Data Processing Agreement

Version 1.1 · Last updated: 15 October 2026

When you use Fire Suite to manage your staff, you decide what happens to their personal data and we act on your instructions. This document is the agreement that says so, and sets out what we are obliged to do. It is required by Article 28 of the UK GDPR, and it forms part of our Terms of Service.

1. Who is who

This agreement is between SafeerTec Ltd, a company registered in England & Wales ("we", "us", "the Processor"), and the business that holds a Fire Suite account ("you", "the Customer", "the Controller").

For personal data about your staff — their hours, pay, documents and so on — you are the controller and we are your processor. You decide what is collected and why; we act on your instructions.

For personal data about your own account — the name and email of whoever signs up, and your billing records — we are the controller, because we decide to keep those in order to run our business. Our Privacy Policy covers that part.

2. How this agreement comes into force

It is incorporated into the Terms of Service. By creating a Fire Suite account you accept it, and no signature is needed. If your organisation requires a signed counterpart, email info@safeertec.com and we will sign one.

It lasts as long as your account does, plus any period in which we still hold your data under clause 9.

3. What we are instructed to do

We process personal data only on your documented instructions. Your instructions are: this agreement, the Terms of Service, and the ordinary use you make of the product's features. We will not process your staff's personal data for any other purpose.

In particular, and so it is written down rather than assumed:

• We do not sell personal data, share it with advertisers, or disclose it to anyone except the sub-processors in Annex 3.
• We do not use your staff's personal data to train machine-learning models, our own or anyone else's.
• We do not use your data to build products for other customers, or combine it with another customer's data.
• If we believe an instruction from you breaches data protection law, we will tell you and may pause that processing rather than carry it out.

If we are ever required by law to process your data differently — by a court order, for example — we will tell you before doing so unless the law forbids us from telling you.

4. Details of the processing

The subject matter, duration, nature, purpose, types of personal data and categories of data subject are set out in Annex 1, as Article 28(3) requires.

5. Confidentiality

Everyone we allow to access your data is bound to keep it confidential. Today that is a small, named group of people within SafeerTec Ltd, and access is limited to those who need it to support you or to keep the service running.

6. Security

We take the technical and organisational measures required by Article 32. The measures actually in place are listed in Annex 2, which describes what we do rather than what is typical — so you can judge it, and so you can see where the limits are.

7. Sub-processors

You give us general authorisation to use the sub-processors listed in Annex 3. Each is bound by terms that are no less protective than these, and we remain responsible to you for what they do.

If we intend to add or replace one, we will give you at least 30 days' notice by email to your account's registered address. If you reasonably object on data protection grounds within that period, we will work with you to find an alternative; if we cannot, you may terminate the affected part of the service and we will refund any fees covering the period after termination.

8. Your obligations, and helping you with yours

You are responsible for having a lawful basis for the data you put into Fire Suite, for telling your staff what you are doing with it, and for the accuracy of what you enter.

We will help you meet yours, taking into account the nature of the processing and the information available to us:

• Data subject requests. Fire Suite lets you read, correct, export and delete your staff's records yourself, which is usually the fastest route. If a member of your staff contacts us directly, we will not answer them on your behalf — we will forward it to you without undue delay.
• Security and breach. See clause 10.
• Impact assessments and prior consultation. We will give you the information you reasonably need. Annex 1 and Annex 2 are written to be usable in a DPIA without having to ask us.

9. Deletion and return

On request at any time, and in any case when your account ends, we will delete your personal data or return it to you, at your choice.

• Export. You can export your data from the product at any time while your account is open. Ask us and we will produce a complete copy in a structured, machine-readable format.
• Deletion. We will delete your data within 30 days of your request, or of your account ending, and confirm in writing when it is done.
• Documents under a write-protection rule. Payslips and staff documents, and right-to-work and certification scans, are held in storage that refuses deletion — for six years and two years from upload respectively. That rule exists because the storage has no version history, so an accidental or malicious deletion of a payslip would be permanent and silent. It is the reason those files are safe, and it is also a limit on erasing them: the rule has to be lifted by hand before those particular documents can go. We will do that as part of your 30 days, and the deletion is reported to us if it is refused — but it is a manual step, so tell us explicitly if an erasure request covers them.
• Backups, honestly. Database snapshots age out on their own: the most recent 30 are kept, and the server's own dumps are kept 14 days, so deleted records leave those within a month. The file backups are different and you should know it. The copies of uploaded documents are append-only by deliberate design — they copy, they never mirror a deletion — so that one bad command cannot destroy all three copies at once. The consequence is that a deleted file persists in those copies and is not aged out on a timetable. We do not restore from a backup except to recover the service from a failure, and anything restored that you had asked us to delete is deleted again.
• We keep data for longer only where the law requires it — billing records for tax purposes, for example — and in that case we keep only what the law requires and stop processing it for any other purpose.

We would rather write the paragraph above than the shorter one that says everything disappears in thirty days. Both the write-protection rule and the append-only backups are there to stop your records being destroyed, and a contract that promised instant erasure would be promising to weaken them. If that trade-off does not suit your organisation, tell us before you sign rather than after.

10. Personal data breaches

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and in any event within 48 hours, by email to your account's registered address and by telephone if we hold a number for you.

You have 72 hours to decide whether to tell the ICO, so our notification is meant to leave you time to decide rather than to be the last word. It will describe what happened, which data and roughly how many people are affected, what we think the consequences are, and what we are doing about it. Where we do not yet know something, we will say so and follow up rather than delay the first notification.

We will not notify your staff or any regulator on your behalf unless you ask us to in writing — that is the controller's decision, not ours.

11. Audit and information

We will make available the information you reasonably need to show that we are meeting these obligations, and will respond to a reasonable written due-diligence questionnaire within 30 days.

You may audit us, or appoint an independent auditor to do so, once in any 12-month period on 30 days' written notice, and additionally after a breach affecting your data. Audits take place in business hours, must not unreasonably disrupt the service, and the auditor must be bound by confidentiality and must not be a competitor of ours. We do not hold ISO 27001, SOC 2 or any equivalent certification, and we would rather say so here than let a certification logo answer the question for us.

12. International transfers

Your data is stored and processed in Germany and, for backups, in the European Union. Transfers from the UK to the EEA are permitted under the UK's adequacy regulations.

Two sub-processors in Annex 3 are United States companies, identified as such in the table together with exactly what each one receives. Where a transfer to a country without UK adequacy is involved, it is made under the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism, together with the additional safeguards noted in Annex 3.

13. Liability and precedence

The limitations and exclusions of liability in the Terms of Service apply to this agreement, and the total liability of either party under both taken together does not exceed the cap stated there.

If this agreement and the Terms of Service conflict on anything to do with the processing of personal data, this agreement wins.

14. Governing law

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. "UK GDPR", "controller", "processor", "personal data", "personal data breach" and "processing" have the meanings given in the UK GDPR and the Data Protection Act 2018.

15. Changes

We may update this agreement where the law changes or the service does. We will give you at least 30 days' notice of any change that materially reduces your protection, by email to your account's registered address. The version and date at the top of this page tell you which version you are reading.

Annex 1 — Details of the processing

Subject matter and duration

Providing the Fire Suite applications to you, for as long as you hold an account, plus the deletion periods in clause 9.

Nature and purpose

Hosting, storing, organising, displaying, analysing and backing up the records you create, so that you can run staff rotas, record attendance, calculate pay, keep right-to-work and certification records, manage stock and suppliers, reconcile money, and run screens in your premises.

Categories of data subject

• Your employees and workers.
• People who apply to work for you and register through a staff invitation.
• Your own managers and administrators who hold a login.

Types of personal data

Special category data. Fire Suite has no field for health, biometric, racial or ethnic, religious, political or trade-union data, and we ask you not to put any in. A right-to-work document can nevertheless reveal nationality or immigration status, so those documents are treated as the most sensitive thing in the system: they are stored with a two-year deletion lock against accidental loss, and they are never shown on any public page or screen.

Annex 2 — Technical and organisational measures

What is actually in place as at 15 October 2026. Where there is a limit, it is stated rather than left out.

Access control

• Passwords are stored hashed with bcrypt and are never recoverable in plain text, by us or anyone else.
• Two-factor authentication by emailed code for dashboard accounts that have a deliverable email address.
• Permissions are per person and per screen, so a team leader can build a rota without seeing pay.
• Access to a customer's data is restricted to the organisation that owns it, enforced on every request rather than in the user interface.
• An append-only audit log records who changed what in the dashboard.

Encryption

• In transit: HTTPS/TLS everywhere, with certificates renewed automatically.
• The off-site backup copy is encrypted before it leaves our server, so the company storing it cannot read it. ⚠️ To be precise rather than flattering: that applies to the off-site copy. The primary object storage and the server's own mirror are encrypted at rest by the provider and by the disk, not by a key only we hold, so not every copy is opaque to the company hosting it.
• Uploaded documents are served through short-lived signed links rather than public URLs.

Resilience and backups

• Four independent backup layers: a nightly database snapshot, a nightly database dump, a mirror of uploaded documents, and an encrypted off-site copy held in the EU.
• Restoration has been tested from the off-site copy, not merely assumed.
• Right-to-work and certification documents carry a two-year deletion lock, so they cannot be removed by accident or by a mistaken instruction.
• A documented disaster-recovery procedure, rehearsed end to end, with a measured time to restore service of approximately ten minutes.
• Automated monitoring alerts us when a backup job stops running — the absence of a failure is not treated as success.

Organisational

• Changes are reviewed and covered by an automated test suite that must pass before release.
• Releases are health-checked and roll back automatically if the service does not come up.
• Errors are reported to a monitoring system so that faults are noticed rather than reported by you.

What we do not have. We hold no ISO 27001, SOC 2 or Cyber Essentials certification. We are a small company and there is no 24-hour staffed operations desk. We would rather you knew that before signing than after an incident.

Annex 3 — Sub-processors

Everyone other than us who may handle your data, what they do, and where they are. This list is current as at 15 October 2026; clause 7 governs changes.

On the document scanner. It is the one place your staff's most sensitive documents leave our own servers, so it gets its own paragraph rather than a row in a table. A document is sent only at the moment somebody scans it, only to extract dates, and Anthropic's API terms provide that inputs submitted through it are not used to train their models. If you would rather your documents were never sent to it, tell us and we will turn the feature off for your account — your managers then type the expiry dates in by hand, and nothing else changes.

Contact

Questions about this agreement, a data subject request, a due-diligence questionnaire or a signed counterpart: info@safeertec.com.

You can also complain to the UK Information Commissioner's Office at ico.org.uk.