Data Processing Agreement

Terms not defined here have the meaning given in the UK GDPR (the UK General Data Protection Regulation, as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018) and the Data Protection Act 2018.

• "Customer Data" — the personal data you (or your users) submit to, or generate within, the SmartCore platform, which we process solely on your instructions.
• "Special Category Data" — personal data revealing health, medical, or similar sensitive information, as defined in Article 9 UK GDPR (for example, data processed within the SmartCore Flexi module).
• "Sub-processor" — any third party we engage to process Customer Data on our behalf (see Section 6).

For Customer Data, you are the controller and SmartCore Technology is the processor. You determine what data is entered into the platform, who your users are, and what it's used for. We process it only to provide the Service and only on your documented instructions (which include the configuration choices you make within SmartCore itself, such as which modules you enable).

For data we hold about you directly as our customer — your own account details, billing information, and communications with us — SmartCore Technology is the controller, and that processing is covered by our Privacy Policy, not this agreement.

We will:

• Process Customer Data only on your documented instructions, unless required to do otherwise by UK law (in which case we'll tell you before processing, unless the law prohibits this)
• Ensure everyone with access to Customer Data is subject to a duty of confidentiality
• Implement appropriate technical and organisational security measures (Section 7)
• Not engage a new sub-processor without giving you the opportunity to object (Section 6)
• Assist you in responding to data subject rights requests (Section 8)
• Notify you promptly of any personal data breach affecting Customer Data (Section 9)
• Delete or return Customer Data at the end of the relationship, subject to Section 12
• Make available the information reasonably necessary to demonstrate compliance with this agreement (Section 11)

Anyone we authorise to process Customer Data — employees, contractors, and sub-processors — is bound by confidentiality obligations covering that data, whether contractually or as a matter of professional duty.

To diagnose and resolve issues you report, a limited number of authorised SmartCore staff (company owners/admins only) can start a session as one of your employees to see and reproduce what they are seeing, rather than relying on a written description alone. This is a support tool, not standing access: it requires the staff member to record a reason before the session can start, and every session is logged — who initiated it, whose account it was, the reason given, and when it started and ended.

This access is used only for legitimate support, troubleshooting, or maintenance purposes on your instruction or in response to a report you have raised, and is covered by the same confidentiality obligations as all other processing under this agreement. The log of this access is available to you on request, and is retained for 2 years before automatic deletion (see our Data Retention Schedule).

Where you subscribe to SmartCore Chat, the platform stores the content of your staff's internal messages to each other, the files, images and video they share, and the metadata of any voice or video calls they place. You are the controller of all of it; we process it only as directed by your use of the module's features.

Your administrators' access to a conversation

The module gives your owner and administrators — not SmartCore staff — a restricted facility to read and export the direct messages between two named employees. This is a controller-side capability, and the responsibility for using it lawfully (a lawful basis, proportionality, and telling your staff it exists) rests with you. What we provide are the controls that make it auditable:

• It is a targeted lookup of two named employees. The platform provides no facility, for you or for us, to browse or bulk-export your staff's direct messages.
• Every use is recorded immutably — the administrator, both employees, the timestamp, whether a copy was exported and in which format, the reason given, and the originating IP address. Neither your administrators nor SmartCore staff can edit or delete those records through the platform.
• Conversations involving an administrator or the account owner are excluded by design. The platform refuses the request if either participant holds such a role, regardless of who is asking. This is enforced in the database rather than in the interface, and is re-evaluated at the time of each request — so promoting an employee closes their existing history to the facility immediately.
• Exports are produced by the same mechanism and are subject to the same exclusion and the same record.
• An administrator may remove a message from a shared channel, which is logged together with the content removed. Messages inside a direct message cannot be removed or altered by an administrator.
• Each employee can obtain a copy of the records of any access to conversations involving them, through the module's own self-service export (see Section 8).

SmartCore staff have no facility of their own to read your staff's chat messages. Support access under Section 5a operates as the signed-in employee it impersonates, so it inherits that employee's own access and nothing more, and is subject to the reason and logging requirements described there.

Retention within the module

You set a single company-wide retention window for chat history (3, 6, 12 or 24 months, or indefinite). Where a window is set, a daily automated job permanently deletes messages older than it and the files attached to them. You can change this at any time; shortening it takes effect at the next run of that job and is not reversible.

The conversation-access records and the administrator action log described above are excluded from that window, so that a retention setting cannot be used to remove evidence of access. They are retained for 2 years on the same basis as the Section 5a support-access log.

Voice and video calls

Calls are established directly between participants using WebRTC. No third-party calling, conferencing or media-processing provider is engaged, and accordingly none is listed as a sub-processor in Section 6 for this purpose.

Where a participant's network prevents a direct connection, the connection is relayed through a TURN server operated by SmartCore Technology on its own infrastructure. In that configuration the encrypted media stream transits our infrastructure in order to reach the other participant. It is not decrypted, inspected, recorded or retained, and no recording or transcription facility exists in the module. Only call metadata — participants, timing, outcome — is stored.

You give general authorisation for us to engage the following sub-processors, each of which is bound by data protection obligations no less protective than this agreement:

• Supabase — database hosting and authentication
• Cloudflare — hosting, content delivery, and edge compute
• Stripe — payment processing
• Resend — transactional email delivery
• Anthropic — AI processing powering SmartCore's in-app AI features (chat/support assistants including Nova, CRM support chat, and general platform support chat) and SiteSnap's floor-plan analysis tool

SmartCore Chat's voice and video calling engages no sub-processor at all: calls are peer-to-peer, and where a network requires a relay it is a server we operate ourselves (see Section 5b).

If we intend to add or replace a sub-processor, we will give you reasonable notice (by email or platform notice) and the opportunity to object on reasonable data-protection grounds before the change takes effect.

We maintain technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Row-level security policies restricting data access to authorised users within your own organisation
• Private, non-public storage for uploaded files and photos, including any Special Category Data processed via Flexi
• Access logging and audit trails for sensitive actions, including access to client health records within Flexi
• Regular review of access controls and prompt patching of known vulnerabilities

Where a data subject exercises a right (access, rectification, erasure, portability, etc.) directly against you regarding data held in SmartCore, we will provide reasonable assistance, including — where the relevant module supports it — self-service tooling that lets your employees or clients exercise these rights directly (for example, the export/deletion tools in the Flexi client portal).

If we become aware of a personal data breach affecting Customer Data, we will notify you without undue delay and, in any event, provide you with enough information to meet your own notification obligations to the ICO and affected individuals. See Section 10 of our Privacy Policy for our full breach response process.

Where Customer Data is transferred outside the UK (for example, to a sub-processor's infrastructure), we ensure this is done under an adequate safeguard recognised by UK GDPR, such as Standard Contractual Clauses or an adequacy decision.

On reasonable written notice, we will make available information reasonably necessary to demonstrate compliance with this agreement, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint — subject to reasonable confidentiality and scheduling conditions.

Following cancellation of your subscription, Customer Data is retained for 90 days (see our Privacy Policy, Section 8), during which you can export it yourself via the platform. After that window, it is permanently and automatically deleted, unless we're required by law to retain specific records for longer (for example, billing records retained for HMRC purposes).

Each party's liability arising out of or in connection with this agreement is subject to the limitations and exclusions of liability set out in our Terms of Service.

Questions about this agreement, or requests relating to Customer Data processing, should be sent to support@smartcoretechnology.co.uk.

All of our legal and data protection documents, including this agreement, are also available together at smartcoretechnology.co.uk/legal.