SiteCabin data processing agreement

Draft of 12 October 2026

1. Parties and how this agreement applies

1.1 This agreement is between Brightyard Ltd, a company registered in England and Wales with number 17511364, trading as SiteCabin (Brightyard), and the business that has signed up to SiteCabin (the Customer).

1.2 It forms part of the SiteCabin Terms of Service. It applies automatically when the Customer accepts those terms, and lasts as long as Brightyard processes Customer Personal Data.

1.3 The Customer is the controller of the Customer Personal Data. Brightyard is its processor. Brightyard processes Customer Personal Data only to provide SiteCabin.

1.4 Brightyard is a controller, not a processor, for its own business data about the Customer: the account holder's contact details, billing records, support emails about the account and how the Customer heard about SiteCabin. Brightyard's privacy notice covers that data, not this agreement.

1.5 If this agreement and the Terms of Service disagree about personal data, this agreement wins.

2. Definitions

Words such as controller, processor, personal data, processing and data subject have the meanings given in the UK GDPR.

3. Brightyard's duties

3.1 Instructions. Brightyard processes Customer Personal Data only on the Customer's documented instructions. The Customer's instructions are this agreement, the Terms of Service, and what the Customer and its Users choose to do in SiteCabin, including its settings. If Brightyard thinks an instruction breaks Data Protection Law, it will tell the Customer promptly. If the law requires Brightyard to process the data in another way, it will tell the Customer first, unless the law forbids that.

3.2 Customer's own duties. The Customer is responsible for having a lawful basis for the processing, for telling its staff and its own customers how their data is used (SiteCabin supplies a staff privacy notice template), and for the accuracy of what it puts in.

3.3 Confidentiality. Brightyard ensures that everyone who can access Customer Personal Data is bound by a duty of confidentiality, and only accesses it when needed to run, support or secure SiteCabin. They process it only on the Customer's instructions, unless the law requires otherwise. This duty continues after the service ends.

3.4 Security. Brightyard takes appropriate technical and organisational measures to protect Customer Personal Data, as Article 32 of the UK GDPR requires. The measures in place are described in Schedule 2. Brightyard may improve them over time but will not reduce the overall level of protection.

3.5 No other use. Brightyard does not sell Customer Personal Data. It does not use Customer Personal Data to train artificial intelligence models, and does not send it to AI services. It does not use it for its own marketing or for any purpose other than providing SiteCabin.

3.6 Anonymous figures. Brightyard may count usage in a way that identifies no person, such as the number of active firms or forms completed, to run and improve SiteCabin.

3.7 Ownership. The Customer owns the Customer Personal Data. It gives Brightyard a limited, non-exclusive, non-transferable right to use it only to provide SiteCabin, for as long as this agreement lasts. Brightyard owns SiteCabin itself and its materials.

3.8 No disclosure. Brightyard will not disclose Customer Personal Data to any third party except its sub-processors under clause 4, or where the law requires it. If a court, the police or a regulator asks Brightyard for Customer Personal Data, Brightyard will tell the Customer and discuss the response first, unless the law forbids that.

4. Sub-processors

4.1 The Customer gives Brightyard general permission to use the sub-processors listed in Schedule 3.

4.2 Brightyard will tell the Customer's admins by email at least 30 days before adding or replacing a sub-processor, and keep the current list on its website. The Customer may object on reasonable data protection grounds within that time. If the parties cannot resolve the objection, the Customer may cancel SiteCabin without penalty and receive a refund of any amount paid for the period after cancellation.

4.3 Brightyard puts a written contract in place with each sub-processor that gives Customer Personal Data the same level of protection as this agreement. Brightyard stays fully responsible to the Customer for its sub-processors' work. On request, Brightyard will provide copies of those contracts, with unrelated commercial terms removed.

4.4 Microsoft is not Brightyard's sub-processor. Files, workbooks and certificates are stored in the Customer's SharePoint area, and emails go out through a mailbox the Customer chooses. Both sit in the Customer's own Microsoft 365 account, under the Customer's own contract with Microsoft. SiteCabin only reads and writes that one SharePoint site and that one mailbox, using the permissions the Customer's admin grants during setup. The Customer can see or withdraw those permissions in its own Microsoft admin centre at any time.

5. Transfers outside the UK

5.1 SiteCabin's database and the servers that run the app are in London. Files stay in the Customer's own SharePoint area, wherever the Customer's Microsoft 365 account keeps its data.

5.2 Some sub-processors are US companies whose staff may access data from outside the UK to run, support or secure their services. That is a Restricted Transfer. Brightyard makes it only with one of these safeguards in place:

• the recipient is certified to the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), and its certification covers HR data as well as non-HR data, because much of the Customer Personal Data is about the Customer's staff; or
• the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, in the sub-processor's own data processing agreement, with a transfer risk assessment.

5.3 Schedule 3 says which safeguard covers each sub-processor. Brightyard checks each certification on the official Data Privacy Framework list at least once a year and before relying on it.

5.4 Brightyard will not move the database or the app's servers out of the UK without giving the Customer the notice in clause 4.2.

6. Personal data breaches

6.1 Brightyard will tell the Customer about a Personal Data Breach without undue delay, and in any case within 48 hours of becoming aware of it. This gives the Customer time to meet its own 72-hour deadline for telling the ICO.

6.2 The notice goes by email to the Customer's admins. It will say, as far as Brightyard then knows:

• what happened and when;
• which kinds of data and roughly how many people are affected;
• the likely consequences;
• what Brightyard has done and will do to contain it and limit the harm;
• a named contact for more information.

6.3 If Brightyard does not know everything at first, it will send what it knows and add the rest as it finds out.

6.4 Brightyard will take reasonable steps to contain the breach and stop it happening again. It will co-operate with the Customer's investigation, follow the Customer's reasonable directions on fixing the problem, and help the Customer tell the ICO and the people affected, if the Customer needs to. A notice under this clause is not an admission of fault.

7. Helping the Customer

7.1 People's rights. Most requests can be handled by the Customer's own admins in SiteCabin, because they can see, correct, export and remove their staff's records. Where they cannot, Brightyard will help the Customer answer requests from people exercising their rights (access, correction, deletion, restriction, objection and portability). If a person contacts Brightyard directly, Brightyard will pass the request to the Customer within 5 working days and will not answer it itself unless the Customer asks it to.

7.2 Assessments and the ICO. Brightyard will give the Customer reasonable information and help with data protection impact assessments, prior consultation with the ICO, and the Customer's security duties, as far as these relate to SiteCabin.

7.3 Cost. Help under this clause is free where it is reasonable in scale. Brightyard may charge a fair fee, agreed in advance, for help that is unusual or takes significant time.

8. End of the service: return and deletion

8.1 Files are already the Customer's. Everything SiteCabin files in the Customer's SharePoint area stays there, in the Customer's own Microsoft 365 account, when the service ends. Brightyard does not delete it.

8.2 Getting data out. Until the service ends, the Customer's admins can export their records from SiteCabin (for example timesheets, holidays and staff records as spreadsheets). Brightyard will help with a reasonable export request made before the deletion date in 8.3.

8.3 Deletion. When the Customer closes its account, it keeps access to the end of the period already paid for, then has read-only access. 30 days after that, Brightyard deletes the Customer's records from SiteCabin's database. Copies in Brightyard's encrypted database backups are overwritten within a further 30 days.

8.4 What Brightyard keeps. Brightyard keeps only what the law requires it to keep as a controller: the Customer's firm name, invoices and payment records (normally six years, for tax). Nothing about the Customer's staff or customers is kept.

8.5 On request, Brightyard will confirm in writing that deletion has happened.

9. Audits and information

9.1 Brightyard will make available the information the Customer reasonably needs to show that both parties are meeting Article 28 of the UK GDPR.

9.2 Brightyard will first answer the Customer's audit needs with documents: this agreement, its security measures, its Cyber Essentials certificate, its ICO registration number, a written security questionnaire (answered once a year on request) and its sub-processors' own certificates.

9.3 If that is not enough, or the ICO requires it, or after a Personal Data Breach, the Customer (or an independent auditor bound by confidentiality) may audit Brightyard. The Customer must give 30 days' notice, keep to working hours, avoid disrupting the service and other customers' data, and pay its own costs. Audits are limited to once a year unless the ICO requires more or there has been a breach.

10. Liability, term, changes and law

10.1 Liability. Each party's liability under this agreement is subject to the limits and exclusions in the Terms of Service. Nothing limits a party's liability where the law does not allow it to be limited.

10.2 Term. This agreement starts when the Customer accepts the Terms of Service. It ends when Brightyard has deleted the Customer Personal Data under clause 8. Clauses 3.3, 8 and 10 continue after that.

10.3 Changes. Brightyard may update this agreement to reflect changes in Data Protection Law or in SiteCabin, giving the Customer's admins at least 30 days' notice by email. A change that reduces the protection of Customer Personal Data needs the Customer's agreement.

10.4 Law. This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Schedule 1: Details of the processing

Schedule 2: Security measures

Schedule 3: Sub-processors

Not sub-processors, because they never receive Customer Personal Data: Stripe (handles Brightyard's billing of the Customer, as Brightyard's own supplier), Cloudflare (hosts the marketing website and waiting list), GitHub (holds the code, with made-up test data only) and UptimeRobot (checks the app is up).