Data processing agreement

Parties and scope

This agreement is between the customer organization (the controller) and ExpertFusion Software and Marketplace L.L.C-FZ, the operator of PestLove (the processor). It forms part of the terms of service and applies automatically to every subscription; no signature is needed. If it conflicts with the terms on the processing of personal data, this agreement prevails.

It covers personal data that the organization and its users enter into or generate through PestLove. The operator’s own processing for accounts, billing, security and the website is described in the privacy policy.

Instructions and confidentiality

We process customer personal data only on the organization’s documented instructions — the terms, this agreement and the organization’s configuration and use of the service — unless the law requires otherwise, in which case we inform the organization first where permitted. We tell the organization if we believe an instruction breaks data protection law.

Everyone authorized to process customer personal data is bound by confidentiality, and access is limited to what is needed to provide, support and secure the service.

Security measures

We maintain appropriate technical and organizational measures, including: tenant isolation enforced on every request and API call; role-based permissions and explicit sharing between organizations; encrypted connections (TLS); hashed passwords and rate-limited sign-in; scoped API tokens; operational audit records; least-privilege access to production systems; version-controlled, tested releases; and database backups.

We may update these measures as long as the overall level of protection is not reduced.

Sub-processors

The organization authorizes the following sub-processors: Vultr (hosting, databases and file storage, Amsterdam, Netherlands; and our outgoing email server, Madrid, Spain) and Expo / 650 Industries, Inc. (mobile push notifications, United States). Stripe processes payment data as an independent controller.

We give at least 30 days’ notice by email before adding or replacing a sub-processor. The organization may object on reasonable data protection grounds; if we cannot resolve the objection, it may terminate the affected service and receive a pro-rata refund of prepaid fees. We impose equivalent data protection obligations on every sub-processor and remain responsible for them.

International transfers

Customer personal data is hosted in the Netherlands. Where it is transferred outside the EEA, the UK or Switzerland — including to the operator in the United Arab Emirates and to sub-processors in the United States — the European Commission Standard Contractual Clauses (Decision 2021/914, Module 2: controller to processor, governed by Irish law) are incorporated into this agreement, together with the UK International Data Transfer Addendum and the Swiss adaptations where applicable.

Assistance, breaches and audits

The service lets the organization access, correct, export and delete its data. We forward any request from a data subject to the organization and help it respond, and we provide reasonable information for data protection impact assessments.

We notify the organization without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting its data, with the information then available, and we keep it informed as we learn more.

We make available the information needed to demonstrate compliance with this agreement. The organization may audit our compliance once a year with 30 days’ written notice, or after a breach, under confidentiality and at its own cost.

Return and deletion

During the subscription and for 30 days after it ends, the organization can export its data. We then delete customer personal data from the live systems, and backup copies are removed when they expire from the backup rotation, unless the law requires us to keep it. We confirm deletion in writing on request.

Details of the processing

Subject matter and purpose: providing the PestLove software for pest control, food safety (HACCP), auditing, training and laboratory workflows. Duration: the term of the subscription plus the export period. Nature: hosting, storage, organization, display, transmission by email and push notification, reporting, export, backup and deletion.

Data subjects: the organization’s users, its customers and their contacts, site staff named in records, trainees and signatories. Categories of data: names, job titles, business contact details, account identifiers, site addresses, service, inspection and audit records, readings, photographs, signatures and training records. Special categories of data are not intended to be processed.

Liability under this agreement is subject to the limits in the terms of service, except where data protection law does not permit them.