What this is. When you use FireCompliance Pro, you enter personal data about your own staff, your clients and the buildings you maintain. For that data you are the controller and we are your processor — we act only on your instructions. Article 28 of the UK GDPR requires a written contract between us setting out how that works. This is it.
It forms part of your subscription agreement and applies automatically for as long as you use the platform. Data where we are the controller — your account, billing, support — is covered by the Platform Privacy Notice instead.
- 1. Parties and roles
- 2. Subject matter, duration, nature and purpose
- 3. Processing on documented instructions
- 4. Confidentiality
- 5. Security
- 6. Sub-processors
- 7. Assisting you with data subject rights
- 8. Breaches, impact assessments and consultation
- 9. International transfers
- 10. Return and deletion at the end
- 11. Demonstrating compliance, and audits
- Annex A — Details of the processing
- Annex B — Sub-processors
- Annex C — Security measures
1. Parties and roles
This agreement is between the contractor subscribing to FireCompliance Pro (the "Controller", "you") and FireCompliance Pro (the "Processor", "we", "us").
You determine the purposes and means of processing the personal data you put into the platform. We process it only to provide the service. Nothing in this agreement makes us a controller of that data, and if we ever processed it for our own purposes we would become a controller in respect of that processing and take on the corresponding responsibilities.
You confirm that you have a lawful basis for the personal data you enter, that you have provided the necessary privacy information to the people it concerns, and — importantly for this service — that where you record criminal records (DBS) information about your staff you have an Article 10 condition for doing so and any appropriate policy document required of you.
2. Subject matter, duration, nature and purpose
The subject matter is the provision of the FireCompliance Pro platform. The processing lasts for the duration of your subscription, plus the retention periods in section 10. The nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex A.
3. Processing on documented instructions
We process personal data only on your documented instructions, including in relation to international transfers, unless we are required to do otherwise by law — in which case we will tell you before processing, unless the law prohibits us from doing so on important grounds of public interest.
Your instructions are: this agreement, your subscription agreement, and your use of the platform's features. If we consider an instruction infringes data protection law, we will tell you.
4. Confidentiality
We ensure that anyone authorised to process your personal data is bound by an appropriate duty of confidentiality, and that access is limited to those who need it to provide, support or secure the service.
5. Security
We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32. The measures in place are described in Annex C. We may update them as the service evolves, provided the level of protection is not reduced.
6. Sub-processors
You give us general authorisation to engage sub-processors. The current list is in Annex B.
If we intend to add or replace a sub-processor we will give you at least 30 days' notice by email and by updating Annex B. If you have a reasonable data protection objection you may raise it within that period, and if we cannot resolve it you may terminate the affected part of the service without penalty for the unused portion of any prepaid fees.
We impose data protection obligations on each sub-processor that are no less protective than those in this agreement, and we remain fully liable to you for their performance.
7. Assisting you with data subject rights
The platform is built so you can answer most requests yourself — you can view, correct, export and delete the records in your account directly, and export certificates and compliance documents at any time.
Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to requests to exercise data subject rights. If a data subject contacts us directly about data you control, we will not respond substantively — we will promptly refer them to you and tell you about it.
8. Breaches, impact assessments and consultation
We notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information we hold at that point — the nature of the breach, categories and approximate numbers of records concerned, likely consequences, and the measures taken or proposed. We will provide further detail in phases as an investigation progresses, and we will not delay an initial notification in order to complete one.
Reporting a breach to the ICO and, where required, to affected individuals is your responsibility as controller. We will provide reasonable assistance.
We also provide reasonable assistance with data protection impact assessments and prior consultation with the ICO, where these relate to our processing.
9. International transfers
Live platform data is hosted in the EU (Frankfurt). Where personal data is transferred outside the UK or EEA — including to the US-based sub-processors in Annex B and for off-site backup — we ensure an appropriate transfer mechanism is in place, being the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and where applicable the UK–US Data Bridge, supported by encryption in transit and at rest.
10. Return and deletion at the end
On termination, and at your choice, we will delete or return your personal data, and delete existing copies — except where we are required by law to retain it.
Two limits you should understand before you sign, because they are real and we would rather be plain about them.
Compliance records are retained for at least 7 years. Fire safety certificates, service reports and the visit records behind them are kept for a minimum of 7 years from the relevant work, in line with certification scheme requirements including BAFE SP203-1 clause 10.1.2, and because they are evidence of statutory fire safety compliance that may be needed long after a contract ends. These records are retained in restricted form and are not used for any other purpose. You can export them at any time, including after cancellation.
Backups age out rather than being edited. Deleted data is removed from the live service immediately, but copies persist in encrypted backups until those backups expire — up to 35 days for daily copies and up to 13 months for monthly copies. We do not selectively edit backups, because that would compromise their integrity as a recovery point. If a backup is restored, deletions are reapplied.
11. Demonstrating compliance, and audits
We make available to you the information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.
In practice: we will respond to reasonable written questions and security questionnaires, and provide the information in these Annexes. On-site or in-depth audits may be requested once in any 12-month period on at least 30 days' notice, subject to confidentiality, at a time that does not unreasonably disrupt the service, and limited to information relevant to your processing — not other customers' data. We may charge our reasonable costs for audits beyond that.
Annex A — Details of the processing
Nature and purpose
Hosting and providing a fire safety compliance management platform: scheduling and recording site visits, recording defects and remedial work, generating and storing certificates and service reports, managing asset and device registers, maintaining staff competency and test equipment records, providing a client-facing compliance portal, and sending related notifications.
Categories of data subjects
- Your employees and workers — engineers and office staff
- Your sub-contractors and their personnel
- Your clients' staff, including the "responsible person" for each building
- Site contacts and other individuals named in visit records or correspondence
Types of personal data
| Category | Examples |
|---|---|
| Identity and contact | Name, job title, work email, phone number, employer, employment start date |
| Employment and competency | Qualifications and training records, certificate scans and expiry dates, department, supervisor status, BAFE Lead Individual designations |
| Criminal records data (UK GDPR Article 10) | DBS check date, DBS certificate reference, next check due date |
| Sign-off and attribution | Handwritten signature images, printed name and position, timestamps of who did what |
| Site and premises | Site addresses and postcodes, site contact details, building access notes, photographs taken on site |
| Free text | Notes on jobs, visits, defects, devices and correspondence, which may contain incidental personal data |
| Account and access | User accounts, roles, authentication and audit records |
Special category data under Article 9 is not required by the platform and should not be entered.
Duration
For the term of the subscription, plus the retention periods set out in section 10.
Annex B — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and file storage — the live system of record | EU (Frankfurt) |
| Vercel | Application hosting, delivery and technical logging | US company; EU edge delivery |
| Stripe | Subscription billing and payment processing | US / EU |
| Resend | Transactional email delivery — invitations, notifications and alerts | US |
| GitHub (GitHub Actions) | Executes the automated nightly backup job; data is processed transiently on a hosted runner and not retained there | US (Microsoft) |
| Cloudflare (R2) | Encrypted off-site retention of nightly backups for disaster recovery | Cloudflare network |
Last updated 13 August 2026.
Annex C — Security measures
- Tenant isolation enforced at the database layer. Access rules are applied by the database on every query, so one contractor's account cannot read another's data even if application code is at fault.
- Role-based access control. Engineers, contractor administrators and client users each see only what their role requires. Staff records containing DBS and other sensitive fields are restricted to the contractor's own administrators.
- Encryption of data in transit (TLS) and at rest, including backups.
- Private file storage for certificates, photographs, signatures and uploaded evidence, accessible only via short-lived signed links issued to authorised users.
- Append-only audit trails for compliance-critical actions, written by the database itself so application code cannot bypass or forge entries.
- Authenticated access with a minimum password policy and administrative controls to disable accounts immediately.
- Automated nightly backups, encrypted and stored off-site, with retention of 35 days (daily) and 13 months (monthly).
- Verified restores. Each backup is automatically restored and checked against a manifest captured before the backup was taken; a backup that fails verification is rejected and raises an alert.
- Documented disaster recovery plan with defined recovery objectives and failure-mode playbooks.
- Least-privilege operational access. We access customer data only as needed to run the service, resolve a fault, or at your request.
- Security review of the application and database access rules, with findings tracked to resolution.