Data Processing Addendum

Scope and roles

This addendum forms part of the Terms of Service and applies where iS3 Ltd processes personal data on behalf of the Customer through Certiqa.

The Customer is the controller. iS3 Ltd is the processor. Each party will comply with the United Kingdom General Data Protection Regulation and the Data Protection Act 2018 as they apply to it.

Where the Customer is established in the European Economic Area, or is otherwise subject to Regulation (EU) 2016/679, references to the United Kingdom GDPR are read as references to that Regulation.

What is processed

Subject matter: the provision of the Certiqa platform.

Duration: for as long as the Customer's subscription runs, and afterwards only as set out under Deletion below.

Nature and purpose: storage, structuring, retrieval, transmission and analysis of management system records, so that the Customer can operate and evidence a management system.

Categories of data subject: the Customer's employees, workers, contractors and crew; the Customer's suppliers' personnel; individuals named in incidents, findings, investigations, audits, acknowledgements and training records; and any other individual the Customer chooses to record.

Categories of personal data: identification and contact details; role and employment information; qualifications, certificates and their expiry; records of actions taken, approvals given and documents acknowledged; the content of any free text the Customer enters.

Special category data: the Customer may record health-related information, for example a medical certificate's validity or an injury recorded in an incident. The Customer is responsible for having a lawful basis and an Article 9 condition. Certiqa does not require special category data in order to function.

Our obligations

We will:

• process personal data only on the Customer's documented instructions, which include the instructions given through normal use of the platform, unless we are required to do otherwise by law, in which case we will tell the Customer first unless the law forbids it
• ensure that everyone authorised to process the data is under an appropriate duty of confidentiality
• implement and maintain appropriate technical and organisational measures, described below
• not engage a sub-processor without the Customer's authorisation, which is given for those listed below and for any replacement notified in advance
• assist the Customer, taking into account the nature of the processing, in responding to requests from data subjects
• assist the Customer with data protection impact assessments and with prior consultation, where the Customer reasonably requires it
• notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, with the information we have at the time and further information as it becomes available
• make available the information reasonably necessary to demonstrate compliance with this addendum, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, on reasonable notice and no more than once a year unless a breach or a regulator requires otherwise

Security measures

The technical and organisational measures we maintain include:

• encryption of data in transit and at rest
• tenant isolation enforced in the database itself by deny-by-default row level security, so that a tenant's data is unreachable from another tenant's session rather than merely filtered by the application
• role-based access control within each tenant, enforced by the database
• multi-factor authentication, available to every account and enforceable by the Customer across its own organisation
• an append-only audit log of changes to governed records
• least-privilege administrative access within iS3 Ltd, with administrative actions audited
• regular backups, held by our hosting sub-processor
• documented procedures for applying changes to the production database

Sub-processors

We use the following sub-processors. Each is engaged under a written contract containing data protection terms no less protective than this addendum.

• Supabase, database and file storage hosting. The Certiqa database is hosted in the United Kingdom (London)
• Vercel, application hosting and content delivery
• Stripe, payment processing and subscription billing
• Resend, transactional email delivery
• Anthropic, the Ai model that powers assistance features within the platform. Content sent for processing is not used to train the model

International transfers

The Certiqa database is in the United Kingdom. Where a sub-processor listed above processes personal data outside the United Kingdom, the transfer is made under the International Data Transfer Agreement, the United Kingdom Addendum to the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism, together with any additional safeguards the transfer requires.

Assistance with data subject rights, and erasure

Certiqa provides a working erasure capability rather than a promise of one. Where the Customer needs to erase a data subject, the platform runs a single controlled operation that reaches every record in the Customer's tenant that relates to that person, deleting or pseudonymising each according to a recorded decision for that record type, and produces a record that it did so.

Two things are deliberately preserved. The append-only audit log retains the fact and sequence of events with the personal content removed, because a log that can be edited evidences nothing. And where a record must be retained to meet a legal obligation, or to establish or defend a legal claim, it is retained and flagged for the Customer rather than silently deleted or silently kept.

Where a record requires human judgement before erasure, for example an uploaded photograph that may contain a person's image, the operation raises it for review rather than guessing.

Deletion and return

During the subscription, the Customer may export its data at any time.

On termination, the Customer may request return or deletion of its personal data. We will comply within a reasonable period, except to the extent that we are required by law to retain it, in which case we will tell the Customer what is retained and why.

Backups are overwritten on their ordinary cycle; data in a backup is not restored into live use after a deletion request.

Liability

Each party's liability under this addendum is subject to the limitations and exclusions in the Terms of Service.

Precedence

Where this addendum conflicts with the Terms of Service on the processing of personal data, this addendum prevails.