Book a demo

Data Processing Agreement

Version 1.0, effective 1 November 2026. Part of the Terms of Service.

1. Parties and roles

1.1 Controller: the Customer that accepted the Terms of Service. Processor: KFBASE LTD, company number 17554532, 5 Hereward Close, Impington CB24 9NH, United Kingdom.

1.2 The Processor’s representative in the European Union under Article 27 GDPR: Michal Kolakowski, Dzielin 7, 06-415 Czernice Borowe, Poland, gdpr-representative@kfbase.com.

1.3 This Agreement governs the processing of personal data in the Customer Data (as defined in the Terms) under Article 28 of the GDPR (Regulation (EU) 2016/679) and of the UK GDPR, together the Data Protection Law.

2. Subject matter, duration, nature and purpose

2.1 Subject matter and purpose: providing the Service described in the Terms — planning and recording field work, communication, hours and absences, project finances, quotes and invoices.

2.2 Nature: storage, organisation, display, transmission (including to the Customer’s invoicing provider on its instruction), backup and deletion.

2.3 Duration: for as long as the Terms apply, and until the data is deleted under section 10.

2.4 Categories of data subjects: the Customer’s owners, office staff and workers; the Customer’s clients and their contact persons; other people the Customer records (for example subcontractors).

2.5 Types of personal data:

3. Processor’s obligations

The Processor shall:

3.1 process the data only on the Customer’s documented instructions — the Terms, this Agreement and the Customer’s use of the Service’s features — unless the law requires otherwise (in which case it informs the Customer first, unless the law forbids it); and tell the Customer if it believes an instruction breaches Data Protection Law;

3.2 ensure that people authorised to process the data are bound by confidentiality;

3.3 implement the technical and organisational measures in Annex 2;

3.4 engage sub-processors only as in section 4;

3.5 assist the Customer, as far as possible and taking into account the nature of the processing, with requests from data subjects (access, rectification, erasure, portability…), mainly through the Service’s own functions (viewing, exporting, editing records, removing people, and erasing removed people and archived clients — their names are replaced and contact details removed; content in the task log that still identifies them, such as text, photos or voice notes, is deleted or redacted by the Processor on the Customer’s instruction), and with the Customer’s obligations under Articles 32 to 36 GDPR / UK GDPR: security of processing, notification of personal data breaches to the supervisory authority and to data subjects, data protection impact assessments and prior consultation with the supervisory authority. Where an instruction to erase conflicts with a retention obligation (for example employment records the Customer must keep), the Processor tells the Customer, and deletes or pseudonymises only what the Customer confirms may go;

3.6 notify the Customer of a personal data breach without undue delay and in any case within 48 hours of becoming aware of it, with the information available, and assist with the Customer’s own notifications;

3.7 make available the information needed to demonstrate compliance and allow audits under section 8;

3.8 not use the Customer Data for its own purposes, sell it, or combine it with other customers’ data.

4. Sub-processors

4.1 The Customer gives general authorisation for the sub-processors in Annex 1.

4.2 The Processor informs the Customer of any intended addition or replacement at least 30 days in advance (by e-mail and in the Service). The Customer may object on reasonable data protection grounds; if the parties cannot resolve it, the Customer may terminate the Terms and receive a pro-rata refund of prepaid fees.

4.3 The Processor imposes the same data protection obligations on each sub-processor by contract and remains liable for them.

4.4 The Customer’s own invoicing provider (Fakturownia, Xero) is not a sub-processor: the Customer contracts with it directly and instructs the transfer by connecting its account.

5. Support access

The Processor’s authorised staff may view the Customer’s business in a read-only mode only to investigate a problem the Customer reported or to keep the Service secure. Such access is time limited (one hour per session), recorded in an audit log, and cannot change any data.

6. Location of data and transfers

6.1 The Customer Data is stored in the European Union (server: Hetzner, Germany; files and backups: Cloudflare R2 with EU jurisdiction).

6.2 Transfers to sub-processors outside the UK/EEA (Annex 1) take place: for data subject to the EU GDPR, under the EU–US Data Privacy Framework where the recipient is certified, and otherwise under the European Commission’s standard contractual clauses (Decision (EU) 2021/914, module three: processor to processor); for data subject to the UK GDPR, under the UK Extension to the Data Privacy Framework where the recipient has joined it, and otherwise under the UK International Data Transfer Agreement or the UK Addendum to those clauses.

6.3 Transfers to the Processor (EU → UK). The Processor is established in the United Kingdom. Personal data subject to the EU GDPR is transferred to it under the European Commission’s adequacy decision for the United Kingdom (renewed on 19 December 2025, applicable until 27 December 2031), for as long as that decision applies.

6.4 Fallback: standard contractual clauses. If that adequacy decision ceases to apply, or is suspended or invalidated, without a new one taking its place, transfers from the Customer (as data exporter) to the Processor (as data importer) are from that moment governed by the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914), module two (controller to processor), completed as set out in Annex 3 and incorporated into this Agreement by reference; by accepting the Terms both parties agree to be bound by them from that moment, and this acceptance constitutes signature of the clauses. The full, official text of the clauses is published by the European Union at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj (module two applies, with the choices in Annex 3). If they conflict with this Agreement, the clauses prevail. The fallback covers the transfers to the Processor only; onward transfers to sub-processors remain governed by clause 6.2 and Annex 1.

7. Customer’s obligations

The Customer is responsible for the lawfulness of the processing it instructs, including a legal basis for each category of data — for health data in sick-leave absences, the Article 9 condition and national law that apply to it (clause 2.5); for location at work events, its legitimate interest or employment law — and for informing its workers and clients as Data Protection Law and employment law require, including the rules on monitoring of employees (in Poland, Kodeks pracy art. 22³).

Turning on location at work (Settings, or when connecting a phone) is the Customer’s documented instruction to process location data; the person who turns it on confirms the statements shown and the Processor keeps the record (who, when, which version). The confirmation records the Customer’s decision; it does not make the processing lawful, which remains the Customer’s responsibility. Turning it off withdraws the instruction for new entries.

The Customer indemnifies the Processor as set out in clause 9A of the Terms (up to the limit in 9A.4, for customer-caused claims, losses and costs, including processing instructed without a legal basis or without informing the people concerned). The Processor’s liability under this Agreement is limited as set out in clause 9 of the Terms.

8. Audits

The Processor answers reasonable written questions about its compliance and provides relevant documentation. On-site audits are possible once a year with 30 days’ notice, during working hours, at the Customer’s cost, by an auditor bound by confidentiality, unless a breach or a supervisory authority requires otherwise.

9. Liability

Liability under this Agreement follows the Terms of Service, except where Data Protection Law does not allow it to be limited.

10. End of processing

10.1 The Customer can export its data at any time, free of charge (Terms 4.4); switching to another service, the transitional and retrieval periods follow Terms 10A (EU Data Act).

10.2 Return or deletion. At the end of the services the Customer chooses: to have its data returned (the export in Terms 4.4, available until the end of the retrieval period) or deleted. The sequence is: closing the business; a retrieval period of 30 days in which it can be restored and exported (Terms 4.5, 10A.6); then deletion of the Customer Data from the Service; then its disappearance from backups within a further 30 days. Data is kept longer only where Union, Member State or UK law requires it. On request the Processor confirms the deletion in writing.

11. Law

This Agreement and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, on the same terms as section 12 of the Terms of Service.

Annex 1 – Sub-processors

The current list is kept in the sub-processor register and published with this Agreement; changes are notified under section 4.2.

Sub-processor Service Data Location
Hetzner Online GmbH Server hosting the Service and the database all Customer Data EU (Germany)
Cloudflare, Inc. Encrypted connection (Tunnel/HTTPS); R2 storage of files and database backups; e-mail routing for @kfbase.com addresses all Customer Data (in transit; files and backups at rest in the EU); e-mails sent to us EU storage, global network
Expo (650 Industries, Inc.) Delivery of push notifications notification text (e.g. task title, sender name), device token US
Google LLC (Firebase Cloud Messaging) Push notifications to Android phones notification text, device token US / global
Apple Inc. (Push Notification service) Push notifications to iPhones notification text, device token US / global
GitHub, Inc. Problem reports sent from the app (private repository) report text and app diagnostics, with record ids only (no name, e-mail or company name) US
Google LLC (Google Workspace) Our business e-mail and documents (support requests and correspondence with customers) Customer Data that customers or their people send us, e.g. in support requests US / global

Stripe (payments), and Google or Apple sign-in, process data of the Customer’s account holders for the Processor’s own purposes (see the Privacy Policy), not Customer Data.

Annex 2 – Technical and organisational measures

Annex 3 – Standard contractual clauses (fallback under clause 6.4)

Module two (controller to processor) of the clauses in Implementing Decision (EU) 2021/914 applies with these choices:

Annex I to the clauses. A. Parties: data exporter — the Customer: its name, registered address, country and tax number as recorded in the Service (Settings → Business, filled from its billing details at Stripe while empty), contact: its owner’s e-mail in the Service; role controller; data importer — KFBASE LTD (clause 1.1, contact office@kfbase.com), role processor; both sign by accepting the Terms. B. Description of the transfer: as in section 2 of this Agreement (categories of data subjects and personal data, special categories — absences including sick leave — with the safeguards in Annex 2; continuous transfers for the duration of the Terms; nature and purpose of processing; retention as in section 10; sub-processors as in Annex 1). C. Competent supervisory authority: the authority of the Customer’s Member State, as under clause 13 above.

Annex II to the clauses. The technical and organisational measures in Annex 2 of this Agreement.

Annex III to the clauses. The sub-processors in Annex 1 of this Agreement.