Data Processing Agreement
1. Scope and roles
This DPA applies where Opsemble Ltd ("Processor") processes personal data within Customer Data on behalf of the Customer ("Controller") in providing the OpSemble Service. It is entered into by acceptance of the Terms and governed by UK GDPR and the Data Protection Act 2018.
2. Details of processing
| Subject matter | Hosting and processing of business-management data in the OpSemble platform |
|---|---|
| Duration | The subscription term plus the wind-down period in the Terms |
| Nature and purpose | Storage, retrieval, display, automation (workflows), reporting, email sending, and optional AI-assisted analysis, all at the Controller's instruction via the Service's features |
| Data subjects | The Controller's employees, workers and candidates; customer and supplier contacts; site visitors and contractors; portal users |
| Categories of data | Contact and identity data; employment records (including leave, absence, payroll-adjacent, recruitment and training data); health & safety records (incident and occupational data, which may include special category health data); commercial and financial records |
3. Processor obligations
- Process personal data only on the Controller's documented instructions (given through use of the Service), unless required by law.
- Ensure persons authorised to process the data are bound by confidentiality.
- Implement the technical and organisational measures in Annex B.
- Assist the Controller with data subject requests (the Service provides in-app DSAR export and erasure tooling), security, breach notification and DPIAs, taking account of the nature of processing.
- Notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Data, and in any event within 72 hours.
- At termination, delete or return Customer Data per the Terms, unless law requires retention.
- Make available information reasonably necessary to demonstrate compliance and allow audits no more than once in any 12-month period, on at least 30 days' written notice, at the Controller's cost.
4. Subprocessors
The Controller gives general authorisation for the subprocessors below. We will give 30 days' notice of changes (via this page and/or email), during which the Controller may object on reasonable grounds.
| Subprocessor | Purpose | Location / transfer mechanism |
|---|---|---|
| Microsoft Azure | Application hosting, SQL database, blob storage | Database: UK South (United Kingdom); application hosting and file storage: West Europe (EU). EEA processing is permitted under UK adequacy regulations. Microsoft DPA |
| Azure Communication Services | Transactional and notification email | Microsoft global email infrastructure; Microsoft DPA |
| Anthropic | AI assistant and AI-assisted features (only when used; tenant admins can disable) | USA; UK Addendum / IDTA + Anthropic commercial terms (no training on customer data) |
| Cloudflare | DNS, TLS and content delivery for tenant subdomains | Global network; UK Addendum / SCCs |
| Stripe (if/when payment features are live) | Card payment processing for customer invoicing features | USA/EU; Stripe DPA |
| GoCardless (if/when payment features are live) | Direct debit processing for customer invoicing features | UK; GoCardless terms |
5. International transfers
Where a subprocessor processes personal data outside the UK, transfers rely on UK adequacy regulations where available, otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs, plus supplementary measures where appropriate.
Annex A — Controller instructions
The Controller instructs the Processor to process Customer Data as needed to provide the Service features the Controller uses, including configured workflows, webhooks and integrations, email sending, and AI features where enabled.
Annex B — Technical and organisational measures
- Encryption in transit (TLS) for all traffic; encryption at rest via Azure storage/SQL encryption.
- Logical multi-tenant isolation enforced at the data layer with fail-closed tenant filters.
- Role-based access control with per-module permissions; optional company-enforced two-factor authentication.
- Tamper-evident audit logging of sign-ins and data changes, with integrity verification and configurable retention.
- Backups via Azure SQL point-in-time restore (7-day window); production and staging run on separate databases and application instances.
- Access to production limited to authorised personnel; secrets managed via Azure configuration.
- Platform patching is managed by Azure PaaS; application dependencies are updated with each release; incidents are triaged by the director with Controller notification per clause 3; production access is limited to the director.