Data processing agreement
This agreement forms part of the Joinery OS terms of service between your business (the "customer") and Boatswain Joinery Limited, a company registered in England and Wales (company number 16081479), of Florida Terrace, Midsomer Norton, Radstock, BA3 2AE, trading as Joinery OS ("Joinery OS"). It applies to personal data the customer puts into Joinery OS, and meets the requirements of Article 28 of the UK GDPR.
1. Roles
The customer is the controller of the personal data it puts into Joinery OS. Joinery OS is the processor and processes that data only on the customer's behalf.
2. Details of the processing
| Subject matter | Providing the Joinery OS software service |
|---|---|
| Duration | While the customer's account is open, plus the deletion period in section 9 |
| Nature and purpose | Storing, organising, displaying, backing up and transmitting data so the customer can produce quotes, drawings and job documents and manage customers and jobs |
| Types of personal data | Names, postal and installation addresses, phone numbers, email addresses, notes, photos and job details the customer enters; names, emails and roles of the customer's own staff |
| Data subjects | The customer's own customers and contacts, and the customer's staff who use Joinery OS |
Joinery OS is not designed for special category data (such as health information). The customer should not enter it.
3. Joinery OS's obligations
Joinery OS will:
- process the personal data only on the customer's documented instructions, which are these terms and the customer's use of Joinery OS, unless the law requires otherwise (in which case it will tell the customer first, unless the law forbids that);
- make sure anyone authorised to process the data is bound by confidentiality;
- take appropriate technical and organisational security measures (section 5);
- only use sub-processors under section 6;
- help the customer, as far as reasonably possible, to respond to requests from people exercising their data protection rights. Much of this the customer can do directly in Joinery OS, including downloading and deleting records;
- help the customer meet its obligations on security, breach notification, data protection impact assessments and consulting the ICO, taking into account the nature of the processing;
- delete or return the personal data at the end of the service (section 9);
- make available the information needed to show it meets this agreement, and allow and contribute to reasonable audits, at the customer's cost, with reasonable notice and no more than once a year unless there has been a breach;
- tell the customer straight away if it believes an instruction breaks data protection law.
4. The customer's obligations
The customer confirms it has a lawful basis for the personal data it puts into Joinery OS, has given people any privacy information the law requires, and will only give lawful instructions.
5. Security
- Data is encrypted in transit (HTTPS/TLS) and stored encrypted at rest by our database provider.
- Each customer's data is kept separate by row-level security rules in the database. Users only see the companies they belong to, and what their role allows.
- Passwords are stored only in hashed form. Password resets go by email.
- Access to the database by Joinery OS staff is limited to what is needed to run and support the service.
- The database is backed up regularly.
6. Sub-processors
The customer gives general authorisation for Joinery OS to use sub-processors. Those in use now are:
| Sub-processor | Service | Location |
|---|---|---|
| Supabase Inc. | Database, sign-in and backups | London, UK (Amazon Web Services eu-west-2) |
| Cloudflare, Inc. | Website delivery and security | Worldwide network |
| Email delivery provider | Account emails (sign-up, invitations, password resets) | To be confirmed |
Joinery OS will give the customer at least 30 days' notice by email before adding or replacing a sub-processor, so the customer can object. If the objection can't be resolved, the customer can close its account. Joinery OS puts data protection terms in place with each sub-processor that are at least as protective as this agreement, and remains responsible for them.
7. Transfers outside the UK
Customer data is stored in the UK. Where a sub-processor accesses it from outside the UK, Joinery OS makes sure there is a lawful transfer mechanism in place, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
8. Personal data breaches
Joinery OS will tell the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the customer's data. It will give the information it has to help the customer meet its own obligations, and take reasonable steps to contain the breach.
9. End of the service
The customer can download its data at any time. After the account closes, the data can still be downloaded for 90 days. It is then deleted, and backups are overwritten within a further 30 days, unless the law requires Joinery OS to keep it.
10. General
If this agreement conflicts with the terms of service on data protection, this agreement wins. The liability limits in the terms of service apply to this agreement. It is governed by the law of England and Wales.