Legal
Data Processing Agreement
The terms that apply when EvoPoint processes personal data on behalf of a business customer using the platform.
Last updated · 3 November 2026
1. About this agreement
This Data Processing Agreement applies where EvoPoint Ltd processes personal data on behalf of a business customer using the EvoPoint platform. EvoPoint Ltd is a company registered in England and Wales, company number 12798732, at 28 Robert Street, Ynysybwl, CF37 3DU.
Our Customer Terms incorporate this agreement, so it applies to every customer whose subscription is governed by them. In this agreement, “the customer” means the organisation that holds the EvoPoint subscription, and “customer personal data” means the personal data EvoPoint processes on the customer's behalf through its workspace.
Customers who need a signed copy of this agreement can email privacy@evopoint.uk.
2. Roles and processing details
The table below sets out the role of each party and the processing EvoPoint carries out for the customer.
| Item | Position |
|---|---|
| Customer role | Controller for the personal data in its workspace, including incident records, public QR reports, staff and contractor data, and site information. |
| EvoPoint role | Processor for customer personal data. EvoPoint is a separate controller for its own account, billing, website, support and marketing records, which our Privacy Policy covers and this agreement does not. |
| Subject matter | Provision of cloud incident reporting, ticketing, assignment, recording, reporting and related software services. |
| Duration | For the duration of the customer's subscription, plus any retention period that applies after it ends. |
| Nature of processing | Collection, storage, hosting, retrieval, display, organisation, modification, export and deletion of customer personal data, and support access where required. |
| Categories of data subjects | The customer's users (its company admin, controllers, staff and contractors), members of the public who submit a report by scanning a QR code, and other individuals mentioned in reports. |
| Categories of personal data | Names, contact details and roles of users; incident details, including categories, summaries, descriptions, comments, status updates and photos; locations, including site and location details, map pins, a reporter's phone location where they choose to share it, and a contractor's live location while they are on shift and working; an optional name and email address or phone number left by a public reporter; and timestamps, actions and technical data, such as IP address and browser details, recorded in the incident timeline and audit log. |
3. Instructions
EvoPoint will process customer personal data only on the customer's documented instructions, unless the law requires otherwise.
4. Confidentiality
EvoPoint will make sure that the people it authorises to process customer personal data are bound by obligations of confidentiality.
5. Security measures
EvoPoint will apply appropriate technical and organisational measures to protect customer personal data. These include:
- separation between customer workspaces, so one customer's data is not available to another;
- role checks on every route, so each user reaches only what their role allows;
- two-factor authentication for admin accounts;
- an append-only audit log of actions;
- photos that upload straight to storage and never pass through our API;
- rate limits and account lockout on sign-in;
- encryption in transit using HTTPS (TLS), and encryption at rest for files stored in Amazon S3.
Our Security page describes these controls in more detail.
6. Sub-processors
The customer gives EvoPoint general authorisation to use the sub-processors needed to provide the service. The current list is set out below. EvoPoint keeps this list up to date and will notify customers of material changes where required.
| Sub-processor | Purpose | Location and data |
|---|---|---|
| Amazon Web Services (AWS) | Application hosting and related infrastructure. | London region (eu-west-2). |
| Amazon S3 | Storage for files, including photos, exports and reports. | London region (eu-west-2). Files are encrypted at rest. |
| Amazon Simple Email Service | Transactional email, including sign-in links. | London region (eu-west-2). |
| Amazon Simple Notification Service | Push notifications to the EvoPoint mobile app. | London region (eu-west-2). Passes notifications to Google Firebase Cloud Messaging or Apple Push Notification service for delivery to the device. |
| Supabase | Database hosting for the records created in the platform, including incidents, users and reports. | Database hosted by Supabase. Ask us if you need its region for your assessment. |
| Vercel | Hosting and delivery of the EvoPoint website and web application. | Processes request metadata, including IP addresses. For locations, see the provider's terms. |
| Stripe | Subscription billing and payment processing, through Stripe-hosted checkout. | Full card numbers are handled by Stripe and never reach EvoPoint. For locations, see the provider's terms. |
| Sentry | Error monitoring for our backend services. | For locations, see the provider's terms. |
| Google Firebase Cloud Messaging | Delivery of push notifications to Android devices, and to iOS devices where used. | Receives notifications from Amazon Simple Notification Service. For locations, see the provider's terms. |
| Apple Push Notification service | Delivery of push notifications to iOS devices. | Receives notifications from Amazon Simple Notification Service. For locations, see the provider's terms. |
Maps in the platform load their map tiles in the browser directly from OpenFreeMap, which therefore sees the browser's IP address. OpenFreeMap does not receive customer records, so it is not a sub-processor.
7. International transfers
EvoPoint runs the application and stores files on Amazon Web Services in the London region (eu-west-2). The platform database is hosted by Supabase.
Where a transfer of customer personal data outside the United Kingdom takes place through a sub-processor, EvoPoint will rely on appropriate safeguards under UK data protection law.
8. Assistance with rights requests
EvoPoint will reasonably assist the customer with requests from individuals to access, correct, delete, restrict or object to the processing of their personal data, where the request relates to customer personal data processed through the platform. If EvoPoint receives such a request directly, it will refer the request to the customer or help the customer to deal with it.
A company admin can request a full export of the workspace's data, and tooling exists to erase an individual's personal data.
9. Breach notification
If EvoPoint becomes aware of a personal data breach affecting customer personal data, EvoPoint will notify the customer without undue delay and provide reasonable information to help the customer assess and respond to the breach.
10. Deletion or return
At the end of the service, EvoPoint will delete or return customer personal data in line with the Customer Terms, the retention periods in our Privacy Policy and legal requirements. The customer should export the records it needs before access ends.
When a workspace is closed, its data is kept for the platform retention window, after which account, incident and comment data is anonymised and photos are deleted. Audit log entries are append-only and are kept after the workspace closes. The Privacy Policy states the current retention window.
11. Audit and information
EvoPoint will provide the information reasonably necessary to demonstrate compliance with this agreement. Any formal audit must be proportionate, subject to confidentiality and security requirements, and arranged with reasonable notice.
12. Customer obligations
The customer is responsible for making sure that:
- it has a lawful basis for the personal data it submits to EvoPoint;
- its public QR signage and privacy notices are appropriate;
- its authorised users use the platform lawfully and in line with our Acceptable Use Policy.
13. Signed copies and contact
Customers who need a signed copy of this agreement, or who have a question about it, can email privacy@evopoint.uk or write to EvoPoint Ltd, 28 Robert Street, Ynysybwl, CF37 3DU.