Customer data processing agreement

1. Parties, scope and priority

This proposed agreement is between the UK business customer identified in the accepted TaskMaster Pro order, as controller, and Christopher Adamson trading as Fire Tree Digital, as processor. It applies only where Fire Tree Digital processes personal data in the customer’s workspace on the customer’s behalf. Fire Tree Digital remains a separate controller for its own account, billing, security and support records.

When accepted, this agreement would form part of the business subscription terms. If its data-protection terms conflict with the general terms, this agreement takes priority for customer personal data. The relevant law is the UK GDPR and Data Protection Act 2018.

2. Processing instructions

Fire Tree Digital will process customer personal data only on the customer’s documented instructions, including instructions in the agreed service configuration and written support requests, unless UK law requires otherwise. We will tell the customer before legally required processing unless the law forbids notice. We will tell the customer if an instruction appears to breach data-protection law.

The customer determines the purpose, lawful basis, accuracy, content and permitted users. It must not instruct processing it is not entitled to undertake.

3. Confidentiality and security

We will ensure that people authorised to handle customer personal data are bound by confidentiality and access it only as needed for the service. We will apply appropriate technical and organisational measures under Article 32, taking account of the risks and the information handled. The planned measures include authenticated accounts, company and role checks, restricted support access, secure transmission, platform encryption, incident handling, backups and periodic security review.

The final security schedule must be checked against the deployed app and Base44’s current controls before this agreement is accepted. This draft does not assert that cross-company and HR/payroll testing has already passed.

4. Other processors

The customer would give general written authorisation for Base44, operated by Wix.com Ltd, to provide app hosting, data storage, backend processing, delivery and related infrastructure. Base44 publishes its own subprocessor directory and DPA. Fire Tree Digital will keep an up-to-date list of its direct sub-processors, notify customers of intended material changes in time for an objection where reasonably possible, and ensure required equivalent data-protection terms apply to each sub-processor.

Google sign-in and Stripe payment processing are described in the privacy notice. Their roles must be checked for each data flow rather than assuming every provider is a sub-processor for all customer workspace content. If the customer reasonably objects to a new sub-processor, we will discuss a practical solution; if none is available, the affected processing must not continue without a lawful basis.

5. Transfers outside the UK

Customer personal data may be processed outside the UK through Base44 and its listed providers, including in the United States. We will not make or authorise a restricted transfer without an applicable lawful transfer mechanism, such as adequacy regulations or appropriate contractual safeguards. Base44’s DPA describes its mechanisms. The exact transfer schedule and route to a copy of the safeguards must be confirmed before paid launch.

6. Rights requests and assistance

Taking account of the nature of processing and information available, we will reasonably assist the customer to respond to access, correction, deletion, restriction, objection and portability requests. We will tell the customer when we receive a request concerning its workspace content, unless prohibited by law, and will not decide the request in the customer’s place without instruction.

We will also reasonably assist with security, breach notification, data-protection impact assessments and consultation with the ICO where the law requires.

7. Personal data breaches

We will notify the customer without undue delay after becoming aware of a personal data breach affecting its content, provide available facts about the incident and its likely effects, and give updates as investigation continues. The customer remains responsible for deciding whether and how to notify the ICO or affected people unless law says otherwise.

8. Return and deletion

At the end of the service, at the customer’s choice and subject to legal retention, Fire Tree Digital will return or delete customer personal data and delete remaining copies. Protected backups may remain beyond the immediate deletion step only for a justified technical period and must be kept beyond normal use until they expire. The final agreement must state the tested export method, request route, live-system deletion period and backup expiry period before paid checkout opens.

9. Information and audit

We will provide information reasonably needed to demonstrate compliance with these processor obligations and allow for and contribute to audits or inspections by the customer or its appointed auditor, with reasonable notice and confidentiality protections. We may first provide relevant independent platform reports or security information, but this cannot remove a legal audit right.

Schedule A — details of processing

• Subject matter and duration: hosting and operating one company workspace for the subscription term and a documented closure period.
• Nature and purpose: storing, retrieving, organising, transmitting and securing customer-entered records to deliver TaskMaster Pro and support authorised users.
• Data subjects: the customer’s staff, contractors, candidates, clients, prospects, suppliers and other business contacts.
• Data types: names, contact details, account roles, job and quote information, attendance, training, HR and pay records, messages and uploaded documents; sensitive details only where the customer lawfully enters them.
• Controller rights and duties: choose purposes, lawful basis, retention and user permissions; issue lawful instructions; receive assistance, information and return or deletion.

Schedule B — security measures to verify

• Authenticated access with company and role checks for every sensitive operation; no unlinked account access.
• Encrypted network transport and provider-managed storage encryption, supported by Base44’s published security information.
• Restricted support and administrative access, incident review, logging and recovery arrangements.
• Regular access and tenant-isolation tests, especially for HR, payroll, files and billing.
• A tested customer export, deletion and backup-expiry process before activation.

Schedule C — provider and transfer register

Direct platform provider: Base44, operated by Wix.com Ltd, for hosting, storage, backend functions, application delivery and platform logs. Base44 lists its own underlying subprocessors and processing locations in its public Trust Center. Google may handle sign-in; Stripe handles payment and billing data and may act as an independent controller for some payment purposes. The final register must map each actual data flow, location, role and transfer safeguard before acceptance.