Data Processing Agreement

The Customer is the controller and SLP Media Ltd is the processor. We process personal data only on the Customer’s documented instructions (which include using the features of Krux), unless required by law.

Subject matter: provision of the Krux platform. Duration: for the term of the Customer’s use of Krux, plus any agreed wind-down period.

• Purpose: site, workforce and compliance management and payroll estimation.
• Categories of data subjects: the Customer’s workers, operatives and subcontractors.
• Types of personal data: names, contact details, trade/role, UTR and tax-reference data, National Insurance-related details, CSCS card data, pay rates and timesheets, clock-in location/GPS data, and incident records.

• Process only on documented instructions.
• Ensure personnel are bound by confidentiality.
• Implement appropriate technical and organisational security (row-level tenant isolation, encryption in transit, role-based access, least-privilege secret handling).
• Engage sub-processors only under equivalent terms, and inform the Customer of changes.
• Assist the Customer with data-subject requests, DPIAs and breach notifications.
• Notify the Customer without undue delay on becoming aware of a personal-data breach.
• Delete or return personal data at the end of the service, save where retention is legally required.
• Make available information needed to demonstrate compliance and allow reasonable audits.

We currently use:

• Supabase — database, authentication, hosting.
• Vercel — application hosting.
• Stripe — payments / disbursements (where enabled).
• [EMAIL PROVIDER] — transactional email.

Where a sub-processor processes data outside the UK, transfers are made under appropriate safeguards (UK adequacy or the IDTA/Addendum). [Confirm and configure provider regions for any required data residency.]

The Customer, as controller, is responsible for the lawfulness of any worker location monitoring it enables — including completing a DPIA and informing workers transparently. Krux provides supporting tooling only.