Data Processing Agreement

This Data Processing Agreement (the "DPA") is part of the Putlogic terms of service (the "Terms"). It sets out how we handle the personal data your firm keeps in Putlogic, as Article 28 of the UK GDPR requires. It is accepted when you accept the Terms, and you do not need to sign it.

1. The parties

1.1 RAM Software Studio Ltd, trading as Putlogic, a company registered in England and Wales with company number 17236535, whose registered office is at Unit C Aldow Enterprise Park, Blackett Street, Manchester, M12 6AE, registered with the Information Commissioner's Office under number ZC266667 ("we", "us", "our"). We are the processor.

1.2 The business that signs up to Putlogic and accepts the Terms ("you", "your"). You are the controller.

2. Definitions and roles

2.1 In this DPA:

• "Agreement" has the meaning in clause 1.1 of the Terms: the Terms, your order or sign up confirmation, and this DPA.
• "Business day" means Monday to Friday, except bank holidays in England. Our support hours are 7:30 to 17:30 on business days.
• "Customer Personal Data" means the personal data in your data (clause 7.1 of the Terms) that we process for you to provide the Service. Schedule 1 describes it.
• "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended from time to time (including by the Data (Use and Access) Act 2025), and any other law in the UK about personal data that applies to the processing.
• "Owner email" means the email address of the owner login on your account.
• "Restricted transfer" means a transfer of Customer Personal Data out of the UK that Chapter V of the UK GDPR applies to.
• "Service" has the meaning in clause 1.2 of the Terms.
• "Sub-processor" means another processor we engage to process Customer Personal Data for you.
• Words such as controller, processor, personal data, processing, data subject, personal data breach and special category data have the meanings they have in Data Protection Law.

2.2 You are the controller of Customer Personal Data. You decide what is recorded in Putlogic about your staff, your clients and everyone else, and why.

2.3 We are your processor. We process Customer Personal Data only to provide the Service to you, on your documented instructions (clause 4), as described in Schedule 1.

2.4 Where we are a controller, not your processor. We are a controller, under our own privacy notice and outside this DPA, for the limited personal data we need to run our own business with you:

• the names, emails and phone numbers of your owner and account contacts, and our emails, calls and messages with them;
• your plan, our invoices to you and the payments you make to us. Our own subscription fees are collected through GoCardless (Direct Debit) and Revolut (card). They collect those payments for us, and they act for their own regulated payment services under their own terms. That is our billing, not processing for you, and it is not covered by this DPA;
• records we need to keep Putlogic itself secure and working for every customer, such as limits on failed sign ins and the server's error logs; and
• information about how the Service is used that does not identify you, your users or anyone in your data (clause 7.5 of the Terms).

This is different from online payments that your own customers make to you through Putlogic (clause 9.6). For those, you are the controller and we are your processor.

3. Your duties as controller

3.1 You must make sure that:

• you have a lawful basis under Data Protection Law for the personal data you put into Putlogic, and for asking us to process it;
• you have given your staff, clients and the other people you record the information Data Protection Law requires, in your own privacy notices. This includes telling your staff that when they sign a record, sign in on site or take a photo in Putlogic, their phone's location is recorded if their phone allows it (Schedule 1, part 6), and telling them that a scaffold tag's public page shows the name of the person who last inspected or handed over the scaffold (Schedule 1, part 7);
• your instructions to us comply with Data Protection Law;
• you record only what you need, keep it accurate, and decide how long to keep it while you are a customer;
• you have a condition under Article 9 of the UK GDPR for any special category data you record, such as details of an injury in an incident report, and that you do not put other special category data or criminal offence data into Putlogic unless you have a lawful basis and a reason to;
• you give each person only the access they need, remove people who leave, and keep your logins secure (clauses 2.4 and 8.2 of the Terms); and
• you export anything you need to keep before the Agreement ends (clause 12).

3.2 You are responsible for your own duties under Data Protection Law, including answering requests from people about their data, deciding whether to report a personal data breach to the Information Commissioner or to the people affected, and any data protection impact assessment you need. We help you with these as set out in clause 8.

4. Your documented instructions

4.1 Your instructions to us are:

• the Agreement, including this DPA;
• how you and your users set up and use the Service, for example which features you switch on, what you enter, the emails you send through it, the links you share with your clients and the scaffold tags you print; and
• any other written instruction from an owner or admin login, by email to [email protected], that is consistent with the Agreement.

4.2 We process Customer Personal Data only on your documented instructions, including on transfers outside the UK (clause 11), unless UK law requires us to do something else. If it does, we will tell you before we act, unless that law forbids us to tell you.

4.3 We will tell you straight away if we think an instruction breaks Data Protection Law. We do not have to follow that instruction until you confirm or change it.

4.4 What we never do with Customer Personal Data. We never:

• sell it, rent it out or give it to anyone in return for anything;
• use it for advertising or marketing, whether ours or anyone else's, or to build profiles of anyone;
• use it to train, test or improve any artificial intelligence or machine learning model, or put it into any AI tool or service;
• combine it with another customer's data, or use it for any purpose other than providing the Service to you; or
• disclose it to anyone except our sub-processors (clause 9), people you choose to share it with through the Service, or where UK law requires it (clause 4.2).

4.5 You instruct us to create information about how the Service is used that does not identify you, your users or anyone in your data (clause 7.5 of the Terms), so we can run and improve Putlogic. Once it no longer identifies anyone, it is not personal data.

4.6 We keep a record of the processing we carry out for our customers, as Article 30(2) of the UK GDPR requires.

5. Confidentiality

5.1 We only let people process Customer Personal Data if they need to, to provide or support the Service, and each of them is bound by a duty of confidentiality, by contract or by law, and processes it only on your instructions.

5.2 We only look at the contents of your account when you or your users ask us to (for example, for support or to load your data at setup), when it is needed to keep the Service working or secure or to restore it from a backup, or when UK law requires it.

5.3 We test changes to Putlogic on made-up demo data, not on your data. We do not keep copies of your data outside the Service and our backups, except a temporary copy when it is needed to fix a problem you have reported, restore your data or prepare your export. We keep that copy secure and delete it when the work is done.

6. Security (Article 32)

6.1 We take appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the state of the art, the cost, the nature, scope, context and purposes of the processing, and the risks to people. Schedule 2 describes the measures.

6.2 We review the measures at least once a year and after any personal data breach. We may change them, but we will not lower the overall level of protection.

6.3 You are responsible for the parts of security that are in your control: who you give logins to and with what role, your users' passwords and devices, which features you switch on, and who you share links, documents and tags with.

7. Personal data breaches

7.1 We will tell you about any personal data breach affecting Customer Personal Data without undue delay, and in any event within 48 hours of becoming aware of it. We will email the owner email and, where we have a phone number for the owner, ring or message them too.

7.2 We will tell you what we know at the time: what happened and when, the kinds of data and roughly how many people and records are affected, the likely consequences, what we have done and will do to deal with it and reduce its effects, and who to contact. Where we do not know everything at first, we will send the rest as soon as we learn it.

7.3 We will take reasonable steps straight away to contain the breach, reduce its effects and stop it happening again. We will help you, as you reasonably need, to decide whether to report it and to tell the Information Commissioner and the people affected. We will keep a record of the breach and what we did.

7.4 We will not tell the Information Commissioner or the people affected about a breach of Customer Personal Data on your behalf, or make a public statement naming you, without agreeing it with you first, unless the law requires us to.

7.5 Telling you about a breach is not an admission of fault by either of us.

7.6 Please tell us straight away if you think a login has been misused or your data has been exposed (clause 2.4 of the Terms).

8. Helping you meet your duties

8.1 Requests from people about their data. Putlogic lets your owner and admin logins find, correct and download much of the personal data in your account (clause 12.1). If you need more, we will help you, free of charge, so far as we reasonably can, to answer requests from people using their rights under Data Protection Law, for example by finding or exporting their data, or deleting it on your written instruction.

8.2 Signed records. Signed handovers, inspections, variations and RAMS briefings cannot be deleted in the app, so they stay reliable as records: they can only be voided, with a reason. If you decide one must be erased, tell us in writing and we will erase it for you.

8.3 If someone contacts us directly about Customer Personal Data, we will pass the request to you within 2 business days, and we will not answer it ourselves except to tell them we have passed it on, unless you ask us to.

8.4 Security, breaches, assessments and the regulator (Articles 32 to 36). Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your security duties, with personal data breaches (clause 7), with any data protection impact assessment about your use of Putlogic, with any prior consultation with the Information Commissioner, and with any complaint or enquiry from a data subject or the Information Commissioner about the processing.

8.5 This help is free of charge where it is reasonable. If a request would need significant work beyond the normal Service, we will tell you the cost first, and you decide whether to go ahead.

9. Sub-processors

9.1 General authorisation. You give us general written authorisation to engage sub-processors. The sub-processors we use are listed in Schedule 3, which is also published at putlogic.co.uk/dpa.

9.2 Our duties for each sub-processor. We engage each sub-processor under a written contract that requires it to protect Customer Personal Data as Article 28(3) of the UK GDPR requires, with sufficient guarantees of appropriate security. We stay fully responsible to you for what our sub-processors do with Customer Personal Data.

9.3 Notice of changes. Before we add or replace a sub-processor, we will email the owner email at least 30 days before the change, saying who it is, what it will do and where it will process data, and we will update Schedule 3.

9.4 Objecting. If you have a reasonable objection on data protection grounds, tell us within those 30 days. We will talk it through with you in good faith and, where we reasonably can, offer a way to avoid the change for your data. If we cannot resolve it, you may end the Agreement by written notice before the change takes effect, without penalty, and we will refund, pro rata, any fees you have paid in advance for the period after the end.

9.5 Urgent replacement. If a sub-processor must be replaced urgently to keep the Service secure or running (for example, because it stops providing its service or has a serious security failure), we may make the change with less notice. We will tell you as soon as we can, and you have the same right to object, from the date of our notice, as in clause 9.4.

9.6 Online payments from your customers. Putlogic will let you take payments from your own customers online through Stripe or GoCardless. This is not available yet. When it is, it will only be used if you switch it on. When you do:

• the provider you choose processes the payment data described in Schedule 1, part 8, for the Putlogic payments feature. For that processing it is our sub-processor, listed in Schedule 3, part B;
• Stripe and GoCardless also act as independent controllers for their own regulated payment activities, such as executing payments, checking identity, preventing fraud and money laundering, and meeting their legal and card or Direct Debit scheme duties. For that, they are responsible under their own terms and privacy notices, which you accept when you connect your account with them, and that processing is not covered by this DPA; and
• card numbers and bank account details are entered directly with Stripe or GoCardless. We will not store full card numbers or bank account details in Putlogic.

10. Audits

10.1 Documents first. We will make available to you the information you reasonably need to show that we meet Article 28 of the UK GDPR and this DPA. That includes this DPA and its schedules, written answers to your reasonable questions or security questionnaire, a summary of our latest security review, and any certifications or reports our sub-processors publish or share for this purpose.

10.2 Audit. You, or an independent auditor you appoint who is bound by a duty of confidentiality and is not a competitor of ours, may audit our compliance with this DPA:

• once in any 12 months, with at least 10 business days' written notice;
• more often if there has been a personal data breach affecting Customer Personal Data, or if the Information Commissioner or another regulator requires it.

10.3 On-site inspection is only for when it is necessary: where the documents and answers under clause 10.1 do not reasonably show that we comply, or where a regulator requires it. It takes place during business hours and in a way that does not disrupt the Service or put other customers' data at risk. It does not cover our sub-processors' premises, for which we rely on their own audit reports.

10.4 Costs. An inspection is at your cost, and we bear our own costs. But if it follows a personal data breach caused by our breach of this DPA, or it finds that we have materially breached this DPA, we will pay your reasonable costs of it.

11. International transfers

11.1 Customer Personal Data is stored in London, in the United Kingdom. This includes the Putlogic server, its databases, photos and documents, and our backups (Schedule 3).

11.2 Some sub-processors process Customer Personal Data outside the UK, or may access it from outside the UK, as shown in Schedule 3. You authorise those transfers. We only make or allow a restricted transfer where Data Protection Law permits it:

• under UK adequacy regulations, including the UK Extension to the EU-U.S. Data Privacy Framework for a US company certified under it; or
• with the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where one is needed.

11.3 Schedule 3 shows which of these each sub-processor relies on. If a safeguard we rely on stops being valid, we will move to another valid safeguard or stop the transfer, and tell you.

11.4 We will not change where Customer Personal Data is stored without telling you first under clause 9.3.

12. Export, return and deletion

12.1 While you are a customer. An owner or admin can download your jobs, customers and invoices as spreadsheet (CSV) files from Settings at any time, and anyone with access can download the PDFs (certificates, reports, quotes and invoices). An owner can also download a copy of your firm's database file.

12.2 Full export. You can export all your data in a commonly used, machine-readable format: a CSV file for each type of record, plus your photos and documents in the format they are stored in Putlogic (JPEG, PNG or PDF). When this is available in the app, you can do it yourself. Until then, we will provide it when you ask by email to [email protected] from the owner email, within 10 business days, at no charge. We send it through a secure download link or another secure method we agree with you.

12.3 When the Agreement ends. For 30 days after the Agreement ends, you can still sign in as an owner to download your spreadsheets and documents, and ask for a full export under clause 12.2.

12.4 Deletion. We delete Customer Personal Data from the live Service within 30 days after we have returned it to you or you have told us in writing to delete it, and in any event no later than 60 days after the Agreement ends. Copies in our backups are overwritten on their normal cycle and are gone within 90 days of the end of the Agreement. Copies held by our sub-processors, such as emails sent through the Service, are deleted on their own retention cycles or by us, within the same 90 days.

12.5 We only keep Customer Personal Data longer if UK law requires us to store it. If so, we keep it protected under this DPA and only process it for that purpose.

12.6 If you ask, we will confirm in writing when the deletion is done.

12.7 If you need records kept for longer, for example inspection records for a claim, export them before the end.

13. Liability

13.1 Clauses 10.1, 10.2 and 10.4 of the Terms apply to this DPA.

13.2 Our total liability to you for all claims under or in connection with this DPA, or Data Protection Law, about Customer Personal Data is limited to the greater of:

• (a) the total fees you paid or were due to pay us in the 12 months before the event that gave rise to the claim; and
• (b) £5,000.

This is the limit for claims about personal data under clause 10.3 of the Terms. It is not in addition to that clause: any amount we pay under this clause counts towards the limit in clause 10.3, and that limit is raised as far as needed to pay it.

13.3 Nothing in this DPA or the Terms limits any right a data subject has against either of us under Data Protection Law, or the powers of the Information Commissioner. Where a data subject's claim arises from the acts of both of us, each of us is responsible for the part of the damage caused by its own breach.

14. Contacts, changes and law

14.1 Our contact. Email [email protected] for anything about this DPA, including requests, instructions, objections and audit requests. For an urgent security incident, ring or WhatsApp 07453 109691 at any time. Please do not send personal data from your account by WhatsApp: use it to tell us there is a problem, and we will take it from there by email or phone. Otherwise our support hours apply (7:30 to 17:30, Monday to Friday, not bank holidays).

14.2 Your contact. We contact you at the owner email. Keep it up to date in your account, or tell us if it changes.

14.3 Changes to this DPA. We may update this DPA under clause 12.1 of the Terms: we will give you at least 30 days' notice by email of any change that affects you materially, and you can cancel without penalty before it takes effect. A change the law requires, or one that only adds to your protection, may take effect sooner, and we will tell you about it. Changes to the list of sub-processors follow clause 9 instead. Each version is published at putlogic.co.uk/dpa with its version number, and we keep earlier versions available on request.

14.4 Order of precedence. If this DPA conflicts with the Terms or the order confirmation on personal data, this DPA wins (clause 1.1 of the Terms).

14.5 How long it lasts. This DPA applies for as long as we process Customer Personal Data for you, including after the Agreement ends until the deletion in clause 12 is complete.

14.6 Severance. If any part of this DPA is found unenforceable, the rest stays in force.

14.7 Law and courts. This DPA, and any dispute about it, is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Schedule 1: Details of the processing

1. Subject matter and purpose. Providing Putlogic, job management software for scaffolding contractors, to you: storing, organising, showing, printing and sending your records about quotes, jobs, gangs, scaffolds, handovers, inspections, scaffold tags, RAMS and briefings, safety records, hire, stock, vans, variations and invoices, and your client portal; online payments if you switch them on; backups and restores; support; and setting up and loading your data when you join.

2. Nature of the processing. Collecting data through the app, the phone app, the client portal, your website enquiry form and the links you send to clients; recording, storing, organising, searching, showing it to your users and clients, making PDF documents, sending the emails you or your settings trigger, showing public scaffold tag pages, backing up, restoring, exporting and deleting.

3. Duration. For as long as the Agreement lasts, and then until deletion under clause 12. The processing is continuous.

4. People whose data is processed.

• Your staff and people who work for you: owners, office users, managers, scaffolders and other site users, including people you add by name without a login.
• Your clients and their contacts: homeowners, main contractors' site managers, and other people at your clients, including client portal users.
• People who contact you through your website enquiry form, if you connect it to Putlogic.
• Other people you record: for example people briefed on a RAMS, people who sign a handover, acceptance or variation, drivers, people named in an incident or near miss report and witnesses, members of the public, suppliers, and inspectors from other firms.
• Your customers who pay you online, if you switch online payments on.

5. Kinds of personal data.

6. Location and device data. Putlogic does not track anyone's location in the background. It asks the phone for its location only when a person opens or signs a handover, inspection, variation or RAMS, signs in on site, a supervisor lets someone start, or a photo is taken in the app. The phone's own settings decide whether location is shared; the person can say no, and the record is still saved without it. When it is shared, Putlogic keeps:

• with a signature or site sign in: the latitude and longitude, how accurate it was, and how far that was from the site's pin on the map; and
• with a photo: when it was taken and, if location was shared in the last 10 minutes, the latitude and longitude, both stamped along the bottom of the photo itself and kept with it.

Photos taken with Putlogic's photo buttons, and photos of competence cards, are made smaller on the phone before they are sent (at most 1,600 pixels across), and the other information the camera saves inside the file is not kept. Files uploaded as documents (PDF, JPEG or PNG) are kept exactly as uploaded, including anything saved inside them. Signed records also keep the device (browser and type) and internet address they were signed from.

7. Public pages. A scaffold tag's QR code opens a public page that anyone can see. It shows the scaffold's status, when it was last inspected or handed over and the name, position and card type of the person who did it, its load class and restrictions, the town, and your firm's name and phone number. It never shows a client's name, house number or prices. We record that a tag page was opened, and when, but not who opened it. Quote, handover and variation links you send to clients are open to whoever has the link.

8. Online payments (when you switch them on). Your customer's name and email, the invoice it relates to, the amount, the payment or Direct Debit mandate reference and its status, and messages about the payment. Card numbers and bank account details are entered directly with Stripe or GoCardless, which act as described in clause 9.6.

9. Special category data. Putlogic is not designed to hold special category data. An incident or near miss report can include details of an injury, which is health data, and photos may show people. You decide whether to record this, and you need an Article 9 condition for it (clause 3.1). It has the same protection as the rest of your data.

10. Retention while you are a customer. You decide how long to keep your records, within what the app allows. Signed records cannot be deleted in the app (clause 8.2). Ended sign in sessions are cleared automatically after 30 days.

Schedule 2: Security measures

This describes what we do today. We may improve it, but will not lower the overall level of protection (clause 6.2).

Where your data is held

• The Putlogic server is a DigitalOcean server in London (LON1). Your databases, photos and documents are held on it.
• Only the web ports (HTTP and HTTPS) and the server's own administration port are open, behind DigitalOcean's firewall.

Keeping firms apart

• Each firm's data is held in its own separate database file, with its own folder for photos and documents. It is never mixed with other firms' data in one table.
• Every request is checked against the firm and the person signed in. Tests check that one firm cannot reach another firm's records.

Connections

• Every connection to Putlogic is encrypted (HTTPS). Plain HTTP is sent to HTTPS, and browsers are told to use HTTPS only (HTTP Strict Transport Security).

Signing in

• Passwords are stored only in a scrambled form (bcrypt), never as text.
• Repeated failed sign ins are limited, both per email and per internet address. Password resets use single use links that expire.
• Sign ins use secure cookies that pages cannot read. A session lasts at most 90 days for staff and 30 days for client portal users, and ends sooner if unused. A person can sign out of every device, and an owner can sign anyone out of all devices. Switching off a login or removing a person takes effect straight away, and a password change signs the person out of their other devices.
• Two-factor sign in for your users is not available yet.

Access by role

• Owners, admins, managers and scaffolders see only what their role allows. Office pages and prices are blocked on the server for scaffolders. Clients see only their own scaffolds, quotes, invoices and documents in the portal.

Records that cannot be quietly changed

• A change to a signed handover, inspection or variation is a new version, recording who changed it, when, why and what changed. Each PDF made from a signed record is kept as made, with a fingerprint (SHA-256), so a reprint is the same file. Signed records are voided with a reason, not deleted.

Phones

• Forms saved to a phone for use with no signal hold only today's and tomorrow's work, and are removed when the person signs out. A record signed with no signal is kept on the phone until it has been sent.

Backups

• Every night at 2am, a full copy of every database and upload is taken and kept on the server for 14 days.
• The same copy is encrypted (AES-256-GCM), with a key only we hold, and stored off the server in DigitalOcean Spaces in London (LON1) for 30 days. DigitalOcean cannot read it.
• DigitalOcean also keeps daily backups of the whole server, in the same region, for 7 days.
• No backup is ever sent by email. The nightly email to us only says whether the backup worked, with no customer data.

Logs

• The server's logs record errors and emails that could not be sent, which can include a page address or an email subject. They stay on the server, are used only to run and fix the Service, and are overwritten automatically as they fill up.

Email

• Emails are sent through Resend from [email protected], in your firm's name, with replies going to your firm. We do not switch on open or click tracking.

Our own access

• Only our named staff can reach the server and our provider accounts, each with their own login. Access to the server is by SSH key, and our hosting, email and code accounts use two-factor authentication.
• Our code is kept in a private repository. It never contains customer data.

Keeping it up to date

• The server's software and Putlogic's components are kept up to date, and every change is tested on made-up data before it goes live.
• Error messages shown to users never include internal details such as file paths or database queries.

People and process

• Everyone who can access Customer Personal Data is bound by confidentiality (clause 5).
• We follow a written process for personal data breaches (clause 7) and review these measures at least once a year (clause 6.2).

Schedule 3: Sub-processors

This list is current for version 1.0 of this DPA. We give 30 days' notice by email before adding or replacing a sub-processor (clause 9).

Part A: sub-processors we use

Part B: only if you switch on online payments (not available yet)

Part C: services that are not sub-processors, named so you know

These services do not receive Customer Personal Data from us, or only receive a postcode or map position with no name or other details:

• Cloudflare, Inc. runs the DNS for putlogic.co.uk and hosts our marketing website. Putlogic itself (app.putlogic.co.uk) is not routed through Cloudflare, so Cloudflare does not receive your data. If that changes, we will treat it as a new sub-processor under clause 9.
• postcodes.io (UK) is sent a site postcode, to place the site on the map.
• Open-Meteo (Switzerland) is sent a site's map position for wind forecasts. If we switch to the Met Office (UK), it is sent the same.
• OpenFreeMap supplies the map pictures and jsDelivr the map software. Your users' browsers load these directly, so those services see the browser's internet address and the map area being viewed.
• Google Maps opens only when a user presses Directions, in that user's own browser or phone.
• WhatsApp and phone calls are for contacting us. We do not use them to process Customer Personal Data (clause 14.1).
• GoCardless and Revolut collect our own subscription fees from you. That is our billing, not processing for you (clause 2.4).