Data Processing Addendum

This is the only DPA offered; no per-customer variants.

Roles. The subscribing organisation is the controller of personal data entered into KitLog (staff names, work emails, teams, leave dates). KitLog (Central Technologies Limited, company no. 12231402) is the processor.

Scope of processing. Storage, display, reminder emails to data subjects at the controller's instruction, exports, backups. No other use; no selling; no profiling.

Sub-processors. Hosting (UK/EU region), email delivery (Purelymail), billing (Stripe). A current list is available on request; 30 days' notice of changes.

Security. Encryption in transit, org-scoped access controls, audit logging, daily backups, admin access restricted to the operator for support with audit trail.

Data subject requests. Forwarded to the controller within 72 hours; assistance provided via export and deletion tools.

Breach notification. Without undue delay and within 72 hours of becoming aware.

Deletion. On termination, data is retained 90 days for reactivation, then deleted. Earlier deletion on written request.