1. Scope and purpose
This Data Processing Agreement (“DPA”) forms part of the agreement between FabQT and the customer for use of the FabQT platform. It applies where FabQT processes personal data on behalf of the customer in connection with providing the hosted software service.
This DPA is intended to set out the parties’ respective obligations under applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018.
2. Definitions
In this DPA, “Customer Personal Data” means personal data processed by FabQT on behalf of the customer through the platform. “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach” and “Processing” have the meanings given to them under applicable data protection law.
“Sub-processor” means a third party appointed by FabQT to process Customer Personal Data in connection with providing the service.
3. Roles of the parties
For Customer Personal Data entered into or processed through a customer workspace, the customer will generally act as Controller and FabQT will act as Processor.
FabQT may separately act as a Controller for personal data it processes for its own legitimate business purposes, such as customer account administration, billing, security, support and service communications. Such processing is governed by the FabQT Privacy Policy.
4. Customer instructions
FabQT will process Customer Personal Data only on documented instructions from the customer, unless processing is required by applicable law. The customer’s use and configuration of the FabQT platform, together with the applicable subscription agreement, Terms of Use and this DPA, constitute documented instructions to process Customer Personal Data as necessary to provide, secure, maintain and support the service.
If FabQT is required by law to process Customer Personal Data other than on the customer’s instructions, FabQT will inform the customer before processing unless prohibited from doing so by law.
5. Customer responsibilities
The customer is responsible for ensuring that its processing of personal data and its instructions to FabQT comply with applicable data protection law. In particular, the customer is responsible for:
- Having an appropriate lawful basis for collecting and processing Customer Personal Data.
- Providing any required privacy information to Data Subjects.
- Ensuring that personal data uploaded to FabQT is relevant, appropriate and limited to what is necessary.
- Managing users, roles and access permissions within its tenant.
- Keeping user accounts and credentials secure.
- Responding to Data Subject requests where the customer is the Controller.
- Ensuring any special category or otherwise sensitive information is processed lawfully and with appropriate safeguards.
6. Details of processing
6.1 Subject matter and duration
The subject matter of the processing is the provision of the FabQT SaaS platform and associated hosting, support, maintenance, security and related services. Processing will continue for the duration of the customer’s subscription and for any limited period afterwards during which Customer Personal Data is retained in accordance with applicable deletion, backup and legal retention requirements.
6.2 Nature and purpose
Processing may include collecting, recording, organising, storing, retrieving, viewing, transmitting, backing up, securing, modifying and deleting personal data as required to provide the FabQT service.
6.3 Categories of Data Subjects
Depending on how the customer uses FabQT, Data Subjects may include the customer’s employees, workers, users, directors, clients, suppliers, subcontractors, professional advisers, project contacts and other individuals whose information is entered into the platform.
6.4 Types of personal data
Customer Personal Data may include names, business contact details, usernames, job roles, project information, supplier and subcontractor records, purchasing and sales records, quality and traceability records, training or competency information, health and safety records, documents, correspondence, user activity and other information uploaded by or on behalf of the customer.
7. Confidentiality
FabQT will ensure that persons authorised to process Customer Personal Data are subject to appropriate duties of confidentiality and only have access where required for the performance of their duties.
8. Security of processing
FabQT will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include, as appropriate:
- Logical tenant separation and access controls.
- Role-based user permissions.
- Password-protected accounts and secure authentication controls.
- Encrypted communications where appropriate.
- Server, application and database security controls.
- Backup and recovery arrangements.
- Logging, monitoring and security maintenance.
- Restrictions on administrative and support access.
- Processes for managing vulnerabilities, updates and security incidents.
The customer acknowledges that security measures may evolve as technology, threats and the FabQT platform develop.
9. Personal Data Breaches
FabQT will notify the customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data where notification is required under applicable data protection law.
Where reasonably available, FabQT will provide information concerning the nature of the breach, the categories of data and Data Subjects affected, likely consequences and measures taken or proposed to address the breach. Information may be supplied in phases where it is not possible to provide all details at the same time.
The customer remains responsible, as Controller, for determining whether notification to the Information Commissioner’s Office, affected Data Subjects or any other authority is required.
10. Data Subject rights
Taking into account the nature of the processing, FabQT will provide reasonable assistance to enable the customer to respond to requests by Data Subjects exercising their rights under applicable data protection law.
If FabQT receives a request directly from a Data Subject relating to Customer Personal Data for which the customer is Controller, FabQT may refer the request to the customer unless legally required to respond directly.
11. Data protection impact assessments and regulatory assistance
Taking into account the nature of processing and information available to FabQT, FabQT will provide reasonable assistance where required in connection with data protection impact assessments, prior consultations with supervisory authorities and the customer’s obligations concerning security and breach management.
12. Sub-processors
The customer provides general authorisation for FabQT to appoint Sub-processors where reasonably necessary to provide the service, including providers of hosting and infrastructure, email delivery, payment processing, security, support and other technical services.
FabQT will require Sub-processors that process Customer Personal Data to be subject to data protection obligations appropriate to the services they perform. FabQT remains responsible for its obligations under this DPA in relation to processing carried out by its Sub-processors.
FabQT may change or appoint Sub-processors as the service develops. Where required by applicable law, customers will be provided with appropriate information concerning material changes and an opportunity to raise reasonable data protection objections.
13. International data transfers
FabQT will not transfer Customer Personal Data outside the United Kingdom unless the transfer is permitted under applicable data protection law. Where an international transfer requires additional safeguards, FabQT will ensure an appropriate transfer mechanism is in place, such as an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or another lawful mechanism.
14. Audit and compliance information
FabQT will make available information reasonably necessary to demonstrate compliance with its processor obligations under applicable data protection law and this DPA.
Where further verification is reasonably required, the parties will cooperate in good faith regarding an appropriate audit or assessment. Any audit must be proportionate, protect the security and confidentiality of FabQT and other customers, avoid unnecessary disruption and, unless required by a regulator or following a relevant security incident, be subject to reasonable advance notice.
15. Return and deletion of Customer Personal Data
Following termination or expiry of the customer’s subscription, FabQT will, subject to the functionality and procedures made available by the service, allow Customer Personal Data to be exported or returned where reasonably practicable.
After the applicable retention period, FabQT will delete or render inaccessible Customer Personal Data unless continued retention is required by law. Data contained in backup systems may remain for a limited period until overwritten or deleted in accordance with normal backup cycles.
16. Customer data and ownership
As between the customer and FabQT, the customer retains ownership and control of Customer Personal Data and other customer content submitted to the platform. FabQT acquires no ownership rights in that data merely by processing it to provide the service.
17. Liability and relationship with the Terms
The liability of each party arising from this DPA is subject to the limitations and exclusions of liability contained in the applicable FabQT Terms of Use or other agreement governing the customer’s subscription, except to the extent such limitations are prohibited by law.
If there is a conflict between this DPA and the general Terms of Use concerning the processing of Customer Personal Data, this DPA will take precedence to the extent of that conflict.
18. Changes to this DPA
FabQT may update this DPA where reasonably necessary to reflect changes to the service, applicable law, regulatory guidance or data processing arrangements. Material changes will be communicated where appropriate.
19. Governing law
This DPA is governed by the laws of England and Wales and is subject to the jurisdiction provisions contained in the applicable FabQT Terms of Use.
20. Contact
Questions relating to this DPA, data protection or the processing of Customer Personal Data should be submitted using the support or contact details provided on the FabQT website.