# Data Processing Agreement — template (not signed)

**Last updated:** 30 October 2026 (Europe/London calendar date)

**Parties (placeholders):**

- **Controller:** [Customer legal name, company number, address]
- **Processor:** Pure Cores · contact@pure-cores.co.uk · 0800 009 6667

---

## 1. Subject matter and duration

Processing of personal data for the PureCores applications the Controller orders (for example Pure Safety, Pure Projects, Pure ISO, Pure Haulage, and related suite services), for the term of the main agreement and any wind-down period the parties agree.

## 2. Nature and purpose

Hosting, storage, transmission, display, and support of tenant data the Controller (and its authorised users) enter into the apps, so the Controller can operate project, ISO, haulage, or related workflows.

## 3. Types of personal data and data subjects

As determined by the Controller. Typical categories may include names, contact details, employment or contractor identifiers, location/check-in signals, job or site references, and account credentials. **Special category data** is not requested by PureCores product defaults; if the Controller chooses to enter it, the Controller remains responsible for a lawful basis and any DPIA.

## 4. Controller instructions (Article 28(3)(a))

The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country, unless required to do so by UK law. The main service agreement and this schedule constitute those instructions, as updated in writing.

## 5. Confidentiality (Article 28(3)(b))

Persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

## 6. Security (Article 28(3)(c))

Taking into account the state of the art, costs, and risks, the Processor implements appropriate technical and organisational measures. Hosting practice is described on the public Security page.

## 7. Sub-processors (Article 28(3)(d))

The Controller authorises the Processor to use the sub-processors listed below (general written authorisation). The Processor will inform the Controller of intended changes so the Controller can object on reasonable grounds within [__] days.

| Sub-processor | Role | Location / transfer note |
| --- | --- | --- |
| Pure Cores | Application hosting for the site and the apps | United Kingdom |
| Stripe | Card payments for Pure ISO Professional | May involve processing outside the United Kingdom |
| [Add others only when actually used] | | |

Transactional mail is sent from noreply@pure-cores.co.uk.

## 8. Assistance with data subject rights (Article 28(3)(e))

The Processor assists the Controller, by appropriate technical and organisational measures, insofar as possible, for the fulfilment of the Controller’s obligation to respond to requests for exercising data subject rights.

## 9. Assistance with security, breaches, DPIA, prior consultation (Article 28(3)(f))

The Processor assists the Controller in ensuring compliance with UK GDPR Articles 32–36, taking into account the nature of processing and information available to the Processor. **Personal data breach:** the Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, with enough detail for the Controller to meet its own notification duties.

## 10. Deletion or return (Article 28(3)(g))

At the choice of the Controller, the Processor deletes or returns all personal data after the end of the provision of services, and deletes existing copies, unless UK law requires storage.

## 11. Audits (Article 28(3)(h))

The Processor makes available information necessary to demonstrate compliance with Article 28 and allows for and contributes to audits by the Controller or an auditor mandated by the Controller, subject to reasonable notice, confidentiality, and frequency limits.

## 12. International transfers

Where processing involves a transfer outside the UK, the parties rely on a lawful transfer tool (for example the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs). Stripe may process data outside the United Kingdom.

## 13. Governing law

England and Wales. Courts of England and Wales have exclusive jurisdiction, unless the main agreement says otherwise.

---

## Signature blocks (not executed)

| | Controller | Processor (Pure Cores) |
| --- | --- | --- |
| Name | | |
| Title | | |
| Date | | |
| Signature | | |