DATA PROTECTION
Data Processing Agreement
This Data Processing Agreement is entered into between Safeli Limited (company registered in England and Wales, company no. 16932254, ICO registration no. CSN8470526) and the Client named in the accompanying services agreement. It supplements and forms part of that agreement.
1. Definitions
In this Agreement, the following terms have the meanings set out below:
- "Controller" means Safeli Limited, acting as the data controller in respect of personal data processed on behalf of the Client.
- "Processor" means the Client, or any sub-processor appointed pursuant to this Agreement.
- "Personal Data" has the meaning given in the UK GDPR and the Data Protection Act 2018.
- "Processing" has the meaning given in the UK GDPR.
- "Services" means the Safeli compliance management platform and any associated professional services.
- "Sub-processor" means any third party engaged by Safeli to process personal data in connection with the Services.
- "UK GDPR" means the UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018.
2. Scope and purpose
This Data Processing Agreement ("DPA") forms part of the agreement between Safeli Limited ("Safeli") and the Client for the provision of the Services. It sets out the terms on which Safeli processes personal data on behalf of the Client.
Safeli processes personal data only on documented instructions from the Client, unless required to do so by applicable law. The subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects are set out in Schedule 1.
3. Safeli's obligations
Safeli shall, in relation to any personal data processed in connection with the Services:
- Process that personal data only on the Client's documented instructions, unless required by applicable law.
- Ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations.
- Implement and maintain the technical and organisational measures described in Schedule 2.
- Assist the Client in responding to data subject requests and in meeting obligations under Articles 32-36 UK GDPR.
- Delete or return all personal data at the end of the provision of the Services, unless retention is required by law.
- Make available all information reasonably necessary to demonstrate compliance with this DPA.
- Allow for and contribute to audits, including inspections, conducted by the Client or its appointed auditor.
4. Client's obligations
The Client warrants and represents that:
- It has a lawful basis for processing all personal data provided to Safeli under the Services.
- It has provided all required privacy notices to data subjects whose personal data is submitted to the platform.
- Its instructions to Safeli comply with applicable data protection law.
- It will promptly notify Safeli of any changes to its instructions or any known or suspected data breach.
5. International transfers
Safeli is built on infrastructure provided by Base44 Ltd. Personal data may be processed outside the UK and EEA. All such transfers are made using one or more of the following lawful transfer mechanisms:
- UK International Data Transfer Agreements (IDTA) or Addendum to EU Standard Contractual Clauses where applicable.
- Adequacy regulations where the destination country has been recognised as adequate.
- The EU-US Data Privacy Framework, where Base44 Ltd. is an active participant.
Base44 Ltd. maintains a public sub-processor list and commits to notifying customers of any planned additions or replacements, allowing reasonable time to object. Details are available at base44.com.
6. Sub-processors
The Client provides general authorisation for Safeli to engage sub-processors. Safeli will give reasonable prior notice of any intended changes to sub-processors and the Client may object within 14 days on reasonable grounds.
Safeli requires all sub-processors to comply with data protection obligations materially equivalent to those set out in this DPA. A current list of sub-processors is available on request.
7. Security
Safeli implements and maintains appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures are set out in Schedule 2.
Safeli will notify the Client without undue delay (and within 72 hours where feasible) on becoming aware of a personal data breach affecting the Client's data.
8. Data subject rights
Safeli shall promptly notify the Client of any data subject request received directly from a data subject in relation to the Client's data. Safeli will assist the Client to fulfil its obligations in respect of such requests, taking into account the nature of the processing and information available.
9. Termination and return of data
On termination of the Services, Safeli will, at the Client's choice, either securely delete or return all personal data processed on the Client's behalf. The Client may export all of its data - sites, documents, actions and assessments - directly from the portal at any time during the term of the Services, and may request a final export in spreadsheet or PDF format on termination.
Safeli may retain personal data where required by applicable law, for the minimum period required.
10. Governing law
This DPA and any dispute or claim arising out of it shall be governed by and construed in accordance with the laws of England and Wales. The parties submit to the exclusive jurisdiction of the courts of England and Wales.
Schedule 1 - Processing Details
| Subject matter | Provision of compliance management services, including risk assessments, document management, action tracking and reporting. |
| Duration | For the term of the Services agreement between Safeli and the Client. |
| Nature of processing | Collection, storage, organisation, use, disclosure, erasure and destruction. |
| Purpose | Enabling the Client to manage fire, water hygiene and health & safety compliance obligations across its sites. |
| Types of personal data | Names, job titles, email addresses, phone numbers, digital signatures, and photographs of people and premises. |
| Categories of data subjects | The Client's employees, contractors, site visitors and key contacts recorded in the platform. |
Schedule 2 - Technical and Organisational Measures
| Encryption | All data encrypted in transit (TLS 1.2+) and at rest (AES-256). Key management maintained by the cloud provider. |
| Access control | Role-based permissions (admin, consultant, client) with per-site scoping. Users only access data they are explicitly assigned. |
| Infrastructure certification | Hosted on ISO/IEC 27001:2022 certified infrastructure (cert. no. 1127009, valid until June 2028). |
| Penetration testing | The platform undergoes periodic penetration testing and security audits by external auditors. |
| Audit logging | Complete, timestamped audit trail of all data access and modifications. |
| Incident response | Documented incident response procedures with 72-hour breach notification commitment. |
| Sub-processor oversight | Written agreements with all sub-processors incorporating equivalent data protection obligations. |
| Data minimisation | Collection limited to data necessary for the provision of the Services. |
Putting this agreement in place
This DPA takes effect when you enter into a services agreement with Safeli and is incorporated into it by reference. No separate signature is required - it applies automatically to all clients using the Safeli platform.
A countersigned copy, or a version on company letterhead, is available on request at any time.