DATA PROCESSING AGREEMENT
Business customer data processing
Draft published 27 October 2026 · Subject to legal review and incorporation into customer agreements
This Data Processing Agreement (DPA) describes the terms on which TickSure processes personal data on behalf of business customers. It is intended to supplement the Terms of Service when agreed by the customer and TickSure. It does not replace our Privacy Notice.
1. Parties and roles
The customer using TickSure for its business records is the Controller of personal data entered about staff or other individuals in those records. Callum Grant trading as TickSure is the Processor of that customer-controlled data. TickSure is a separate controller for its own account administration, billing, support and website marketing data, which is addressed in the Privacy Notice. If TickSure Ltd becomes the contracting provider, the parties' documents will be updated accordingly.
2. Details and duration of processing
TickSure processes personal data to host, secure, organise, display, maintain and provide the customer's digital checklists, tasks, operational records, reports and evidence, and to provide associated support. Processing continues for the period the customer uses the relevant service and any reasonable end-of-service return or deletion period, subject to applicable legal retention requirements. The Schedule below sets out the categories of information and individuals involved.
3. Documented instructions
TickSure will process customer-controlled personal data only on documented instructions from the customer, including the instructions reflected in the customer's use and configuration of TickSure, unless required otherwise by applicable law. Where legally permitted, TickSure will inform the customer of such a legal requirement before processing. TickSure will notify the customer if it believes an instruction infringes applicable data protection law.
4. Confidentiality and security
TickSure will ensure persons authorised to process customer-controlled personal data are subject to confidentiality obligations. TickSure will implement appropriate technical and organisational security measures taking account of the risks involved, including access controls, authentication, restricted administrative access, appropriate protections for stored records and evidence, and procedures for addressing security incidents. Security measures will be reviewed as the service develops.
5. Sub-processors
The customer gives general written authorisation for TickSure to use sub-processors needed to provide the service. These may include Supabase (database, authentication and storage), Cloudflare (website infrastructure), Resend (service email), Twilio (SMS, if used) and other providers where they process customer-controlled personal data. Stripe processes billing information for payment services and may act in a different data protection role, rather than always as a sub-processor. TickSure will maintain an up-to-date list of relevant sub-processors and inform customers of intended additions or replacements, allowing a reasonable opportunity to object on data protection grounds. TickSure will impose equivalent applicable data protection obligations on its sub-processors and remain responsible for their performance.
6. Assistance to customers
Taking into account the nature of processing and the information available, TickSure will reasonably assist the customer in responding to requests to access, correct, delete, restrict or otherwise exercise rights concerning customer-controlled personal data. TickSure will also reasonably assist with security obligations, personal data breach notifications, data protection impact assessments and prior regulatory consultations, where applicable.
7. Personal data breaches
TickSure will notify the customer without undue delay after becoming aware of a personal data breach affecting customer-controlled personal data and provide available information reasonably required to assist the customer's assessment, notifications and response. The customer remains responsible for deciding whether it must notify regulators or affected individuals where it is the controller.
8. International transfers
Where customer-controlled personal data is transferred outside the UK in a way subject to UK transfer restrictions, TickSure will ensure an applicable lawful transfer mechanism is used, such as UK adequacy regulations or appropriate contractual safeguards, and will take any additional steps required by law. Customer instructions and applicable sub-processor terms will govern these transfers.
9. Return and deletion
At the end of the processing services, TickSure will, at the customer's choice, return or delete customer-controlled personal data, subject to technical feasibility, agreed arrangements and legal obligations requiring retention. TickSure will delete existing copies unless applicable law requires storage. Backup deletion may follow established retention cycles, during which retained information remains protected and is not used for unrelated purposes. Customers should export required records using available tools before account access ends and may contact support for assistance.
10. Information and audits
TickSure will make available information reasonably necessary to demonstrate compliance with its processor obligations and allow and contribute to audits or inspections conducted by the customer or an authorised auditor. The parties will coordinate audits reasonably, with appropriate notice, confidentiality and safeguards for other customers and platform security, without restricting rights required by law.
11. Responsibilities and order of terms
The customer is responsible for providing lawful instructions, identifying a lawful basis for its processing, informing relevant individuals and ensuring the information it asks staff to record is appropriate. Each party remains responsible for its own legal obligations. Where this DPA conflicts with the Terms of Service concerning processing of customer-controlled personal data, this DPA takes precedence to the extent required by applicable data protection law.
Schedule — Processing description
Subject matter: Business checklist, task, operational record, reporting and evidence services.
Nature and purpose: Collection at the customer's direction; storage; organisation; retrieval; display; reporting; security; backup; and related technical support.
Data subjects: Customer staff, managers, authorised users, contractors and other individuals whose information the customer chooses to record.
Data types: Names, roles, contact details where entered, account identifiers, task assignments, timestamps, check results, comments, photographs, signatures, incident records and other customer-configured fields. Customers should avoid entering special category or highly sensitive data unless necessary and lawfully justified.
Duration: For the service relationship and the applicable return, deletion and legally required retention periods described above.
Questions and agreement
For DPA requests, sub-processor information or to agree the applicable processing terms, contact info@ticksure.co.uk. This is a published draft; a binding customer-processor arrangement should be confirmed in the applicable customer contract or acceptance process.