Data Processing Agreement

Last updated 18 October 2026. Effective from 19 October 2026.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer ("Controller") and G8 ONE Limited, company number 17510021 ("Processor"). It applies automatically when the customer uses G8 ONE; no signature is needed. If you'd like a countersigned copy, email support@g8-one.com.

1. Subject matter and duration

The Processor processes personal data only to provide G8 ONE to the Controller, for the term of the contract and the deletion period in clause 4(h).

2. Nature and purpose

Hosting, storing, displaying, exporting and deleting records the Controller enters; sending account emails; producing PDFs, exports and view-only links; and running AI features the Controller's users choose to use.

3. Types of personal data and data subjects

Data subjects: the Controller's staff, operatives, subcontractors and visitors, and its clients' contacts.

Personal data: names, employer, role, contact details, signatures and sign-off times, device and IP evidence of sign-off, training and certificate records, site attendance and timesheets, location at sign-in/out (if enabled), photos, and noise and vibration exposure records.

Special category and sensitive data (only if the Controller uses those modules): health surveillance outcomes, injury details and right-to-work checks.

4. Processor obligations (UK GDPR Article 28(3))

The Processor will:

1. process personal data only on the Controller's documented instructions – using and configuring the service is the instruction – unless the law requires otherwise, in which case it will tell the Controller first unless the law forbids that;
2. make sure everyone authorised to process the data is bound by confidentiality;
3. apply the security measures in Annex A;
4. use sub-processors only as set out in clause 5;
5. help the Controller respond to data subject requests (in-app export and deletion are provided);
6. help the Controller with security, breach notification, data protection impact assessments and prior consultation with the ICO;
7. tell the Controller without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting the Controller's data, with the information the Controller needs;
8. at the end of the service, delete the personal data after the 30-day export period (backups age out within the hosting provider's backup window), unless the law requires it to be kept;
9. make available the information needed to show compliance with this DPA and allow reasonable audits, on at least 30 days' notice, no more than once a year unless there has been a breach.

5. Sub-processors

The Controller authorises the sub-processors in Annex B. The Processor imposes data protection terms on each that give equivalent protection, and remains responsible for them. We will tell customers at least 30 days before adding or replacing a sub-processor (by email to the account owner and an update to the Sub-processors page). The Controller may object on reasonable data protection grounds; if we can't resolve the objection, the Controller may end the affected service and receive a pro-rata refund of prepaid fees.

6. International transfers

Customer data is stored in the EU (Ireland), which the UK recognises as adequate under its adequacy regulations. Where a sub-processor processes data outside the UK or EEA, the transfer is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or the UK–US data bridge.

7. Controller responsibilities

The Controller is responsible for having a lawful basis for the processing, giving workers appropriate privacy information (including about location capture at sign-in if enabled), and for the content it enters.

8. Liability

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow it.

Annex A – Security measures

• Tenant isolation through database row-level security, with automated tests checking isolation between companies.
• Encryption in transit (TLS) and at rest (provider-managed).
• Data stored in the EU (Ireland).
• Role-based access (owner, admin, manager, operative), with sensitive modules limited to owners, admins and people granted access.
• Two-factor authentication (authenticator app) available for office users.
• An append-only audit log and version history of records and sign-offs.
• Operative PINs stored hashed; lock-out after repeated failed attempts.
• Share links use long random tokens that are stored hashed, can expire and can be revoked.
• Sessions end after 7 days without use and at most 30 days.
• Error monitoring with personal data and secret tokens stripped; session replay is opt-in and fully masked.
• Automated backups managed by our database provider.
• Payments handled by Stripe; we don't store card numbers.

Annex B – Sub-processors