Data Processing Addendum
Effective from: 12 October 2026 · Version: 3.1
1. Parties, status and precedence
1.1 This Addendum forms part of the 360Synk Terms of Service between the Customer (the "Controller", "you") and 360 Synk Software Ltd, company number NI734698, registered office 3 Drumard Cottages, Ballymena, Co. Antrim BT42 2PX (the "Processor", "360Synk", "we").
1.2 It sets out the terms required by Article 28 of the UK GDPR and the Data Protection Act 2018 for personal data we process on your behalf through the Service. It takes effect when you first become bound by the Terms of Service or first give us personal data, whichever is earlier, and lasts for as long as we process personal data for you.
1.3 If this Addendum conflicts with the Terms of Service or an Order on anything about personal data, this Addendum wins.
2. Words we use
"Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "special category data" have their UK GDPR meanings. "Customer Data" is defined in the Terms of Service. "Sub-processor" means a third party we engage to process Customer personal data. "Restricted transfer" means a transfer of personal data from the UK to a country or recipient that UK law does not treat as adequate without further safeguards.
3. Roles
3.1 You are the controller, and we are the processor, of personal data in Customer Data, except where the law gives a particular activity a different role.
3.2 We are a separate controller for the limited data described in our Privacy Notice (account administration, billing, sign-in security, service diagnostics and our own communications). That processing is governed by the Privacy Notice, not this Addendum.
3.3 You are responsible for: a lawful basis for the processing you ask us to do; privacy information to the people concerned; collecting and disclosing personal data lawfully; giving lawful instructions; and deciding how long your records are kept, within what the Service supports. Nothing here relieves either party of duties the law places on it directly.
4. Instructions
4.1 You instruct us to process personal data as needed to provide, host, secure, maintain, support and administer the Service and to carry out the processing in Annex 1.
4.2 The Terms of Service, this Addendum, your configuration of the Service (including switches such as location sharing, client-portal settings and connected accounting packages) and your lawful use of its features are your documented instructions.
4.3 We will not process personal data for a materially different purpose unless you instruct us or the law requires it. If the law requires us to process other than on your instructions we will tell you first unless the law forbids it. If we believe an instruction breaks data-protection law we will tell you without undue delay and may pause the affected processing until it is clarified.
4.4 We will not sell Customer personal data, use it for third-party advertising or unrelated profiling, or use it to train an artificial-intelligence model for our own commercial benefit unless you separately agree in writing and the law allows.
5. Details of the processing
The subject matter, duration, nature, purposes, categories of data subject and categories of personal data are in Annex 1. The scope depends on your Plan, the features you enable and the information you choose to enter.
6. Our people
6.1 Everyone we authorise to process Customer personal data is bound by confidentiality, and access is limited to people who need it for operations, support, security, engineering, legal or compliance work.
6.2 Confidentiality duties continue after a person's employment or engagement ends. We keep procedures for granting, reviewing and revoking privileged access.
7. Support and administrative access
7.1 Authorised 360Synk staff may access your company's data where reasonably necessary to provide support you have asked for, diagnose a fault, investigate a security issue, keep the Service working, carry out an agreed migration, or comply with law.
7.2 Such access is limited to the scope and time needed, is controlled by role, and is attributable to a named person. We do not use support access to browse Customer Data.
7.3 Support access. 360 Synk Software Ltd staff will view your company's data in 360Synk only when an owner or administrator of your company has approved it in the app, for the length of time you choose. The access is read-only, every page viewed is recorded and visible to you, and you can end it at any time.
8. Security
8.1 Taking account of the state of the art, cost, and the nature, scope, context, purposes and risks of the processing, we implement and maintain the technical and organisational measures in Annex 2.
8.2 We may update those measures as technology, threats, the law and the Service change, provided the overall level of protection is not materially reduced.
8.3 You are responsible for security within your control: choosing appropriate Users, assigning roles, protecting credentials and devices, removing leavers promptly, keeping your own networks and endpoints secure, and using the optional security features (for example the two-step sign-in switch) appropriately.
8.4 No system is completely secure. We maintain security appropriate to the risk.
9. Sub-processors
9.1 You give general authorisation for the sub-processors in Annex 3. We publish the current list with the Data Processing Addendum in the Service.
9.2 We give at least 30 days' notice of any new or replacement sub-processor, by email to your account owner and on our published sub-processor list, except where urgent replacement is needed for security, legal or service-continuity reasons, in which case we tell you as soon as practicable.
9.3 You may object within 30 days on reasonable data-protection grounds. We will discuss the objection in good faith and may offer a reasonable alternative. If we cannot resolve it, you may end the affected part of the Service and receive a pro-rata refund of prepaid fees.
9.4 We impose data-protection terms on each sub-processor no less protective than this Addendum, to the extent the law requires, and remain responsible for their performance.
10. International transfers
10.1 Customer Data is hosted in the EU (Microsoft Azure, North Europe region, Ireland) with supporting services in the UK and the Netherlands, as Annex 3 shows. The UK treats the EU as providing adequate protection.
10.2 Where a sub-processor processes personal data outside the UK or a country covered by UK adequacy regulations (today: Google's push-notification and crash-reporting services, which may process data in the United States), we rely on an approved transfer mechanism: the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement or Addendum, with a transfer risk assessment where required.
10.3 Annex 3 identifies the processing location of each sub-processor and, where relevant, the transfer mechanism. On reasonable request we provide the information you need to understand our transfer arrangements, subject to confidentiality and security limits.
11. Personal data breaches
11.1 We will tell you without undue delay after becoming aware of a personal data breach affecting personal data we process for you, and we aim to give you an initial notification within 48 hours of becoming aware, recognising that information may be incomplete at that stage.
11.2 The notification describes, as far as the information is available: the nature of the breach; the categories of people and data affected; approximate numbers; the likely consequences; the measures taken or proposed; and a contact point. Where not everything is known at once, we provide it in phases without undue further delay.
11.3 We take reasonable steps to contain, investigate, mitigate and remediate the breach and cooperate with you so that you can meet your own 72-hour duty to the Information Commissioner and any duty to tell the people affected.
11.4 We keep an internal record of personal data breaches. Notifying a breach is not an admission of fault or liability.
12. Data-subject rights
12.1 Taking account of the nature of the processing, we help you respond to requests from people exercising their rights (access, rectification, erasure, restriction, portability, objection and rights about automated decisions). Most requests can be handled by you inside the Service: view, edit, export lists, remove Users. Where they cannot, we help within a reasonable time.
12.2 If a person contacts us directly about personal data we process only for you, we pass the request to you and do not answer it ourselves unless you authorise us or the law requires it. You decide whether a request is valid, which exemptions apply and what the formal response is.
12.3 Deleting a User's login does not delete records the law requires you to keep. Certificates, test records, employment records and similar records associated with a person stay in your company's records; the person's login and contact details are anonymised. Nothing here promises self-service deletion of records you must retain.
12.4 Help that goes beyond standard Service functions and reasonable support may be charged at a reasonable rate where the law and the Terms of Service allow.
13. Impact assessments and consultation
13.1 Taking account of the nature of the processing and the information available to us, we help you with data protection impact assessments that relate to your use of the Service, and with any prior consultation with the Information Commissioner, where the law requires it and the matter relates to our processing.
13.2 You decide whether an impact assessment is required for your own purposes, including workforce monitoring, location sharing and sensitive information. We make our standard security, architecture and supplier information available to support your assessment, subject to confidentiality and security limits.
14. Records, information and audits
14.1 We make available the information reasonably necessary to show that we meet our processor obligations under this Addendum.
14.2 Compliance is shown first through documents: this Addendum and its annexes, our policies, security summaries, answers to reasonable security questionnaires, and any certifications or test summaries we hold.
14.3 If that is not enough to show compliance with a material legal obligation, you may request an audit, no more than once in any 12-month period unless a personal data breach, a supervisory authority or a credible material concern justifies more. An audit must be on at least 30 days' written notice where practicable, during business hours, proportionate to the concern, carried out by you or an independent auditor bound by confidentiality, and must not disrupt the Service or expose other customers' data, source code, credentials or vulnerability details.
14.4 Each party bears its own audit costs. We may charge reasonable costs for an audit that is unusually burdensome or repetitive and is not caused by our material breach.
14.5 We cooperate with lawful inspections and information requests from the Information Commissioner about processing covered by this Addendum.
15. Return, export, retention and deletion
15.1 During your subscription you can export Customer Data using the Service's export functions (lists as spreadsheet files; issued documents as downloads).
15.2 When your subscription ends, your account becomes read-only and mobile access stops. Your administrators can view and export your data for 12 months. We email your account owner 30 days and 7 days before deletion with a reminder to export (Terms of Service section 27).
15.3 After the 12 months, or earlier on your written request, we delete Customer Data from the live system, including files. It leaves rolling backups within 30 days. Backup data is protected until it expires and is not restored to active use except for disaster recovery, legal compliance or security.
15.4 We keep a closed record that the account existed (without contact or bank details) and our own billing records with you. Where the law requires us to keep other data we restrict it and use it only for that purpose.
15.5 A whole-company export pack is not yet self-service. Until it is, we provide an export of your core records and files on request in a commonly used format, free of charge once; a reasonable fee may apply to repeat requests.
16. Special category and higher-risk data
16.1 The Service is not designed as a health-record system, but it can hold special category data that you choose to enter: sickness and absence records, medical notes, GP and next-of-kin details in staff profiles, and injury descriptions in incident reports.
16.2 You are responsible for an Article 9 condition for that data (for employers, usually the employment-law condition in Schedule 1 of the Data Protection Act 2018), for the appropriate policy document that condition requires, and for deciding which roles may see it. The Service restricts staff personal and medical details to the Owner, company administrators and the HR team.
16.3 We apply the same security framework to this data as to all Customer personal data. Do not upload highly sensitive information where it is not needed for a supported business purpose. Criminal-offence data is not intended to be stored in the Service.
17. Location and workforce data
17.1 When location sharing is on for your company, the mobile app records your engineers' precise location, including in the background, only during your company's working hours (with a short overrun) or while a job timer or "On my way" is running. Outside those windows it does not record. It stops when the engineer logs out. The server rejects location points that fall outside these rules. The app may use the phone's motion sensors to tell whether the device is moving, to save battery.
17.2 Office Users with permission see current locations on the dispatch map. If you enable it, your clients see an estimated arrival time in the client portal.
17.3 The live location trail is deleted automatically after 90 days. Arrival and departure times at sites, and location stamps on photos, signatures and checks, are kept as part of the job record for as long as that record is kept.
17.4 You are responsible for the lawful basis, transparency, proportionality and any workforce-monitoring assessment for your use of these features, and for telling your staff before they use the app. Location sharing is a company setting in Settings. It is on for a new company; switch it off if you do not need it.
18. AI and automated processing
18.1 When you use an AI-assisted feature you instruct us to process the relevant Customer Data through it. Today these features are: the read-only office assistant (Copilot); reading of supplier bills and receipts; import of forms from PDF; and extraction of data from uploaded electrical certificates by our own hosted service.
18.2 These run on Microsoft Azure AI services in the UK South region and on our own infrastructure. We configure providers so that Customer Data is not used to train their models and is not used for advertising or profiling. The assistant cannot see ETT Connect member accounts, reports or form answers, and staff leave reaches it only as "Away", never as the reason.
18.3 AI output is a suggestion for a person to approve. We make no solely automated decisions about individuals that have legal or similarly significant effects.
18.4 You remain responsible for the lawfulness of the documents and personal data you submit to these features and for reviewing the output.
19. Certificates, forms and records
19.1 Where you use the Service to create or keep electrical certificates, forms, inspection and test records, signatures or audit history, you instruct us to process the personal data in them for your business, regulatory, evidential and record-keeping purposes.
19.2 You determine the retention period and access rules for those records, within what the Service supports. We do not independently assess the competence or legal standing of the people named in them.
20. Liability
Liability under this Addendum is governed by the Terms of Service, including its separate limit for data-protection and confidentiality claims (section 23.4), except where data-protection law requires otherwise. Nothing excludes or limits liability that cannot lawfully be excluded.
21. Term and contact
21.1 This Addendum ends when we stop processing personal data for you, except for provisions that by their nature continue (confidentiality, deletion, audit, liability, transfers).
21.2 Data-protection questions and notices: privacy@360synk.com · 360 Synk Software Ltd, 3 Drumard Cottages, Ballymena, Co. Antrim BT42 2PX · ICO registration ZC262363. Your data-protection contact is the person named in your account or Order.
---
Annex 1: Details of the processing
| Item | Detail |
|---|---|
| Subject matter | Providing the 360Synk hosted business-management and field-service platform: hosting, security, support, integrations, synchronisation, backup, export and administration |
| Duration | The subscription term, plus the 12-month read-only period, plus backup expiry (30 days) and any retention the law requires |
| Nature | Collection, recording, organisation, storage, retrieval, display, calculation, validation, transmission, synchronisation, integration, support access, backup, restoration, export, restriction and deletion |
| Purposes | To run your business in the Service: clients and sites, surveys and quotes, jobs and scheduling, certificates and forms, health and safety, training, timesheets, leave and expenses, people records, equipment and vehicles, bills and invoices, documents, the client portal, notifications, reports; and to support users, fix faults, run your imports and exports, send the emails you ask the Service to send (including, when you switch the feature on, feedback and review-request emails to your clients), and meet legal obligations |
| Categories of data subject | Your owners, administrators and office staff; your employees, electricians, engineers, apprentices, contractors and subcontractors; people you invite as Users; your clients and their contacts; site contacts and occupants; suppliers' contacts; Portal Users; people named in forms, certificates, incident reports, signatures and audit histories; anyone else whose information you lawfully record |
| Categories of personal data | Names, job titles, contact details and identifiers; user accounts, roles, permissions, authentication metadata and audit events; business and site addresses; jobs, work orders, tasks, diaries, scheduling and attendance; timesheets, job timers, hours, overtime, leave and availability; precise location of mobile Users where location sharing is on (section 17); client, supplier and subcontractor records; quotes, invoices, purchases, payment status and accounting records; photos, documents, drawings, signatures and uploads; electrical forms, certificates, inspection and test information, observations and declarations; training and qualifications; vehicle and equipment records (including fuel card details if entered); expenses and receipts; notes, comments and messages; device, session, IP and app-version data; AI inputs and outputs |
| Special category data | Health data you choose to enter: sickness and absence, medical notes, GP and next-of-kin details, injury descriptions (section 16) |
| Criminal-offence data | Not intended. Do not store it |
Annex 2: Security measures (what is in place today)
- Hosting on Microsoft Azure (App Service, Azure Database for PostgreSQL, Blob Storage). Encryption in transit (HTTPS only, HSTS) and at rest by Azure's platform storage encryption.
- Every record is labelled with the company it belongs to; every database read is automatically limited to the signed-in user's company; a second check on saves records any mismatch in a security log. Cross-company isolation is covered by automated tests run on a real database, and was checked in a live two-company test on the test system.
- Role-based permissions. Staff personal and medical details visible only to the Owner, company administrators and the HR team. Members of the ETT Connect app are confined to their own routes.
- Passwords stored as salted BCrypt hashes; minimum length 8; account lock after 5 failed attempts for 30 minutes; rate limits on sign-in, token refresh, password reset and registration. Two-step sign-in with an authenticator app for office web Users, which the company can make compulsory; Users who have set it up are challenged at every sign-in.
- Secrets held in Azure Key Vault (soft delete and purge protection on), never in code. Separate development and production databases, storage and vaults; the test system has no email or push credentials and cannot read the live vault.
- Short-lived links for files and photos (about 15 minutes).
- Audit logging of sign-ins, failures, lockouts and key changes; application monitoring and alerts through Azure Application Insights. There is no 24/7 human monitoring.
- Automated daily database backups with 30-day point-in-time restore, in one region; restore rehearsed on 4 Aug 2026. Blob storage soft delete, 30 days.
- Automatic deletion of the live location trail (90 days) and mobile support diagnostics (90 days). Self-service account deletion on mobile anonymises the person's details.
- Photo metadata (including GPS) stripped from photos on anonymous ETT Connect reports.
- Changes go through pull requests and the automated test suite, reach the test system first, and go live only when the owner approves; live releases are tagged for rollback.
- Not claimed, because not yet true: independent penetration test, ISO 27001, Cyber Essentials, web application firewall or DDoS protection beyond Azure defaults, single sign-on, 24/7 monitoring, a second-region backup.
Annex 3: Sub-processors (as at 1 October 2026)
| Sub-processor | Service | What it does with Customer Data | Location |
|---|---|---|---|
| Microsoft Ireland Operations Ltd (Microsoft Azure) | App Service, Azure Database for PostgreSQL, Blob Storage, Key Vault, SignalR, Static Web Apps | Hosts the web app, API, database, files and the client-portal front end | North Europe (Ireland); portal front end West Europe (Netherlands) |
| Microsoft (Azure) | Application Insights, Log Analytics | Application logs and telemetry (may include user IDs, IP addresses, request details), kept 90 days | North Europe; production log workspace UK South (London) |
| Microsoft (Azure) | Azure Communication Services Email | Sends service emails (sign-in, verification, notifications, documents you send) | Europe |
| Microsoft (Azure) | Azure OpenAI, Document Intelligence, Computer Vision; Container Apps | Copilot answers; reading bills, receipts and PDFs; our own certificate-extraction service | UK South (London) |
| Google LLC / Google Ireland Ltd (Firebase Cloud Messaging; Apple Push Notification service via FCM) | Push notifications | Device token and notification text | Google's infrastructure, including the United States; UK Extension to the EU–US DPF |
| Google (Firebase Crashlytics) | Crash reporting | Crash and diagnostic data from the mobile apps (no names or emails) | Google's infrastructure, including the United States; UK Extension to the EU–US DPF |
| Google (Google Maps Platform) | Maps, places, routing | Displays maps, looks up addresses, calculates route times from engineer and job locations when requested | Global; UK Extension to the EU–US DPF |
| Ideal Postcodes Ltd (postcodes.io) | Postcode and address lookup | Site postcodes and coordinates when an address is looked up | UK |
| Xero Ltd | Accounting connection (customer-enabled) | Invoices, bills, contacts and payments sent at your instruction when you connect Xero | As set out in Xero's own terms and privacy notice |
| Intuit (QuickBooks), Sage | Accounting connections | As above, when enabled | Listed only when switched on |
Not sub-processors of Customer Data: Stripe (our own billing, not yet live), TrueLayer (not used), Myth Digital (development partner with no live-data access).
Annex 4: Shared responsibility
| Area | 360Synk (processor) | Customer (controller) |
|---|---|---|
| Users | Account and role controls | Approve Users, remove leavers, least privilege |
| Sign-in security | Two-step sign-in switch, lockout, rate limits | Switch it on where policy requires; protect devices |
| Electrical records | Store and present securely | Lawful basis, competence, accuracy, retention |
| Location | A company setting (on for a new company); record only within the rules in section 17; delete the trail after 90 days | Lawful basis, staff notice, proportionality, the switch |
| Health data | Restrict to Owner, admins and HR | Article 9 condition and appropriate policy document |
| Mobile and offline | Sync and local app controls | Protect devices; check sync; remove lost devices |
| Client portal | Restricted portal functions | Choose recipients and lawful disclosures |
| Imports and AI | Provide the tools | Right to import; review the output |
| Integrations | Operate our side | Authorise, configure and verify exchanged data |
| Retention | Export functions, 12-month read-only period, deletion | Set retention; export what must be kept |