Data Processing Agreement

The customer company is the controller. OHMLEY LTD (“OHMLEY”) is the processor. Each party will comply with UK data protection law in respect of its role.

OHMLEY processes personal data only on the documented instructions of the controller, which are: to provide, support, secure and maintain the OHMLEY service as described in the Terms of Use and configured by the controller's administrators. OHMLEY will tell the controller if, in its opinion, an instruction breaches data protection law.

• Subject matter: provision of job management, site reporting and document/compliance record keeping software.
• Duration: for the term of the subscription, plus any agreed retention or deletion period.
• Nature and purpose: hosting, storage, transmission, retrieval, generation of PDFs and exports, email delivery of records, and optional AI-assisted text generation.

• Identification and contact data: name, work email, phone, job role, company.
• Account and access data: role, permissions, invitation and sign-in records.
• Operational content: jobs, sites, site diaries, Safe Start records, quality inspections, snags, reports, plant records, drawings and documents.
• Images: photographs uploaded from site, which may include individuals.
• Signatures, signatory names and timestamps.
• Audit and delivery metadata, including IP/device information where captured, and email delivery status.
• Voice notes and transcripts where the voice feature is used.

• The controller's employees, subcontractors and site personnel
• The controller's clients and their staff (including portal recipients and signatories)
• Third parties incidentally captured in photographs or notes

OHMLEY ensures that people authorised to process the personal data are subject to confidentiality obligations and access it only where needed to run and support the service.

OHMLEY implements appropriate technical and organisational measures, described on the Security page. These include authentication managed by a specialist provider, role and permission based access, database-level row security enforcing company isolation, private file storage accessed only through short-lived authorised links, encryption in transit, and audit logging of important actions.

The controller gives general authorisation for OHMLEY to appoint sub-processors. Current sub-processors:

available on request The list will be maintained in the OHMLEY admin area and published here. We will not name providers we have not actually engaged.

OHMLEY will give notice of any intended addition or replacement of a sub-processor, allowing the controller a reasonable period to object on reasonable data protection grounds. OHMLEY remains liable for its sub-processors' performance of these obligations.

Taking account of the nature of the processing, OHMLEY will assist the controller with requests from data subjects, including by making data available for export and by supporting correction and deletion within the application. Requests received directly by OHMLEY will be passed to the controller.

OHMLEY will notify the controller without undue delay after becoming aware of a personal data breach affecting the controller's data, and will provide the information reasonably available to help the controller meet its own obligations. Incidents are recorded in the internal incident register. This clause does not state statutory deadlines; those are set by law and assessed case by case.

OHMLEY will provide reasonable assistance with data protection impact assessments and prior consultation with the ICO, taking into account the nature of processing and the information available to OHMLEY.

On termination, and at the controller's choice, OHMLEY will delete or return the personal data, subject to any configured retention settings and to storage required by law. The controller can export its data before closure.

OHMLEY will make available the information reasonably necessary to demonstrate compliance with these obligations, and will allow for and contribute to audits, including inspections, conducted by the controller or an auditor it mandates, on reasonable notice and subject to confidentiality.

Primary hosting region: United Kingdom (London). Where personal data is transferred outside the UK, OHMLEY relies on UK adequacy regulations or the UK International Data Transfer Agreement/Addendum, as applicable to each sub-processor.