Data Processing Agreement
Version 2026-10
This Data Processing Agreement (“DPA”) forms part of the ServiceLog Terms of Service between the contractor using ServiceLog (the “Customer”, acting as controller) and GridEstate (acting as processor). It applies whenever GridEstate processes personal data on the Customer’s behalf and sets out the terms required by Article 28 of the General Data Protection Regulation (GDPR).
1. Subject matter and duration
GridEstate processes personal data contained in Customer Data in order to provide ServiceLog. The DPA applies for as long as GridEstate processes such data, including the deletion period after the account is closed.
2. Nature and purpose of processing
Hosting, storing, organising, displaying and transmitting Customer Data so that the Customer can keep service records, publish customer pages, send invitations, notifications and reminders, import data, store documents and receive support.
3. Data subjects and categories of data
- Data subjects: the Customer’s clients and their contact people (for example housing association board members, property managers, building owners and their staff), private individuals who are the Customer’s clients, and the Customer’s own staff named in records.
- Personal data: names, email addresses, phone numbers and roles; addresses of serviced sites; service records such as visit dates, technicians, findings, acts, photos and documents; logs of page visits and emails sent.
- Special categories of personal data are not expected. The Customer should not upload them.
4. GridEstate’s obligations
GridEstate will:
- process personal data only on the Customer’s documented instructions, which are these Terms, this DPA and the Customer’s settings in the service, and tell the Customer if it believes an instruction breaks the law;
- ensure that people authorised to process the data are bound by confidentiality;
- apply the security measures in section 10;
- help the Customer respond to data subject requests and, where reasonable, with data protection impact assessments and consultations with authorities;
- notify the Customer of a personal data breach without undue delay and no later than [48] hours after becoming aware of it, with the information the Customer needs to meet its own obligations;
- make available the information needed to demonstrate compliance with this DPA and allow audits. Audits are carried out primarily through documentation, at most once a year, with at least 30 days’ notice and at the Customer’s cost.
5. Sub-processors
The Customer gives general authorisation for GridEstate to use sub-processors. The current sub-processors are:
- MongoDB Atlas — database hosting, EU region;
- Cloudflare — application hosting, file storage, content delivery, DNS and network security;
- Resend — sending emails;
- PostHog — product analytics and error tracking, EU region;
- Sentry — error monitoring.
GridEstate will give at least 30 days’ notice by email before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds; if the objection cannot be resolved, the Customer may terminate the affected service. GridEstate binds each sub-processor to data protection obligations equivalent to this DPA and remains responsible for their performance.
6. Transfers outside the EEA
Customer Data is stored in the European Union. Personal data is transferred outside the European Economic Area only with appropriate safeguards, such as an adequacy decision of the European Commission or Standard Contractual Clauses.
7. The Customer’s obligations
The Customer ensures that it has a lawful basis for the personal data it stores in ServiceLog and for the invitations, notifications and reminders it turns on, informs data subjects about the processing, and gives instructions that comply with the law.
8. Return and deletion
During the term and for [30] days after the account is closed, the Customer can request an export of Customer Data. GridEstate then deletes Customer Data within [30] days, unless the law requires it to be kept. Copies in backups are overwritten within [35] days.
9. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms, without prejudice to the rights of data subjects under Article 82 GDPR. If this DPA conflicts with the Terms on the protection of personal data, this DPA prevails.
10. Technical and organisational measures
- Encryption in transit (TLS) and encryption at rest by the hosting provider.
- Separation of each Customer’s data by organisation in every database query.
- Role-based access inside accounts; customer pages show only records the Customer has published.
- Passwords stored as one-way hashes; sign-in, confirmation and reset links are single-use and time-limited.
- Production access limited to a small number of authorised people, [with multi-factor authentication].
- Regular backups.
- Error monitoring and logging of security-relevant events.