Hyfo

Draft, pending solicitor review

This document is a draft. It has not yet been reviewed by a solicitor, it is not legal advice, and it may change before anyone is asked to rely on it.

Data Processing Addendum

Version: 14 October 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Hyfo (“we”, “us”, the “Processor”) and the organisation that subscribes to Hyfo (the “Customer”, the “Controller”). It sets out the terms on which we process personal data for the Customer, as Article 28 of the UK GDPR requires.

1. Meaning of words

“UK GDPR”, “Data Protection Act 2018”, “personal data”, “controller”, “processor”, “data subject”, “processing” and “personal data breach” have the meanings they have in that law. “Customer Personal Data” is the personal data that the Customer and its users put into Hyfo, or that is put in on its behalf, and that we process for it. “Sub-processor” is a third party we engage to process Customer Personal Data.

2. Roles

For Customer Personal Data the Customer is the controller and we are the processor. The Customer decides why and how that data is processed and is responsible for having a lawful basis for it. For the account and billing data about the Customer's users that we use to run the service, we are a controller in our own right, as the Privacy Policy explains. This DPA does not apply to that data.

3. The processing

Subject matterProviding Hyfo to the Customer under the Terms of Service.
DurationThe time the Terms of Service last, and then the period needed to return or delete the data under clause 10.
Nature of the processingHosting, storing, retrieving, displaying, transmitting, copying for backup, and deleting; and, where a user uses an AI-assisted feature, sending the content of that request to the AI provider and returning the result.
PurposeTo provide, secure and support the service for the Customer, and to do what the Customer instructs through its use of it.
Types of personal dataStaff and contractor records (names, contact details, job titles, roles, emergency contacts, right-to-work and qualification details, training and licence records, leave and absence, appraisals); contact details of the Customer's clients and suppliers (names, job titles, e-mail addresses, telephone numbers, postal addresses); timesheets and expense claims, including journey details; HR records; incident and near-miss reports; the locations of survey sites and of staff and subcontractors at work; account and sign-in details; files the Customer uploads, such as receipts and documents. Special category data, such as health information in sickness or incident records, is processed only where the Customer chooses to enter it: [to be confirmed before launch].
Categories of data subjectsThe Customer's employees, workers, contractors, subcontractors and job applicants; the staff of its clients, suppliers and other contacts; and members of the public named in project, survey or incident records.

4. Instructions

We will process Customer Personal Data only on the Customer's documented instructions, which are the Terms of Service, this DPA, and the Customer's use and configuration of the service, unless the law requires otherwise. If so, we will tell the Customer before processing, unless the law forbids that. If we think an instruction breaches data protection law we will tell the Customer.

5. Confidentiality

We make sure that everyone we allow to process Customer Personal Data is bound by a duty of confidentiality, and that access is limited to those who need it to provide the service.

6. Security

We take the measures that Article 32 of the UK GDPR requires, taking into account the state of the art, the cost, and the nature, scope and risk of the processing. The measures built into the service are summarised in the security summary. We may change them, provided we do not materially lower the protection. The Customer is responsible for its own side of security, including who it invites, the roles it gives them, and removing people who leave.

7. Sub-processors

  • The Customer gives us general authorisation to use sub-processors. The ones we use now, what each does and where, are in the list of sub-processors.
  • We will tell the Customer of any intended addition or replacement, giving it at least [to be confirmed before launch] to object. The list says how to be told. If the Customer objects on reasonable data protection grounds and we cannot resolve it, the Customer may end the Terms of Service for the affected service.
  • Some sub-processors are used only when the Customer connects them. By connecting one, the Customer instructs us to exchange data with it, and its own terms apply to what it does with that data.
  • We put in place a written contract with each sub-processor that imposes data protection obligations no less protective than these, and we remain responsible to the Customer for their performance.

8. Helping the Customer

  • Taking into account the nature of the processing, we will help the Customer, by appropriate technical and organisational measures, to answer requests from data subjects to exercise their rights. If a data subject asks us directly, we will pass the request to the Customer and will not answer it ourselves unless told to.
  • We will help the Customer meet its duties on security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner, taking into account the information we hold.
  • We will tell the Customer without undue delay after we become aware of a personal data breach affecting Customer Personal Data, giving what we know about its nature, the categories and approximate numbers of people and records concerned, the likely consequences, and what has been done or is proposed. We will keep the Customer informed as we learn more.

9. International transfers

We will not transfer Customer Personal Data outside the United Kingdom, or allow a sub-processor to, unless there is a lawful route: the UK adequacy regulations (which cover the European Economic Area), the UK International Data Transfer Addendum to the EU standard contractual clauses, the ICO's International Data Transfer Agreement, or another safeguard the law accepts. The route for each sub-processor, and where it processes data, is to be confirmed with each sub-processor: [to be confirmed before launch].

10. Deletion or return

When the Terms of Service end, we will at the Customer's choice return Customer Personal Data or delete it, and delete existing copies, unless the law requires us to keep it. The Customer should make its choice within the period given in the Terms of Service. Copies in backups are removed as the backups expire: [to be confirmed before launch].

11. Information and audits

We will give the Customer the information it reasonably needs to show that we comply with Article 28 of the UK GDPR, and allow for and contribute to audits, including inspections, by the Customer or an auditor it appoints. Audits are on reasonable written notice, no more than once a year unless a personal data breach or a regulator requires otherwise, during normal working hours, under a duty of confidentiality, and so as not to put other customers' data at risk. Each side bears its own costs unless the audit finds a material breach by us.

12. The Customer's duties

The Customer will make sure that it has a lawful basis for the processing, that it has given data subjects the information the law requires, and that its instructions comply with data protection law.

13. Liability and order of documents

Each party's liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails. The law of England and Wales governs it, and the courts of England and Wales have exclusive jurisdiction.

14. Contact

For anything under this DPA, including to be told of changes to sub-processors: hello@hyfo.uk.