Scope and roles
You are the controller of personal data you put in your register, or a processor authorised by your controller. Keepalto acts as your processor or subprocessor. Our separate controller activities, including billing, account security and support administration, are described in the privacy notice. This agreement takes precedence over conflicting subscription wording on processing customer-controlled personal data; mandatory law takes precedence over both.
Processing schedule
Subject matter: hosting and operating your equipment register. Purpose: record equipment, accessories, locations, bookings, handovers, inspections, faults, maintenance, certificates and authorised team activity. Operations include collection, storage, organisation, retrieval, disclosure to your authorised users, export, backup and deletion. People concerned may include your staff, operators, customers, contractors and contacts. Data may include names, business/contact details, assignments, booking history, qualifications, photographs, documents and audit entries. Processing continues during service and the limited closure/backup periods below. Do not upload payment-card data, passwords, health records, biometric identifiers, criminal-history records or unnecessary special-category information.
Your instructions and responsibilities
Providing records, selecting settings, assigning users and making verified support requests are documented instructions to provide this service. You must have an appropriate lawful basis, give necessary notices, minimise the information supplied and control who receives access. We process only on those instructions, including for transfers, unless law requires otherwise. Where permitted, we tell you about a legal requirement before processing. We will tell you if we consider an instruction unlawful and may pause the affected instruction while it is resolved. We do not sell customer register data, use it for cross-context advertising or use it to train AI models.
Confidentiality and security
Access is limited to authorised people who need it to operate or support the service and are subject to confidentiality obligations. Measures include authenticated accounts, server-side business and role checks, private file access, transport encryption, restricted server credentials, platform-admin MFA, audit events, file/usage limits and encrypted off-site backups with a separately held recovery key. Security is tested and maintained according to risk. You remain responsible for your own devices, credentials, staff access and independent safety checks. These controls are not a claim of certification, uninterrupted service or freedom from every vulnerability.
Authorised providers
You give general written authorisation for the providers listed below for their stated purposes. We impose appropriate data-protection obligations on subprocessors and remain responsible for their performance of the processing obligations we owe you. We will notify the account owner of intended additions or replacements at least 14 days before use, unless an urgent security or legal need requires a shorter period. You may object on reasonable data-protection grounds by emailing support. We will seek a reasonable alternative; if none is available, you may end the affected service before the change and receive a proportionate refund of prepaid unused affected service. This specific remedy and mandatory rights override the ordinary no-discretionary-refund policy.
International handling
The operational Supabase project is in London; encrypted R2 backup objects use its EU jurisdiction endpoint. Hosting, email delivery, support and provider administration can involve the United States and other countries. This is not a UK-only hosting promise. Restricted transfers require an applicable adequacy route or contractual safeguards, including the relevant standard contractual clauses and UK Addendum where required. Our review of published provider terms does not certify compliance, verify every provider account’s acceptance or establish that every transfer is lawful. Provider terms, transfer details and supplementary measures are available on reasonable request; third-party confidential information may be redacted. We will not make a restricted transfer without the required safeguards.
Requests, incidents and assistance
We will notify you without undue delay after becoming aware of a personal-data breach affecting your register, provide available information about its nature, effects and mitigation, and update you as facts become available. We will assist proportionately with individual rights, security duties, breach assessment, data-protection impact assessments and regulator consultations, considering the nature of processing and information available. We forward requests about your register to you and do not respond substantively without your instructions unless legally required. You decide notifications to affected people and authorities for your controller activities.
Return, deletion and backup expiry
At the end of service, you may choose return or deletion of your customer-controlled personal data. Exports and verified support requests remain available for this purpose; we do not withhold personal data to force renewal. The ordinary account recovery window is a minimum of 30 days after operational access ends. Closure and deletion are currently handled by support, not an automatic purge. On your verified deletion instruction we remove live records without undue delay, except information lawfully retained, and confirm completion or explain the exception. Residual encrypted backup copies are isolated from ordinary use and expire through the 35-day backup cycle. If a backup is restored, recorded deletion instructions must be reapplied before customer access. Confidentiality and security continue until deletion. Separate legally required billing/security records are retained only for their justified purposes.
Evidence and audits
We will provide information reasonably needed to demonstrate these processing obligations and allow and contribute to audits or inspections by you or your authorised independent auditor. Agree reasonable notice, scope, confidentiality and security arrangements so other customers’ records are protected. Existing evidence can be used where sufficient, but does not remove audit rights required by law. We will notify you if we can no longer meet the applicable processing obligations and cooperate on appropriate remediation.
US service-provider restrictions
Where applicable US privacy law treats us as a service provider or contractor, we use customer-controlled personal information only for the specified service purposes or as the law permits, not outside the direct relationship. We do not sell or share it for cross-context behavioural advertising, or combine it with unrelated third-party or consumer-interaction data except as permitted by law. You may take reasonable steps to verify compliant use, stop unauthorised use and require remediation. We will notify you if we determine that we cannot meet these obligations.
Provider register
Supabase: authentication, London database and private attachments; Netlify: website delivery, server-side requests and scheduled jobs; Cloudflare R2: encrypted EU-jurisdiction backup storage; Resend: transactional messages, recipients and delivery events; Google Workspace: support correspondence you send us. Stripe handles subscription billing and also acts as an independent controller for certain payment, fraud and regulatory purposes; do not put register contents into Stripe. Provider subprocessors and international processing details are governed by the linked provider documents. No advertising-pixel or AI-generation provider is part of Keepalto’s register workflow.