Five Five, Inc.) | Sending emails: invites, password resets, weekly records, alerts | US | UK IDTA / EU SCCs + UK addendum |
| Google LLC (Google Fonts) | Web fonts on office pages (sees the visitor’s IP address) | US | UK–US data bridge |
6. Customer obligations
The customer confirms it has a lawful basis for the processing, gives its workers and visitors appropriate privacy information, and only instructs JobGate to process data lawfully.
7. Liability
The liability limits in the terms of service apply to this agreement.