Data Processing Agreement
Version 2026-09-15 · part of the Terms of Service
This agreement covers the personal data FixDocket handles for you. It is written to meet Article 28 of the UK GDPR and applies for as long as you have an account, and afterwards until your data is deleted.
1. The parties and their roles
You, the organisation that holds the account, are the controller: you decide what is collected about tenants, contractors and landlords, and for how long it is kept. Northvale Technologies Ltd, trading as FixDocket, company number 17453725, of 277 Great Clowes Street, Salford M7 2HE, is the processor: we handle that data on your instructions and on nobody else's.
2. What is processed
| Subject matter | Repair reports and their history for property you manage. |
|---|---|
| Purpose | Receiving reports, routing work to contractors, recording invoices and approvals, and keeping the record for you. |
| Duration | For as long as you have an account and until the data is deleted under section 8. |
| Data subjects | Tenants and occupiers of the property you manage; contractors; landlords; your own staff. |
| Categories of data | Names and contact details where given; the address and unit a report concerns; descriptions of faults; photographs, which may show people or personal belongings; invoice amounts; the dates and times of each step; the email addresses of your staff. |
| Special category data | None is asked for. If a tenant volunteers it in a description, you decide whether to keep it. |
3. Your instructions
We process personal data only on your documented instructions. Creating an account, using the console, issuing links and this agreement are those instructions. If we believe an instruction breaks data-protection law we will tell you. We will not process the data for our own purposes.
4. Confidentiality
Everyone who works for us and can reach your data is bound to keep it confidential. Access is limited to what running and supporting the service requires, and every use of a link is recorded against the job it opened.
5. Security
We keep technical and organisational measures appropriate to the risk. They are described on the security page, which forms part of this agreement: data held and processed in the United Kingdom, encryption in transit and at rest, each customer's data kept apart by a filter every query passes through and that is tested automatically, hashed link tokens, uploads that go straight to storage, daily backups, and error reports with personal data removed. We will not weaken those measures without telling you.
6. Sub-processors
You authorise us to use the sub-processors below. We will tell you at least thirty days before adding or replacing one; if you object on reasonable data-protection grounds and we cannot resolve it, you may end the contract. We remain responsible to you for what they do.
- DigitalOcean -- hosting, database and photo storage, London.
- Cloudflare -- DNS, and the bot check on the report form.
- Resend -- transactional email, sent from EU infrastructure.
- Sentry -- error reporting, EU service, personal data removed first.
- GoCardless -- Direct Debit collection. GoCardless handles your bank details as a controller in its own right, under its own terms; FixDocket never receives them.
7. International transfers
Your data is stored and processed in the United Kingdom. Where a sub-processor operates from the European Economic Area, transfers rely on the UK's adequacy regulations. We do not transfer personal data outside the UK or the EEA without a lawful transfer mechanism and without telling you.
8. Deletion and return
- You can delete a job, a flat or a whole building yourself at any time, from the console. The records, the photos in storage and every link that pointed at them go together, and only a note that an erasure happened is kept.
- Deleted data leaves the backups as they age out, within seven days.
- At the end of the contract we delete your data within thirty days, unless you ask us to keep it readable or the law requires us to keep it longer. Ask before then and we will give you a copy.
9. Helping you with rights requests
Requests from tenants, contractors or landlords to see, correct or erase their data go to you, as controller. The console lets you find and delete what concerns a person. If a request reaches us directly we will pass it to you without undue delay and help you answer it where you cannot do so yourself.
10. Personal data breaches
If we become aware of a breach affecting your data we will tell you without undue delay, and in any case within 48 hours of becoming aware, with what we know about what happened, whose data was involved, and what we are doing about it, so you can meet your own duty to report.
11. Assessments and audits
We will give you the information you reasonably need to show that this agreement is being kept, and to carry out a data-protection impact assessment. Once a year, or after a breach, you may audit our compliance with this agreement, on reasonable notice, during working hours, and in a way that does not put other customers' data at risk; written answers and the security page will normally be enough.
12. Liability and law
Liability under this agreement is subject to the limits in the Terms of Service. This agreement is governed by the law of England and Wales.