Data Processing Agreement

> Reviewed against current UK law; under ongoing internal review. Not formal legal advice.

Last updated: 17 July 2026

This Data Processing Agreement ("DPA") is entered into between OptitechAutomation — a UK sole trader (the personal business of Cristian Moise-Putanu), based in Torquay, Devon, United Kingdom ("Processor"), and the business customer who has accepted the Terms of Service ("Controller") in connection with the use of the OptitechAutomation booking platform ("Platform").

This DPA supplements the Terms of Service and, in the event of conflict on data protection matters, this DPA prevails.

---

1. Definitions

• "Controller" means the trade business using the platform who determines the purposes and means of processing personal data relating to their customers and workers.
• "Processor" means OptitechAutomation, processing personal data on behalf of the Controller.
• "Data Subjects" means the customers and workers whose personal data is processed through the platform.
• "UK GDPR" means the UK General Data Protection Regulation as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018.

---

2. Scope of Processing

The Processor processes personal data on behalf of the Controller for the purposes of:

• Facilitating appointment bookings between the Controller's customers and workers.
• Sending transactional emails on behalf of the Controller (booking confirmations, reminders, status updates).
• Managing worker scheduling and communications.
• Generating invoices and managing payments.
• Storing booking history and related records.

Categories of personal data processed: names, email addresses, phone numbers, postcodes, booking details, payment references.

---

3. Processor Obligations

The Processor shall:

• Process personal data only on documented instructions from the Controller (as set out in the Terms of Service and these standard operations).
• Ensure that persons authorised to process personal data are bound by an appropriate duty of confidentiality.
• Implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration (see Section 5).
• Not engage sub-processors without prior authorisation; authorised sub-processors are listed in our Sub-Processors List at /legal/sub-processors.
• Assist the Controller in responding to Data Subject rights requests under UK GDPR Articles 15–22.
• Notify the Controller without undue delay (and within 72 hours where feasible) upon becoming aware of a personal data breach.
• Delete or return all personal data upon termination of the service, and delete existing copies unless required by law.

---

4. Controller Obligations

The Controller warrants that:

• It has a lawful basis for collecting and processing personal data before sharing it with the Processor.
• It has provided appropriate notice to Data Subjects about how their data is used (including this DPA and the Privacy Policy).
• It will notify the Processor promptly of any change that affects the lawfulness of the processing.

---

5. Security Measures

The Processor maintains the following technical and organisational measures:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access controls with Row Level Security policies in the database.
• Audit logging of all privileged operations.
• Encrypted storage of third-party API credentials.
• Regular access reviews and background screening for personnel with data access.

---

6. Sub-Processors

The Controller authorises the Processor to engage the sub-processors listed at /legal/sub-processors. The Processor will notify the Controller of any intended addition or replacement of sub-processors by updating the Sub-Processors List and providing 30 days' notice.

---

7. International Transfers

Controller personal data is primarily hosted within the European Economic Area (Republic of Ireland — Dublin, AWS eu-west-1). Transfers from the UK to the EEA take place under the UK's adequacy regulations for the EEA (UK GDPR Article 45, as given effect by the Data Protection Act 2018); no Article 46 safeguard is required for that hosting.

Where the Processor transfers personal data to a country not covered by UK adequacy regulations (for example, to United States sub-processors), the Processor ensures a valid UK transfer mechanism is in place before the transfer, being one of:

• the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge"), where the recipient is certified;
• the ICO's International Data Transfer Agreement (IDTA); or
• the UK Addendum to the EU Standard Contractual Clauses,

in each case supported by a transfer risk assessment where required by ICO guidance. The mechanism relied on per sub-processor is recorded in the Sub-Processors List at /legal/sub-processors.

---

8. Audit Rights

The Controller may, upon 30 days' written notice and no more than once per year, request an audit of the Processor's compliance with this DPA. The Controller bears all costs of such an audit. Where a third-party audit is requested, the auditor must be agreed by both parties.

---

9. Term and Termination

This DPA remains in force for the duration of the Terms of Service. Upon termination, the Processor will delete all personal data belonging to the Controller's Data Subjects within 90 days, unless a longer retention period is required by law.

---

10. Assignment

We may assign, transfer, or otherwise deal with all or part of our rights and obligations under this Agreement to any successor entity without your consent, on 30 days' prior written notice.

---

11. Governing Law

This DPA is governed by the laws of England and Wales.

---

12. Contact

OptitechAutomation — Cristian Moise-Putanu (sole trader)

Torquay, Devon, United Kingdom

privacy@optitechautomation.co.uk