Data Processing Agreement

Last updated: 18 August 2026

1. About this agreement

This Data Processing Agreement (DPA) forms part of the ScaffKeep Terms & Conditions between you (the Customer) and Keepsuite Technologies Ltd (we, us). It applies where we process personal data about your operatives on your behalf. For that data, you are the controller and we are your processor under UK data protection law. You accept this DPA when you agree to the Terms.

2. Subject matter and duration

We process operatives’ personal data for the purpose of providing ScaffKeep, for as long as your subscription is active, plus any short period needed to return or delete the data afterwards.

3. Nature and purpose of processing

Storing, organising, retrieving and transmitting operatives’ compliance documents and related details; sending document-upload requests and expiry reminders; and generating compliance reports.

4. Type of personal data

Operative names and contact details; CISRS card details; public and employers’ liability insurance details; RAMS; uploaded document files; and associated dates.

5. Categories of data subjects

Your operatives and workers.

6. Our obligations as processor

We will:

• process the personal data only on your documented instructions (including on transfers), unless the law requires otherwise, in which case we will tell you unless the law prevents us;
• ensure that people authorised to process the data are under a duty of confidentiality;
• put in place appropriate technical and organisational security measures, including keeping each customer’s data isolated from others, holding documents in private storage, making files accessible only through short-lived secure links, encrypting data in transit, and restricting access;
• use only the sub-processors listed below, impose equivalent data-protection terms on them, and give you advance notice of any change and a chance to object;
• assist you, taking account of the nature of the processing, in responding to requests from operatives to exercise their rights;
• assist you with security, personal data breach notification, data protection impact assessments and prior consultation, and notify you without undue delay if we become aware of a personal data breach affecting your data;
• at your choice, delete or return all the personal data at the end of the service and delete existing copies, unless the law requires us to keep it; and
• make available the information you reasonably need to demonstrate compliance with this DPA, and allow for and contribute to audits.

7. Sub-processors

We use Base44 (application hosting) and Resend (sending upload requests and reminders, which include operatives’ email addresses) to process operatives’ personal data on our behalf. (Stripe processes your own account and billing data, not operatives’ data — see our Privacy Notice.)

8. International transfers

Where a sub-processor processes personal data outside the UK, it is protected by an appropriate safeguard: a UK adequacy decision, or the UK International Data Transfer Agreement (or the UK Addendum to the SCCs).

9. Liability

The limitations and exclusions of liability in the Terms apply to this DPA.