Data processing agreement

ExOps · Version 2 · 24 September 2026

For signature by M J Electrical and Technical Ltd (as supplier of ExOps) and each customer company that uses ExOps.

This agreement is required by Article 28 UK GDPR. It is not optional: without it, neither side is lawfully able to let the other handle personal data. It is written to be read and signed by a small business, not by a legal department, but every term Article 28 requires is in it.

1. Who is who

You (the customer company named in the schedule) are the controller. Your customers, your staff and your subcontractors are your data, and you decide what is done with them.

We, M J Electrical and Technical Ltd, company number 10155038, of 135 Powell Avenue, Blackpool FY4 3HQ, supply ExOps and are your processor. We act on your instructions and we do not use your data for our own purposes.

Where we are also running our own electrical business on ExOps, that is a separate company account with its own data, and it is not connected to yours. Nobody in our business can read your records except as set out in clause 6.

2. What this covers


Subject matter	Running the ExOps job management system for your business
Duration	For as long as your account is open, plus the return-and-deletion period in clause 10
Nature and purpose	Storing and processing the records you put into ExOps so that you can quote, schedule, certify, invoice and keep the records your trade requires
Types of personal data	Names and contact details; site and home addresses; job, quote, invoice and payment records; photographs, videos and site recordings; certificates and test results; employment records, pay, hours and locations; right-to-work and DBS records; subcontractor and supplier details
Special category and criminal data	Health data (sickness, fit notes, accidents); criminal offence data (DBS outcomes). Processed only because your business needs it and only under the conditions in your own Appropriate Policy Document
Categories of data subject	Your customers and their contacts; your employees, apprentices and subcontractors; your suppliers; anyone named in a job, certificate or accident record

3. Our instructions come from you

We process personal data only on your documented instructions. Using ExOps as it is designed to be used is itself an instruction. We will tell you if we think an instruction breaks data protection law, and we may refuse it.

If the law requires us to process your data some other way (for example a court order), we will tell you first unless the law forbids that.

4. Confidentiality

Everyone we let near your data is under a duty of confidentiality, in their contract of employment or in writing.

5. Security

We take the measures Article 32 requires, and specifically:

individual named logins; no shared accounts; two-step sign-in available and required for administrator access
server-side security rules that decide who may read or write each record, with an automated test suite that runs on every release and must pass before anything is deployed
encryption in transit and at rest
daily backups, with a restore check
an activity log of who changed what and when, kept for six years
no hard deletes outside an approved retention review, and a deletion log
a data breach log and a procedure for reporting to the ICO within 72 hours

We review these yearly and after any incident.

6. Who else can see it

Our staff. Only people who need to for support, and only with your account's permission or where you have asked us to look at something. Every such access is in the activity log and you can see it.

Sub-processors. We use the companies listed in Schedule 2. You agree to them now. If we want to add or change one, we will tell you at least 30 days beforehand; if you object on reasonable data protection grounds within that time and we cannot resolve it, you may end this agreement without penalty and we will return your data under clause 10.

Every sub-processor is under written terms at least as protective as these, and we stay responsible to you for what they do.

7. International transfers

Your data is held in Google's European data centres and processed in London. Where a sub-processor processes data outside the UK, the transfer relies on UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the International Data Transfer Addendum. We do not transfer your data anywhere else without telling you.

8. Helping you meet your own duties

We will help you, at no extra charge for anything reasonable:

Requests from individuals. ExOps lets you find, export, correct, restrict and erase a person's records yourself. Where you cannot, tell us and we will do it within 5 working days. If a request comes to us instead of you, we will pass it to you and not answer it.
Breaches. If there is a personal data breach affecting your data we will tell you without undue delay and in any case within 24 hours of becoming aware, with what we know, what we are doing and what you may need to report. Your 72-hour clock is yours to meet; we will give you what you need in time to meet it.
Assessments. We will give you what you need for a data protection impact assessment or a consultation with the ICO.

9. Audit

We will give you the information you need to show this agreement is being kept, including our security summary and our latest rules test results. You may audit us, or appoint an auditor, once a year on 30 days' notice, at your cost, at a reasonable time, without disrupting other customers. A serious breach entitles you to audit immediately.

10. Ending it, and getting your data back

When your account ends, or on your written request at any time:

Your data stays available to export for 30 days.
In that window you can download everything — jobs, customers, quotes, invoices, certificates, staff records, photographs and files — in a machine-readable format. Ask us and we will produce the export for you.
After 30 days, if you have asked for deletion, we delete your account's data and confirm in writing. Backups roll off within a further 100 days.
We keep nothing except what the law requires us to keep, and anything kept that way stays protected by this agreement until it is deleted.

We will not hold your data hostage over a disputed invoice.

11. Liability, and the rest

This agreement sits alongside our terms of service. Where they conflict on anything to do with personal data, this agreement wins. It is governed by the law of England and Wales.

Neither of us excludes liability that cannot lawfully be excluded, including under Article 82 UK GDPR to the people whose data it is.

Schedule 1 — your details


Company name
Company number
Registered address
Contact for data protection matters
Email
Date account opened

Schedule 2 — sub-processors

Who	What they do	Where
Google Ireland / Google Cloud	Hosting, database, file storage, notifications, and the AI features (Vertex AI, London region — your data is not used to train Google's models)	EU / UK
Brevo (Sendinblue)	Sending email and text messages on your behalf	EU
Stripe	Card payments, only if you switch them on	UK / EU / US (DPF)
Xero, Intuit (QuickBooks) or Sage	Your accounts software, only the one you connect and only once you connect it	UK / EU
postcodes.io	Turning a postcode into a map position. Only the postcode is sent	UK
Velocity	Vehicle trackers, only where you have them fitted	UK

A browser using ExOps also fetches map tiles from the OpenStreetMap Foundation and software libraries from Cloudflare's public code service. Neither receives any of your records; they see only the request and the browser's IP address.

Signed for M J Electrical and Technical Ltd

Name ............................ Position ............................

Signature ............................ Date ............................

Signed for the customer company

Name ............................ Position ............................

Signature ............................ Date ............................