Data Processing Agreement

Background and parties

This Data Processing Agreement ("DPA") is entered into between you, the customer of the Round Monster platform (the "Controller"), and Round Monster (the "Processor", "we", "us"). It supplements and forms part of our Terms of Service. By creating a Round Monster account and accepting our Terms of Service, the Controller is also entering into this DPA. Acceptance is recorded electronically (date, IP address, user-agent and Controller account) and that record is the parties' written DPA for the purposes of UK GDPR Article 28(9).

1. Definitions

"UK GDPR", "controller", "processor", "data subject", "personal data", "processing", "personal data breach" and "supervisory authority" have the meanings given to them in the UK General Data Protection Regulation as it forms part of the law of England and Wales by virtue of section 3 of the European Union (Withdrawal) Act 2018, and the Data Protection Act 2018 (together, "UK Data Protection Laws"). "Customer Data" means any personal data the Controller (or a person authorised by the Controller) submits to or processes through the Round Monster platform. "Sub-processor" means any third party engaged by the Processor to process Customer Data on the Processor's behalf.

2. Subject-matter, duration, nature and purpose of processing

• Subject-matter: the provision of the Round Monster software-as-a-service business management platform to the Controller.
• Duration: for as long as the Controller has a Round Monster account, plus the post-termination retention period in clause 11.
• Nature and purpose: hosting and processing the Controller's business and customer records to deliver the platform features the Controller has chosen to use, including (without limitation) client management, scheduling, route planning, invoicing, payment collection, SMS and email delivery, financial reporting and accounting integrations.

3. Types of personal data and categories of data subjects

The Processor will process the categories of personal data that the Controller chooses to enter into the platform, which typically include:

• Identity and contact data (name, address, email, phone number)
• Service-history data (jobs booked, completed, frequencies, notes, photos taken on site)
• Billing and payment data (invoices, payment status, partial bank-account identifiers passed through to GoCardless / Stripe)
• Worker / employee data (name, contact details, role, working hours, performance notes)
• Communications metadata (SMS / email logs, delivery status, opens, replies)
• Authentication metadata (login times, IP addresses, user-agent, audit logs)

The categories of data subjects include the Controller's end customers, the Controller's prospects/leads, the Controller's employees and contractors (workers), and the Controller's own personnel who use the platform. The Processor does not require, and the Controller agrees not to upload, special-category personal data (UK GDPR Art. 9), criminal-offence data (Art. 10), or payment-card data within the scope of PCI-DSS unless and until the Processor explicitly supports such processing in writing.

4. The Controller's documented instructions

The Processor will process Customer Data only on the Controller's documented instructions, including with regard to international transfers, except where required to do otherwise by UK or EU law (in which case the Processor will, where legally permitted, inform the Controller of that legal requirement before processing). The Controller's documented instructions are: (a) this DPA; (b) the Terms of Service; (c) the configuration choices the Controller makes within the platform (e.g. which integrations to enable, which reminders to send); and (d) any further written instructions the Controller gives the Processor through support channels and that the Processor expressly accepts. The Processor will inform the Controller without undue delay if, in its opinion, an instruction infringes UK Data Protection Laws.

5. Confidentiality of personnel

The Processor will ensure that any personnel authorised to process Customer Data are bound by appropriate written contractual or statutory obligations of confidentiality, are subject to user-access controls following the principle of least privilege, and have received training proportionate to their role on the protection of personal data.

6. Security of processing (Art. 32)

Taking into account the state of the art, costs of implementation, and the nature, scope, context and purposes of processing as well as the risk to data subjects, the Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption of Customer Data in transit (TLS 1.2+ on all endpoints).
• Encryption of Customer Data at rest in the production database and storage buckets.
• Multi-tenant isolation enforced at the database layer through row-level security policies and JWT-bound tenant identifiers.
• Role-based access controls within the platform, with separate roles for owner, manager, office and worker, and a least-privilege admin model for Processor staff.
• Strong-password requirements for all accounts and breach-corpus checks against Have I Been Pwned to reject reused/compromised passwords.
• Audit logging of administrative and security-sensitive actions.
• Daily automated backups of the production database, retained for the period set out in our Sub-processors page.
• Documented incident-response procedures and a tested process for restoring availability and access to Customer Data in a timely manner after a physical or technical incident.
• Regular review and, where appropriate, updating of the above measures.

The Processor may update or improve these measures from time to time provided that any change does not materially reduce the overall level of security.

7. Sub-processors

The Controller gives the Processor general written authorisation to engage sub-processors to assist in providing the platform. The current list of sub-processors, the categories of data each one processes and the country in which it processes them is published at /sub-processors and forms part of this DPA. Before adding or replacing a sub-processor, the Processor will give the Controller at least 30 days' prior notice (by email to the account owner and / or through an in-platform announcement). The Controller may object on reasonable data-protection grounds within that 30-day window, in which case the Processor will work with the Controller in good faith to resolve the objection, failing which the Controller may terminate the affected services. The Processor will impose, by written contract, data-protection obligations on every sub-processor that are no less protective than those in this DPA, and will remain fully liable to the Controller for the performance of each sub-processor's obligations.

8. International transfers

The Processor will not transfer Customer Data outside the United Kingdom or the European Economic Area unless an appropriate transfer mechanism is in place — for example the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision applicable to the destination country. The current location of each sub-processor is shown on the /sub-processors page.

9. Assistance with data-subject rights

Taking into account the nature of the processing, the Processor will assist the Controller by appropriate technical and organisational measures, insofar as this is possible, to fulfil its obligation to respond to requests from data subjects exercising their rights under UK GDPR (access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making). The platform exposes self-service tools for the Controller to access, export, correct and delete data about its end customers and workers. Where a data-subject request requires Processor assistance beyond those tools, the Controller may contact the Processor at dpo@roundmonster.uk and the Processor will respond without undue delay and in any event within the timeframe required by UK Data Protection Laws.

10. Personal-data breach notification and DPIA assistance

The Processor will notify the Controller without undue delay, and in any event within 72 hours after becoming aware of a personal-data breach affecting Customer Data. The notification will, to the extent then known, describe the nature of the breach (categories and approximate numbers of data subjects and records concerned), the likely consequences, the measures taken or proposed to address it, and a contact point for further information. The Processor will provide the Controller with reasonable assistance in meeting its own breach-notification obligations to the supervisory authority and (where required) to data subjects. The Processor will, on request, also provide reasonable assistance to the Controller with data-protection impact assessments and prior consultations under UK GDPR Articles 35 and 36, taking into account the nature of the processing and the information available to the Processor.

11. Return or deletion of Customer Data

On termination of the Controller's account (for whatever reason), the Processor will, at the Controller's choice, delete or return all Customer Data, and delete existing copies, subject to a retention window of 30 days during which the Controller may export its data through the platform's data-export tools. After that retention window the Processor will permanently and irreversibly delete Customer Data from active systems within a further 30 days. Backups containing Customer Data will be deleted in line with the Processor's rolling backup-rotation schedule (no longer than 90 days). The Processor may retain Customer Data, or a subset of it, beyond these timeframes only to the extent strictly required by UK or EU law (for example, financial / tax record-keeping obligations under the Companies Act 2006 and the Value Added Tax Act 1994). Any such retained data will continue to be protected by the security measures in clause 6 and will not be processed for any other purpose.

12. Audit and inspection rights

The Processor will make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and UK GDPR Art. 28, and will allow for and contribute to audits, including inspections, conducted by the Controller (or another auditor mandated by the Controller). To minimise the burden on both parties and to protect the security of Customer Data of all customers, audits will normally be satisfied by the Processor providing, on written request and not more than once in any 12-month period (except where required by a supervisory authority or following a confirmed personal-data breach affecting the Controller): (a) the most recent third-party security assessment or penetration-test summary; (b) responses to a reasonable industry-standard vendor security questionnaire; and (c) a description of the technical and organisational measures then in place. If those materials do not give the Controller a reasonable basis for assessing compliance, the Controller may request an on-site or remote audit on at least 30 days' written notice, during normal business hours, conducted by a mutually-agreed independent auditor bound by confidentiality. The Controller will bear its own costs and the Processor's reasonable costs of any such audit.

13. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service, except that nothing in this DPA limits or excludes either party's liability for: (a) administrative fines imposed on it by a supervisory authority; (b) compensation paid to a data subject under UK GDPR Article 82 for damage caused by that party's own non-compliance; or (c) any other liability that cannot lawfully be excluded.

14. Term and termination

This DPA takes effect on the date the Controller accepts it (and, in the case of an updated version, on the date the Controller accepts that updated version through the in-platform re-acceptance flow) and continues for as long as the Processor processes Customer Data on the Controller's behalf. Termination of the Terms of Service will automatically terminate this DPA, without prejudice to any obligations that by their nature should survive (including clauses 10, 11, 12 and 13).

15. Order of precedence

If there is any conflict between this DPA and the Terms of Service in relation to the processing of personal data, this DPA prevails. If there is any conflict between this DPA and the UK Standard Contractual Clauses or any other transfer mechanism in place between the parties, the transfer mechanism prevails to the extent of the conflict.

16. Governing law and jurisdiction

This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with this DPA.

17. Contact

Privacy and data-protection enquiries: dpo@round.monster General contact: support@round.monster