Home / Data processing agreement
Legal
Data processing agreement
How Skiplog handles personal data on a customer's behalf, and what each side agrees to.
This agreement
This data processing agreement forms part of the terms of service for Skiplog. It applies whenever a customer's use of Skiplog involves us processing personal data on the customer's behalf, and needs no signature: it takes effect when the customer accepts the terms. Words such as controller, processor, personal data and processing mean what they mean in the UK GDPR and the Data Protection Act 2018.
The particulars
- The processor
- Kaleido Ltd, a company registered in England and Wales, company number 17516332, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
- The controller
- The customer, the organisation that holds the Skiplog account
- Subject matter
- Providing Skiplog to the customer
- Duration
- For as long as the customer uses Skiplog, and until the data is deleted or returned at the end
- Nature and purpose
- Hosting, storing and processing personal data so that Skiplog works for the customer
- Types of personal data
- Your name, email address and a hashed password; Your site's details: name, address and postcode, permit or exemption number, region, a contact email and phone, any position statement, and your return columns; Every transfer note you record: the waste, its codes and weight, when it came in, form and containers, POPs and hazard details, carrier and vehicle, destination; On the device you use Skiplog on: notes you record while offline, and a copy of the screens you have already opened; Accounts for the people you add to your site, and the email addresses and invite links of anyone you have invited; Carrier, broker and dealer registrations you track, with their expiry dates; Generated quarterly returns and their totals; Receipts batches for Defra's waste tracking service, each note's reported mark, its Defra reference, and the date and reason from a rejection notice; A record of each correction to a note Defra had already accepted: the reference it went in under, and the old and new value of what changed; Subscription status and a Stripe customer reference, never card details; The last time you used the signed-in app, and which core actions you completed and when: a note recorded, a queue synced, a return exported; The network address and browser of each signed-in session; and the account details of the customer's users (names, email addresses and sign-in records)
- People the data is about
- The customer's users, and the people whose details the customer puts into Skiplog
- Where it is processed
- Amazon Web Services; the application and its Postgres database are deployed there through SST.
What Kaleido Ltd agrees to
As the processor, we will:
- process the personal data only on the customer's documented instructions, which are these terms and the customer's use of Skiplog, unless the law requires otherwise, in which case we tell the customer first unless the law forbids it;
- make sure everyone we allow to process it is bound to keep it confidential;
- take the technical and organisational measures Article 32 of the UK GDPR requires to keep it secure, including encryption of data in transit and access limited to the people who need it;
- use only the subprocessors on our subprocessors page, which the customer authorises by this agreement. We update that page before a new subprocessor processes the data; the customer may object within 30 days, and if we cannot resolve the objection, end its use of Skiplog and receive a refund of any amount paid for a period it will not receive. Each subprocessor is bound by obligations no less protective than these, and we remain responsible for it;
- help the customer, as far as we reasonably can, to answer requests from the people the data is about;
- help the customer meet its obligations on security, personal data breaches, data protection impact assessments and consulting the regulator, taking into account what we process and the information we have;
- tell the customer without undue delay after we become aware of a personal data breach affecting its data;
- at the end of the customer's use of Skiplog, delete the personal data, or return it if the customer asks, unless the law requires us to keep it (each of the customer's users can download a copy of their own data from Settings in Skiplog before then);
- make available the information needed to show that we meet these obligations, and allow for and contribute to audits by the customer or an auditor it appoints, on reasonable notice and no more than once a year unless a regulator requires it or after a personal data breach;
- tell the customer straight away if we think an instruction breaks data protection law.
What the customer agrees to
The customer is responsible for having a lawful basis for the personal data it puts into Skiplog, for telling the people it is about what the law requires, and for the instructions it gives us.
Transfers outside the United Kingdom
We transfer the personal data outside the United Kingdom only where the transfer is covered by the UK's adequacy regulations or by appropriate safeguards, such as the International Data Transfer Agreement or the UK Addendum to the EU's standard contractual clauses.
Liability
Each side's liability under this agreement is subject to the limits in the terms of service, except where the law does not allow it to be limited.
Keeping a copy
To keep a copy of this agreement, print this page or save it as a PDF from your browser.
Who we are
Skiplog is a product of Kaleido Ltd, a company registered in England and Wales, company number 17516332, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
You can reach us at support@getskiplog.com.