Data processing agreement

Last updated 25 October 2026. Draft, to be reviewed. This agreement forms part of the Upkept Logbook terms.

1. Parties

The customer that opens a Logbook account (the controller) and Upkept, Upkept, London, United Kingdom (the processor).

2. Subject matter and duration

The processing of personal data contained in compliance records the controller’s team enters into the Logbook, for as long as the account exists plus the retention period chosen by the controller.

3. Nature and purpose

Storing, displaying, exporting and backing up records; sending reminders and digests; providing offline sync; producing PDF exports. No other purpose.

4. Types of personal data

• Staff display names and hashed PINs.
• Names of people recorded as performing checks or corrective actions, with timestamps.
• Free-text notes and support messages, which may include personal data the controller chooses to enter.
• Optional photos, which must not show people.
• Push notification endpoints and preferences.

5. Data subjects

The controller’s staff and managers, and anyone the controller names in a note.

6. Processor obligations (Article 28(3))

1. Process personal data only on the controller’s documented instructions, including for transfers, unless required by UK law, in which case the processor informs the controller first where the law allows.
2. Ensure that people authorised to process the data are under a duty of confidentiality.
3. Take the security measures required by Article 32, including row-level security, append-only hash-chained records, hashed PINs, encryption in transit and at rest, and daily backups.
4. Engage sub-processors only under the conditions in section 7.
5. Assist the controller, taking into account the nature of the processing, in responding to data subject requests, with the export tools in the product and by email.
6. Assist the controller with Articles 32 to 36 (security, breach notification, impact assessments and consultation), including notifying the controller of a personal data breach without undue delay.
7. At the end of the service, delete the personal data after the controller’s chosen retention period, having made export available throughout, unless UK law requires storage.
8. Make available the information needed to demonstrate compliance and allow for and contribute to audits, including inspections, conducted by the controller or an auditor mandated by the controller, on reasonable notice.

7. Sub-processors

The controller gives general authorisation for these sub-processors: Supabase (database, authentication, storage; UK region), Vercel (hosting, scheduled jobs), Stripe (payments), Resend (email), Sentry (error reporting), PostHog (analytics, EU), MailerLite (marketing, consent only), Zoho (support inbox). The processor will inform the controller of any intended change by email at least 30 days before, and the controller may object; if the objection cannot be resolved the controller may end the service and export its data.

8. International transfers

Records are stored in the United Kingdom. Where a sub-processor processes personal data outside the UK, the transfer relies on a UK adequacy decision or the UK International Data Transfer Addendum to the EU standard contractual clauses.

9. Deletion at the end

When the retention period ends, or earlier on the controller’s request (handled by a person within 30 days), the processor deletes the controller’s records and confirms deletion by email. Backups roll off within 30 days after that.

10. Liability and law

Liability is as set out in the terms. This agreement is governed by the law of England and Wales.