Data Processing Agreement

Last updated: October 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service between SafetyCore Ltd ("we", the processor) and the organisation that subscribes to SupplierCore ("you", the controller). It applies to personal data we process on your behalf when providing SupplierCore, and meets the requirements of Article 28 of the UK GDPR.

1. What we process

• Subject matter: providing SupplierCore to you under the Terms.
• Duration: for as long as you subscribe, and 90 days after, as set out in section 8.
• Nature and purpose: storing, organising, displaying, sending and deleting data so that you can approve suppliers, request and review documents, and manage raw materials and specifications.
• Types of personal data: names, job titles, email addresses and phone numbers of your staff and of your suppliers' contacts; sign-in and activity records; and any personal data contained in documents uploaded by you or your suppliers.
• Data subjects: your staff and users, and the people at your suppliers and customers whose details you record or who use the supplier portal or a sign-off link.

You must not use SupplierCore to record special category data or criminal offence data.

2. Our obligations

We will:

• Process the personal data only on your documented instructions, which are these Terms and your use of SupplierCore's features, unless the law requires otherwise, in which case we will tell you first unless the law forbids it
• Ensure that anyone we authorise to process the data is bound by confidentiality
• Keep the data secure with appropriate technical and organisational measures, as described in section 4
• Help you respond to requests from data subjects exercising their rights, and pass on any such request we receive directly
• Help you meet your obligations on security, breach notification, data protection impact assessments and consultation with the ICO, taking into account the nature of the processing
• Make available the information you reasonably need to show compliance with Article 28, and allow for and contribute to audits, on reasonable notice and no more than once a year unless a breach has occurred

3. Sub-processors

You authorise us to use these sub-processors:

• Cloudflare, Inc.: the secure network connection to our servers
• Resend, Inc.: sending email, such as invitations, document requests and reminders
• Anthropic PBC: reading details from uploaded certificates
• Stripe Payments UK Ltd: payments (your billing details only)

We will give you at least 30 days' notice by email before adding or replacing a sub-processor, so that you can object. We bind each sub-processor to data protection terms no less protective than this DPA, and remain responsible for its performance. Where a sub-processor processes data outside the UK, we rely on the UK International Data Transfer Addendum or another transfer mechanism recognised under UK law.

4. Security measures

• SupplierCore runs on servers we operate in the United Kingdom, reached only through an encrypted connection
• Each organisation's data is kept apart by row-level security in the database
• Invite-only accounts, role-based permissions, two-factor sign-in that you can require for your organisation, and account lockout after repeated failed sign-ins
• Files are stored outside the web server and are downloadable only through short-lived signed links
• A tamper-evident audit trail of every change
• Nightly backups, kept for 14 days, with a tested restore

5. Personal data breaches

We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations to report it.

6. Your obligations

You are responsible for having a lawful basis for the personal data you record in SupplierCore, for giving the people concerned the information required by UK GDPR, and for the accuracy of the data and the instructions you give us.

7. International transfers

We store your data in the United Kingdom. Transfers outside the UK happen only through the sub-processors listed above and under the safeguards described in section 3.

8. Return and deletion

You can export your registers as CSV at any time. When your subscription ends, we keep your data for 90 days so that you can export it, then delete it, including from backups as they expire, unless the law requires us to keep it. You can ask us to delete it sooner.

9. Contact

For questions about this DPA, or to request a signed copy, email [email protected].
SafetyCore Ltd, Nantwich, Cheshire, United Kingdom.