Data processing agreement

1. The parties

The business using RunSheet is the controller. We are the processor:

• Business: Livelihood Ventures Ltd, company number 17496152
• Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
• Email: hello@schoolrunsheet.co.uk
• ICO registration number: [to be added]

2. What we process

3. Our commitments as processor

We will:

1. process the data only on your documented instructions, which are these terms and how you use RunSheet, unless the law requires otherwise (in which case we’ll tell you first, if we legally can);
2. tell you straight away if we think an instruction breaks data protection law;
3. make sure everyone who can access the data is bound by confidentiality;
4. keep the security measures in section 6 in place;
5. only use the sub-processors in section 7, under written terms that protect the data as well as this agreement does;
6. help you respond to people exercising their rights, such as access or correction requests;
7. help you meet your obligations on security, breach notification and data protection impact assessments, as far as RunSheet is concerned;
8. tell you about a personal data breach without undue delay, and within 48 hours of becoming aware of it, with the information you need;
9. give you the information you need to show this agreement is being met, and allow reasonable audits with at least 30 days’ notice.

4. Your commitments as controller

• You have a lawful basis for the data you put into RunSheet and for asking us to process it.
• You tell your drivers, PAs and staff how their data is used.
• Your instructions to us comply with data protection law.

5. Transfers outside the UK

Data is stored in Ireland. Where a sub-processor handles data outside the UK and EU, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another safeguard recognised under UK law.

6. Security measures

• Bank account numbers and sort codes are encrypted in the database with AES-256-GCM; lists only ever show the last 4 digits.
• Passwords and PINs are stored only as bcrypt hashes. Logins lock for 15 minutes after 5 wrong attempts.
• Every company’s data is kept separate, and this is checked by automated tests.
• All traffic uses HTTPS. Login cookies are HTTP-only and secure.
• The database is not publicly reachable, and every table has row level security switched on.
• Invite and details links are single-use, expire, and are stored only as hashes.
• If someone changes bank details that were already checked, their payments are held until the office confirms.
• Each person sees only what their role needs: drivers and PAs their own invoices, accountants only who to pay.
• Every action is recorded in a history that can’t be changed from inside RunSheet.

7. Sub-processors

You give general permission for us to use these sub-processors. We’ll give you at least 30 days’ notice of any new one, and you can object; if we can’t resolve your objection, you can end the agreement.

8. Liability

Each party’s liability under this agreement is subject to the limits in our terms of service, except where the law doesn’t allow it to be limited.

9. At the end

When you stop using RunSheet, you can download all of your data. We delete it within 90 days of the agreement ending, unless the law requires us to keep it, and confirm the deletion on request.