Data Processing Addendum

1. Subject matter and duration

JobTek processes personal data during the agreement to provide, secure, support and improve the configured JobTek Services. Processing continues for the limited period afterwards needed to return, delete, back up or lawfully retain information, as described in section 10 and Annex A.

2. Roles and instructions

• The customer is the controller and JobTek is its processor for customer-controlled personal data.
• The agreement, this DPA, the customer's configuration and actions taken by people using the customer's account are documented instructions.
• JobTek will process personal data only on those instructions unless UK law requires otherwise. Where permitted, JobTek will tell the customer before carrying out a legally required instruction.
• JobTek will inform the customer if it reasonably believes an instruction infringes applicable data-protection law.

3. Customer responsibilities

The customer must ensure its instructions are lawful, give required privacy information, identify a lawful basis, apply appropriate retention settings and obtain any permission needed to supply data to JobTek or a linked provider. The customer is responsible for responding to data-subject requests unless JobTek's assistance is needed.

4. Confidentiality and personnel

JobTek limits customer-data access to staff who need it for their role and who are subject to confidentiality obligations. JobTek maintains onboarding, access-review, training and offboarding processes appropriate to those responsibilities.

5. Security

JobTek implements the technical and organisational measures in Annex C, taking account of the state of the art, implementation cost, processing scope and risks to people. The Security & Compliance Statement provides additional current operational information without reducing this DPA.

6. Subprocessors

• The customer gives general authorisation for the core sub-processors listed in Annex B and replacements needed to provide the JobTek Services.
• JobTek places materially equivalent data-protection obligations on a sub-processor and remains responsible for its performance to the extent required by law.
• JobTek will announce a material new subprocessor through the JobTek Services, website or account email. The customer may object on reasonable data-protection grounds within 10 days. The parties will work in good faith to find a practical resolution. If none is available, either party may terminate the affected service.

7. Optional customer-directed connections

Payment, accounting, Meta, identity and similar connections enabled by a customer are processing instructions. Some providers act as independent controllers or under a direct agreement with the customer rather than as JobTek subprocessors. JobTek will exchange only the information needed for the enabled connection and will stop scheduled access after the connection is removed, subject to queued operations and provider behaviour.

8. Assistance

Taking account of the processing and information available to it, JobTek will provide reasonable assistance with data-subject rights, security, breach notifications, data-protection impact assessments and prior consultation obligations under Articles 32 to 36 UK GDPR. JobTek may charge reasonable costs for unusually extensive assistance not caused by its breach.

9. Personal data breaches

JobTek will notify the customer without undue delay and, in any event, within 48 hours after becoming aware of a personal-data breach affecting customer-controlled data. JobTek will provide available information about the nature, likely consequences, affected data and people, and containment or remedial measures. It will add further information as the investigation progresses.

10. Return, deletion and legal holds

During an active subscription, customers may use available export functions. After termination, the customer may request a reasonable opportunity to export or receive customer data before production deletion. JobTek will delete remaining customer data from active systems within a commercially reasonable period. Encrypted backup copies will expire through normal backup cycles unless law, a legal hold or security investigation requires longer retention. Any retained copy remains protected and is not used for another purpose.

11. Audits and information

JobTek will provide information reasonably needed to demonstrate compliance. A customer may arrange no more than one audit in any 12-month period, unless a breach or regulator requires otherwise. The audit must be carried out by an independent auditor, on at least 30 days' notice and during normal business hours. It must remain confidential, avoid access to another customer's data and not cause unreasonable disruption. Current certifications or independent reports may satisfy all or part of a request.

12. International transfers

JobTek will not make a restricted transfer of customer personal data without an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another lawful safeguard. Annexes A to C supply the processing details required by those mechanisms where applicable.

13. Liability, priority and law

Liability is governed by the agreement except where law requires otherwise. If documents conflict, an applicable transfer mechanism prevails, followed by this DPA and then the agreement. This DPA is governed by the laws of England and Wales and the courts of England and Wales have exclusive jurisdiction.

Annex A — Processing details

• Nature and purpose: hosting and operating enquiries, messages, customers, contacts, quotes, jobs, bookings, resources, forms, portals, documents, signatures, invoices, payment records, reporting, notifications, support and integrations enabled by the customer.
• Operations: collection, recording, organisation, storage, adaptation, retrieval, consultation, use, analysis, transmission, restriction, export, erasure and destruction.
• Data subjects: customer users and workers; the customer's prospects, customers, suppliers and contacts; message senders and recipients; payers; portal users; form submitters; and other people whose data the customer places in JobTek.
• Personal data: identity and contact information; account roles and activity; messages and attachments; addresses and location; vehicle information; job, booking and service history; quotes, invoices, payment and accounting records; portal and form activity; technical identifiers, audit data and support records.
• Sensitive data: not required by JobTek, but may be included by the customer in free text, messages or attachments. The customer must minimise such data and identify an Article 9 condition where special-category data is processed.
• Frequency and duration: continuous or on demand according to customer use, for the agreement term and the limited return, deletion, backup or legal-hold period described in this DPA.

Annex B — Service providers and subprocessors

These providers support the platform capabilities shown. Providers for optional features process data only when the customer enables or uses that feature. Processing locations may include the UK, EEA, United States and other provider support locations, subject to section 12.

Annex B.1 — Customer-enabled connections

These providers receive data only when you enable or use the relevant integration. Their role may be independent controller, your direct processor or JobTek subprocessor depending on the service and provider terms.

Annex C — Technical and organisational measures

• Identity and access: role-based access, least privilege, strong authentication, administrative multi-factor authentication, access review and controlled privileged operations.
• Data protection: TLS for data in transit, managed encryption at rest where applicable, protected secrets and managed data-protection keys.
• Application and infrastructure: secure development, review, dependency management, vulnerability remediation, network controls, environment separation, monitoring and controlled releases.
• Resilience: backups, restoration testing, service monitoring, incident response and continuity procedures.
• Governance: confidentiality, staff training, supplier due diligence, data minimisation, retention review and documented security and breach processes.

Contact

Email: info@jobtek.com

Security: security@jobtek.com

Post: JobTek Ltd, 61 Bridge Street, Kington, Herefordshire, HR5 3DJ, United Kingdom.

For related information, see the Privacy Policy, Acceptable Use Policy, Security & Compliance Statement and Terms & Conditions.