Data processing agreement (Draft)

Draft: will be finalised once the company is registered. This is not legal advice and should not be relied on until it is finalised.

Version: draft 0.1, 29 October 2026

1. Who this agreement is between

• Us (the processor): [COMPANY NAME] Ltd, a company registered in England and Wales with company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS], trading as Wrenchpost ("we", "us"). Contact: hello@wrenchpost.com.
• You (the controller): the business that signs up to Tierstead and accepts our Terms ("you").

This Data Processing Agreement ("DPA") forms part of our Terms of Service for Tierstead (the "Main Terms"). It applies whenever we process personal data on your behalf while providing Tierstead (app.wrenchpost.com). If this DPA and the Main Terms conflict about personal data, this DPA wins. Its structure follows the UK Information Commissioner's Office (ICO) guidance on what a controller-processor contract must include under Article 28(3) of the UK GDPR.

2. Definitions

Words such as "controller", "processor", "personal data", "processing", "data subject", "personal data breach" and "sub-processor" have the meanings given in the UK GDPR (and, where it applies, the EU GDPR). "Data Protection Laws" means all privacy and data protection laws that apply to the processing, including the UK GDPR, the Data Protection Act 2018, the EU GDPR, US state privacy laws, Canada's PIPEDA and Australia's Privacy Act 1988. "Customer Personal Data" means personal data we process for you under this DPA.

3. Roles

You are the controller of Customer Personal Data. We are your processor (or "service provider"/"processor" under US state laws). You decide why the data is processed; we process it only to run Tierstead for you.

Jobber is not our sub-processor. Your Jobber account is your own platform, under your own contract with Jobber. You choose to connect it to Tierstead. Jobber's handling of your data is governed by your agreement with Jobber, not this DPA.

Billing. Our reseller and merchant of record, Paddle, handles payments and acts as an independent controller of payment data under its own terms. No card, bank or tax ID data is processed through Tierstead.

4. Details of the processing

The subject matter, duration, nature and purpose, types of data and categories of data subjects are set out in Annex 1.

5. Our obligations (UK GDPR Article 28(3))

5.1 Only on your documented instructions (Art. 28(3)(a))

We process Customer Personal Data only on your documented instructions, including for international transfers, unless UK law (or other law we are subject to) requires otherwise; if so, we will tell you first unless the law forbids that. Your instructions are: the Main Terms, this DPA, and your use and configuration of Tierstead (for example, connecting Jobber, approving a price change, or choosing to send a price-rise notice). You can give further instructions in writing, including by email. We will tell you promptly if we think an instruction breaks Data Protection Laws.

5.2 Confidentiality (Art. 28(3)(b))

Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality (by contract or by law).

5.3 Security (Art. 28(3)(c))

We take the technical and organisational measures required by Article 32 UK GDPR, described in Annex 2. We may update them as long as the overall level of protection does not go down.

5.4 Sub-processors (Art. 28(3)(d))

You give us general written authorisation to use the sub-processors in Annex 3. We will give you at least 30 days' notice (by email and/or by updating our sub-processor list at wrenchpost.com/dpa) before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot reasonably address your objection, you may end the affected service and we will refund any prepaid fees for the unused period. We will put a written contract on each sub-processor with data protection obligations giving equivalent protection to this DPA. We remain responsible to you for our sub-processors' performance, subject to Section 12.

5.5 Helping with data subject rights (Art. 28(3)(e))

Taking into account the nature of the processing, we will help you, by appropriate technical and organisational measures where possible, to respond to requests from people exercising their rights (access, correction, deletion, restriction, portability, objection, and US/Canadian/Australian equivalents). Most requests can be handled directly in Jobber, which is your system of record. If we receive a request directly, we will pass it to you without undue delay and will not respond ourselves except to redirect the person to you.

5.6 Helping you comply (Art. 28(3)(f))

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your obligations on security (Art. 32), breach notification (Arts. 33–34), data protection impact assessments (Art. 35) and prior consultation with a regulator (Art. 36).

5.7 Deletion or return at the end (Art. 28(3)(g))

When you disconnect Jobber or cancel your Tierstead account, we will delete Customer Personal Data within 30 days, unless law requires us to keep it. You can export your data from Tierstead (or ask us for an export) before then; your source data also remains in your Jobber account. Encrypted backups are overwritten on our providers' normal backup cycle [confirm: up to [X] days] and are not restored except for disaster recovery. On request we will confirm deletion in writing.

5.8 Information and audits (Art. 28(3)(h))

We will make available the information reasonably needed to show we meet Article 28, starting with documentation: this DPA, our security summary (Annex 2), our sub-processor list and our sub-processors' own certifications and reports where we can share them. If that is not enough to answer a reasonable concern, or a regulator requires it, you may audit us, at your cost, on at least 30 days' written notice, no more than once in 12 months (unless after a breach or at a regulator's request), during business hours, under confidentiality, and without access to other customers' data. We may charge reasonable costs for our time beyond a few hours.

6. Personal data breaches

We will tell you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, aiming to do so within 72 hours (and in any event in time to help you meet your own deadlines). We will tell you what we know: the nature of the breach, the categories and approximate number of people and records affected, likely consequences, and what we are doing about it, and keep you updated as we learn more. Notifying you is not an admission of fault. You are responsible for notifying regulators and affected people where the law requires, and we will help.

7. International transfers

We are based in the UK. Our database is hosted by Supabase in London (AWS eu-west-2). Some sub-processors (for example Vercel, Cloudflare and Resend) process data in the United States or globally. Where Customer Personal Data is transferred out of the UK or EEA to a country without an adequacy decision or data bridge, we rely on:

• for UK data: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement (IDTA), both issued by the ICO, or the UK–US Data Bridge where the recipient is certified to it;
• for EEA data: the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor) as relevant, or the EU–US Data Privacy Framework where the recipient is certified.

Where you are in the EEA and we receive your data in the UK, the UK has an EU adequacy decision. If a transfer mechanism stops being valid, we will work with you to put an alternative in place. Where you are outside the UK/EEA (for example in the US, Canada or Australia), the regional terms in Annex 4 apply.

8. Your obligations

You confirm that: you have a lawful basis and any notices or consents needed for us to process Customer Personal Data (including for sending price-rise notices to your clients by email); your instructions comply with the law; and you will not send us special category data, card or bank details, government ID or tax numbers through Tierstead. You are responsible for the content and timing of any notice you approve, and for any notice period your client contracts or local law require.

9. Price-rise emails sent for you

If you choose to, Tierstead sends price-rise notices to your clients by email on your behalf, using our email provider (Resend). We send them only when you approve them, using the content you approve, and they identify your business as the sender. These are service messages you are responsible for; they are not our marketing.

10. Data minimisation

We only read the Jobber data needed to run Tierstead: client names, emails, phone numbers, service addresses, and recurring job, line item, visit and price data. We do not use Customer Personal Data to train models, for our own marketing, or for any other customer. We may create aggregated, de-identified statistics that cannot reasonably identify you or your clients.

11. No professional advice

Tierstead provides software and suggested calculations. It does not give legal, tax, financial or professional advice, including on whether a price increase or notice is lawful where you or your clients are. Nothing in this DPA changes that.

12. Liability

Each party's liability under or in connection with this DPA is subject to the exclusions and limits of liability in the Main Terms, which apply in total to the Main Terms and this DPA together (and are not a separate cap for this DPA). [Owner to confirm in Main Terms: our total liability is limited to the fees you paid us in the 12 months before the claim.] Nothing in this DPA limits liability that cannot lawfully be limited, or either party's direct liability to data subjects or regulators under Data Protection Laws.

13. Term, changes and law

This DPA lasts as long as we process Customer Personal Data for you, and then until deletion under Section 5.7. We may update this DPA to reflect changes in law, regulator guidance or our sub-processors; material changes that reduce your protection will be notified at least 30 days in advance. This DPA is governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction, except where the SCCs, IDTA or Addendum require otherwise.

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption in transit: all traffic uses TLS 1.2 or higher (HTTPS only, HSTS).
• Encryption at rest: the database and backups are encrypted at rest (AES-256) by our hosting provider.
• Tokens and secrets: Jobber access/refresh tokens are encrypted at rest; session and API tokens we issue are stored only as hashes; secrets are held in the hosting provider's encrypted environment variables, never in code.
• Tenant isolation: Postgres Row Level Security (RLS) ensures each customer can only access its own records.
• Least privilege: staff and service accounts get the minimum access needed; production access is limited to named people with multi-factor authentication.
• Access logging: administrative access and key actions (connecting Jobber, price updates, emails sent) are logged and retained for [90] days.
• Minimisation: only the Jobber fields listed in Annex 1 are requested; no payment data.
• Resilience: managed hosting with automated backups and point-in-time recovery [confirm plan].
• Incident response: a documented process for detecting, containing and notifying breaches (Section 6).
• Supplier checks: sub-processors are chosen for their security certifications (e.g. SOC 2 / ISO 27001) and bound by DPAs.
• Testing: dependency updates and periodic review of these measures.

Annex 3: Authorised sub-processors

Not sub-processors: Jobber (the customer's own platform under its own contract) and Paddle (merchant of record and independent controller of payment data).

Annex 4: Regional terms

United States (CCPA/CPRA and other state laws)

Where US state privacy laws apply (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others), we act as your "service provider" or "processor". We will: (a) process personal information only for the limited and specified business purposes in Annex 1; (b) not sell or share it (including for cross-context behavioural advertising); (c) not retain, use or disclose it outside our direct business relationship with you or for any purpose other than those purposes; (d) not combine it with personal information from other sources except as the law permits; (e) comply with applicable state law and give it the same level of protection the law requires; (f) tell you if we can no longer meet our obligations; (g) allow you to take reasonable and appropriate steps to stop and remediate unauthorised use; (h) bind our sub-processors to equivalent terms; and (i) help you with consumer requests and, where required, data protection assessments. We certify that we understand and will comply with these restrictions.

Canada (PIPEDA and provincial laws)

You remain accountable for personal information you transfer to us for processing. We will use it only for the purposes in Annex 1, protect it with the safeguards in Annex 2, and help you respond to access and correction requests and breach reporting. You should tell your clients that their information may be processed outside Canada (including in the UK and US) by service providers. [Quebec Law 25: assess if the customer is in Quebec.]

Australia (Privacy Act 1988 and the Australian Privacy Principles)

Where you are covered by the Privacy Act, we will handle personal information consistently with the APPs that apply to you, use it only for the purposes in Annex 1, protect it under Annex 2, and tell you promptly of any suspected eligible data breach so you can assess it under the Notifiable Data Breaches scheme. Information may be held in the UK and US (APP 8). [Many small businesses with turnover under A$3m are exempt; confirm with counsel.]

Sources used

• ICO, What needs to be included in the contract: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/
• ICO, Contracts checklist: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/guide-to-accountability-and-governance/contracts/
• ICO, IDTA and Addendum: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/appropriate-safeguards/what-are-standard-data-protection-clauses-the-uk-idta-and-the-addendum/
• European Commission, Standard Contractual Clauses: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
• California Privacy Protection Agency, regulations: https://cppa.ca.gov/regulations/
• Office of the Privacy Commissioner of Canada, PIPEDA: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/
• OAIC, Australian Privacy Principles: https://www.oaic.gov.au/privacy/australian-privacy-principles