Data Processing Agreement

Version 2026-10 · last updated 19 October 2026. Forms part of the Clavarius Terms of Service. Intended to meet UK GDPR Article 28.

Parties: the Customer (controller) and Rob Gardiner Limited, trading as Clavarius ("Clavarius", processor).

1. Subject matter and duration

Clavarius processes personal data for the Customer to provide the Service, for as long as the Customer uses it, plus the deletion period in section 9.

2. Nature and purpose

Hosting, storing, displaying and transmitting sign-in records and related data so the Customer can record who is on its sites, notify people of deliveries, produce reports and safety roll-calls, and administer its users.

3. Types of personal data

• Staff: name, email, phone, company, employee number, site assignments, sign-in/out times and locations.
• Visitors: name, company, phone number (deleted automatically each night once the visitor has left), group size, visit times and locations.
• Deliveries: recipient name and email, description, location, receiving staff member.
• Users of the Service: admin and access-account emails; login and security logs.
• Email log: recipients and subjects of emails the Service sends for the Customer.

No special-category data is required; the Customer should not enter any.

4. Data subjects

The Customer's staff, contractors, visitors, and delivery recipients, and the Customer's users of the Service.

5. Clavarius's obligations

Clavarius will:
(a) process personal data only on the Customer's documented instructions (these terms and the Customer's use of the Service), unless the law requires otherwise, in which case it will tell the Customer first where allowed;
(b) ensure everyone authorised to process the data is bound by confidentiality;
(c) apply the security measures in section 7;
(d) use sub-processors only as in section 8;
(e) help the Customer respond to data-subject requests, taking into account the self-service tools provided (edit/erase people, export, retention settings);
(f) help the Customer with security, breach notification, DPIAs and ICO consultation where relevant to the Service;
(g) notify the Customer without undue delay (and aim for within 48 hours) after becoming aware of a personal data breach affecting Customer Data;
(h) delete or return Customer Data at the end of the Service (section 9);
(i) make available information needed to demonstrate compliance and allow reasonable audits (normally by written questionnaire, at most once a year unless a breach has occurred).

6. Customer's obligations

The Customer is responsible for the lawfulness of the processing, for giving privacy information to data subjects (e.g. a notice at the sign-in point), and for choosing appropriate retention periods in Admin → Data & privacy.

7. Security measures

• Encryption in transit (TLS) for all access, enforced by the browser (HSTS).
• Logical separation: each Customer's data is kept apart from every other Customer's, and cross-customer access is blocked at the database level, not only in the application.
• Passwords stored only as strong one-way hashes; sign-in attempts rate-limited; all sessions ended when a password changes.
• Servers: firewall, key-only administrative access, automatic blocking of repeated failed access, regular security updates; the database is not reachable from the internet.
• Nightly backups, encrypted before they leave the server, with the decryption key held separately; restores are tested.
• Continuous health monitoring; access to production restricted to authorised personnel.

8. Sub-processors

The Customer authorises the sub-processors below. Clavarius will give at least 30 days' notice of new sub-processors (by email to admins or in the Service); the Customer may object on reasonable grounds, and if the objection can't be resolved, may terminate.

Clavarius imposes data-protection terms on each sub-processor equivalent to this agreement and remains liable for their performance.

9. Deletion at the end of the Service

When the Customer closes its account, access stops immediately and Customer Data is permanently deleted after 30 days. Encrypted backups containing it are overwritten within a further 35 days. The Customer can export all its data before closing (Admin → Data & privacy).

10. International transfers

Where personal data is transferred outside the UK, Clavarius relies on UK adequacy regulations or appropriate safeguards (e.g. the ICO International Data Transfer Addendum).

Contact for this agreement: hello@clavarius.io