Data Processing Agreement

This page summarises how ControlOps processes personal data as a processor for UK business customers using the multi-tenant SaaS Service. The full Data Processing Agreement (DPA) is available on request for contract review.

1. Roles

For Customer Content (workforce, rota, operational, payroll preparation and related records you upload or create in the Service), the Customer is the controller and ControlOps is the processor. For account, billing, website enquiry and security logs relating to Service provision, ControlOps acts as an independent controller as described in the Privacy Notice.

2. Subject matter and duration

Processing covers hosting, storage, transmission, backup and support access needed to provide the Service for the term of the Customer's subscription and any agreed retention or deletion period after termination.

3. Nature and purpose

Processing is limited to providing and securing the ControlOps platform, supporting Authorised Users, and complying with applicable law. ControlOps does not sell Customer Content or use it to train unrelated third-party models.

4. Types of personal data and data subjects

Typical categories include names, contact details, employment and assignment information, site and shift records, document metadata, and related operational notes about Customer staff, contractors and client contacts, as determined by the Customer.

5. Instructions and confidentiality

ControlOps processes Customer Content on documented Customer instructions (including configuration inside the Service) and ensures personnel authorised to process it are bound by confidentiality obligations.

6. Security

Technical and organisational measures include authenticated access, company-scoped tenant isolation, encryption in transit, role-based permissions and operational monitoring. A higher-level summary is available on our Security page. Detailed security materials can be provided under NDA for procurement.

7. Sub-processors

ControlOps may use carefully selected sub-processors (for example hosting, email delivery or payment providers) under written terms that provide equivalent data protection obligations. Customers will be informed of material changes through the Service or contract notices.

8. International transfers

Where personal data is transferred outside the UK, ControlOps uses appropriate safeguards such as UK adequacy regulations or standard contractual clauses, as applicable.

9. Assistance, deletion and audit

ControlOps will assist Customers with data subject requests, security incidents affecting Customer Content, and reasonable audits or information requests as set out in the signed DPA. On termination, Customer Content is deleted or returned according to the agreement and product retention settings, except where law requires retention.

10. Request the full DPA

Email [email protected] with your organisation name and we will provide the current DPA for review. Controller processing for accounts, billing and website enquiries remains governed by the Privacy Notice.

For questions, book a demo or contact your ControlOps representative.