Data Processing Agreement

The customer organisation is controller and Trent End Ventures Ltd trading as Jobaro is processor for its workspace records. This DPA forms part of the Platform Terms for those services and continues while Jobaro processes that data. Our own controller activities are described in the Privacy Notice.

Processing provides business-record software: collection, organisation, storage, retrieval, authorised sharing, export and deletion. Data concerns customers, staff, contractors, occupants and contacts and may include names, contact details, addresses, work records, notes, images and audit evidence. The organisation determines its lawful purposes, users and recipients. Special-category and criminal-offence data are not intended launch-core inputs.

Jobaro will process data only on documented instructions through the service, this DPA or authorised written requests, including transfer instructions. If law requires other processing, we will notify the customer unless prohibited. We will flag an instruction that appears unlawful. Authorised personnel must have confidentiality obligations.

Jobaro will maintain measures appropriate to the risk, including authentication, company and record permissions, private evidence storage and staff access auditing. The Security Notice describes their scope without promising absolute security.

Taking account of the processing and available information, we will assist with individuals' rights, security, impact assessments and prior consultation. We will notify the customer without undue delay after becoming aware of a breach affecting its records and provide available information and updates for its response.

The customer generally authorises providers on the Subprocessor List. Jobaro will impose appropriate contractual data-protection duties and remains responsible for their performance. We will notify customers of intended material additions or replacements, allowing reasonable time to raise a data-protection objection before affected processing. We will seek a resolution; the customer may stop an affected service if no resolution is available. Transfers must comply with applicable law and the safeguards described in the provider list.

At the customer's choice, Jobaro will return or delete its personal data when processing ends, including copies unless law requires storage. Available exports and support requests provide the return route. Required retention will be identified and restricted. Backup copies remain protected through their provider deletion cycle; deletion instructions must be reapplied after a restoration.

We will provide information needed to demonstrate these obligations and allow and assist audits or inspections by the customer or its auditor. Practical arrangements must protect other customers and avoid unnecessary disruption without preventing a legally required audit. The customer remains responsible for lawful basis, notices, authority, accuracy and instructions.