Data processing terms

1. Roles and scope

The Customer decides which personal data is entered into STRATIVA and for what purposes. STRATIVA processes it only to provide the service.

2. Details of the processing

Subject matter and duration: providing the STRATIVA service for as long as the Customer's account is active, plus the deletion period below.

Nature and purpose: hosting, storing, organising, displaying, analysing, transmitting and deleting data so the Customer can run its business in STRATIVA.

People concerned: the Customer's owners, managers and employees, and the Customer's own customers, suppliers, drivers, subcontractors and other contacts.

Types of data: identification and contact details, job and role information, work records, photos and documents, location of sites and deliveries, vehicle records, commercial and financial records, and security logs.

3. Instructions

STRATIVA processes personal data only on the Customer's documented instructions. Using the service and its settings counts as such instructions. If STRATIVA believes an instruction breaks the law, it will tell the Customer.

4. Confidentiality

Everyone at STRATIVA who can access Customer data is bound by confidentiality. Access is granted only when needed for support or operations and is limited to what is necessary.

5. Security measures

STRATIVA maintains appropriate technical and organisational measures, including:

Separation of each Customer's data by security rules in the database itself, with an automated test, run on every change, that checks no company can see or change another company's data.

Encryption in transit (HTTPS with strict transport security) and at rest; logins, tokens and webhook signing secrets for outside services in an encrypted vault; access keys stored only in hashed form.

Two-step sign-in (required for owners and administrators by default), passwords of at least 8 characters, automatic sign-out after inactivity, sign-in history and new-device alerts.

Role-based access control and an audit trail of important changes that people in STRATIVA cannot change or delete.

Encrypted nightly backups stored separately, with monthly restore tests.

Health checks of the service and its background jobs, with email alerts to our team when a backup or a restore test fails.

Secure development: every change is tested automatically, including the check that companies cannot see each other's data, and every database change is installed and checked on a separate test system before it goes live.

STRATIVA may improve these measures over time but will not reduce the overall level of protection.

6. Service providers (sub-processors)

The Customer gives STRATIVA general permission to use service providers to help run the service, such as cloud hosting, email delivery, backup storage and, only when the Customer switches them on, AI assistance and e-invoicing.

STRATIVA binds each provider by written terms that protect the data at least as well as these terms, and remains responsible for them.

The current list (provider, purpose and location) is available on request (info@strativa.uk). STRATIVA will give at least 30 days' notice before adding or replacing a provider. If the Customer objects on reasonable data protection grounds and no solution is found, the Customer may end the affected service without penalty.

7. International transfers

Where personal data is transferred outside the Customer's country, STRATIVA ensures a lawful transfer mechanism, such as an adequacy decision, an approved country list or standard contractual protections, and appropriate safeguards.

8. Security incidents

STRATIVA will notify the Customer without undue delay, and in any case within 24 hours, after becoming aware of a personal data breach affecting the Customer's data, and will send the full details within 72 hours. The notice will describe what happened, the data and people likely affected, the likely consequences and the measures taken, and STRATIVA will update it as more is known. [lawyer: confirm the 24 and 72 hours under Resolution 415 and whether STRATIVA must also notify the authority directly]

9. Assistance to the Customer

STRATIVA helps the Customer answer people's requests to access, correct, export or delete their data, including through the export features in the service, and helps with data protection impact assessments and consultations with authorities where reasonably required.

10. End of the service

The Customer can export its records at any time. After a deletion request there is a 30-day waiting period in which the Customer can cancel; then all Customer data, including uploaded files, is permanently deleted the following night and disappears from backups as they expire, within 12 months. STRATIVA keeps only a short record that the deletion took place, without Customer data.

11. Audits

On request, STRATIVA provides the information needed to show that it follows these terms, such as a description of its security measures and the results of its checks. [lawyer: frequency, notice period and costs of on-site audits]

12. Other terms

[lawyer: liability, governing law (England and Wales), order of precedence with the main agreement, and any additional terms required by the laws of the Customer's country]