Data Processing Agreement
Last updated: 25 June 2026 · Version 3 · Vancap Technologies Ltd
This Data Processing Agreement (‘DPA’) forms part of the agreement between Vancap Technologies Ltd (company number 17057839), of C/O Roxburgh Milkins Limited, Merchants House North, Wapping Road, Bristol BS1 4RW (‘Vancap’, ‘Processor’), and the customer organisation that has agreed to Vancap’s Terms of Service or signed an order with Vancap (the ‘Customer’, ‘Controller’) (together, the ‘Agreement’).
It governs Vancap’s processing of personal data on the Customer’s behalf when the Customer uses the Vancap Platform (the ‘Services’). Where this DPA and the Terms of Service conflict on the subject of data protection, this DPA prevails.
1. Definitions
Terms such as ‘personal data’, ‘processing’, ‘controller’, ‘processor’, ‘data subject’, ‘personal data breach’, and ‘supervisory authority’ have the meanings given in UK Data Protection Law, meaning the UK GDPR (Regulation (EU) 2016/679 as it forms part of UK law) and the Data Protection Act 2018, and any successor legislation. Where the EU GDPR applies to the processing, references to UK Data Protection Law include the EU GDPR and the relevant EU transfer mechanisms.
- Customer Content — your ‘Content’ as defined in the Terms of Service.
- Customer Personal Data — personal data within the Customer Content that Vancap processes on the Customer’s behalf under the Agreement, as described in Annex 1.
- Sub-processor — a third party engaged by Vancap to process Customer Personal Data.
2. Roles and scope
2.1 As between the parties, the Customer is the controller and Vancap is the processor of the Customer Personal Data described in Annex 1.
2.2 Each party will comply with its obligations under UK Data Protection Law. The Customer is responsible for the lawfulness of the Customer Personal Data it provides and of the instructions it gives, including having a valid lawful basis and, where required, having provided notice to, or obtained consent from, the relevant data subjects (for example, individuals whose personal data appears in uploaded photos, documents, or messages).
2.3 This DPA governs Vancap’s processing of Customer Personal Data as a processor. Separately, for personal data that each party processes about the other’s personnel in order to manage the business relationship (such as the contact details of administrators and signatories), each party acts as an independent controller and is responsible for its own compliance with UK Data Protection Law.
3. Vancap’s obligations as processor
Vancap will:
3.1 Process only on documented instructions. Process Customer Personal Data only on the Customer’s documented instructions (including as set out in the Agreement and through the Customer’s configuration and use of the Services), and not for its own purposes. Vancap will not sell Customer Personal Data and will not use it to train artificial intelligence models, except with the Customer’s explicit prior consent. If Vancap is required by law to process beyond those instructions, it will inform the Customer first unless the law prohibits this.
3.2 Confidentiality. Ensure that personnel authorised to process Customer Personal Data are bound by appropriate confidentiality obligations and access it only as needed to provide the Services.
3.3 Security. Implement appropriate technical and organisational measures to protect Customer Personal Data, as set out in Annex 2 and as required by Article 32 UK GDPR.
3.4 Sub-processors. Engage sub-processors in accordance with section 4.
3.5 Assist with data subject rights. Taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights under UK Data Protection Law. If Vancap receives such a request directly, it will, without undue delay, inform the data subject to contact the Customer and notify the Customer.
3.6 Assist with compliance. Taking into account the nature of processing and the information available to Vancap, assist the Customer in ensuring compliance with its obligations relating to security (Article 32), personal data breach notification (Articles 33–34), data protection impact assessments (Article 35), and prior consultation (Article 36).
3.7 Personal data breach. Notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide the Customer with the information reasonably available to it to meet its own notification obligations.
3.8 Deletion or return. On termination or expiry of the Agreement, and at the Customer’s choice, delete or return Customer Personal Data held in the live Services within a reasonable period (ordinarily within 30 days), unless UK Data Protection Law requires continued storage. Residual copies held in routine, encrypted backups are deleted in the ordinary course of our backup cycle and remain inaccessible for normal use until then. The Customer may export its Content before deletion.
3.9 Records and audits. Make available to the Customer information reasonably necessary to demonstrate compliance with this section and Article 28 UK GDPR, and allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates. Such audits are limited to once per year, on reasonable prior notice, during business hours, and subject to confidentiality; Vancap may satisfy an audit request by providing existing reports or certifications.
4. Sub-processors
4.1 The Customer gives general authorisation for Vancap to engage the sub-processors listed in Annex 3 (the current sub-processor list) to process Customer Personal Data.
4.2 Vancap will impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains liable to the Customer for its sub-processors’ performance.
4.3 Vancap will give the Customer 30 days’ prior notice of any intended addition or replacement of a sub-processor (by updating the list in Annex 3 and/or notifying the Customer). The Customer may object on reasonable data protection grounds; the parties will work in good faith to resolve the objection, and if they cannot, the Customer may terminate the affected Services.
5. International transfers
5.1 Vancap stores Customer Personal Data primarily in the United Kingdom and the European Union. Certain sub-processors (including the AI, authentication, document-preview, and content-delivery providers in Annex 3) process data in the United States or other countries.
5.2 Where Customer Personal Data is transferred outside the UK, such transfers take place under the data protection terms of the relevant sub-processor, which provide for an appropriate transfer mechanism (such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses) or rely on a valid adequacy decision, where one is required. Vancap will ensure that any such transfer is subject to an appropriate transfer mechanism or adequacy decision as required by UK Data Protection Law, and will, on the Customer’s reasonable request, make available a description of the safeguards relied on.
6. Liability
The parties’ liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service / Agreement. That cap applies to this DPA; no separate data-protection super-cap applies.
7. Term and termination
This DPA takes effect when the Customer accepts the Agreement and continues for as long as Vancap processes Customer Personal Data. Sections that by their nature should survive (including sections 3.8, 3.9, 5, and 6) survive termination.
8. Governing law
This DPA is governed by the laws of England and Wales, consistent with the Terms of Service / Agreement of which it forms part, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.
Annex 1 — Details of the processing
- Subject matter: Vancap’s provision of the Services to the Customer.
- Duration: the term of the Agreement, plus any deletion/return period.
- Nature and purpose: hosting, storage, organisation, retrieval, display, transmission, AI-assisted summarisation and draft-report generation, and related processing, in order to provide the Services. The Customer instructs Vancap to process Customer Personal Data for these purposes, including by transmitting relevant Customer Content (which may include text and images) to its AI sub-processor (Anthropic, United States) as an integral part of the Services.
- Types of personal data:
- Account users: name, email address, optional phone number, role, IP address, and authentication identifiers.
- Within Customer Content: any personal data the Customer or its field workers include in jobs — for example names, addresses, and contact details in notes, documents, and messages; sender phone numbers and usernames from messaging integrations; precise location/GPS data; and personal data appearing in photographs, audio, and video (e.g. individuals at inspection sites). The Customer may upload content that contains special-category data (Article 9) — for example, health information or identifiable images of individuals. The Customer is the controller of such data, must not upload it without a valid Article 9 condition (and, where relevant, an appropriate policy document), and Vancap processes it only as the Customer’s processor on the Customer’s instructions.
- Categories of data subjects: the Customer’s staff and authorised users; and third parties whose personal data appears in Customer Content, such as property occupants, site visitors, and people who send messages into a job.
Annex 2 — Technical and organisational security measures
Vancap maintains measures including:
- Tenant isolation: strict per-organisation separation enforced at the database level with PostgreSQL row-level security — the application connects under a constrained database role to which the policies apply, so access is scoped to a single organisation and a missed application check fails closed rather than leaking. Files are stored under per-organisation paths.
- Encryption: encryption in transit (HTTPS/TLS) for connections to the Services; encryption at rest provided by the storage and database platforms.
- Access control: role-based access within the Services; least-privilege internal access; authentication via the Customer’s Google or Microsoft single sign-on.
- Logging and monitoring: audit and access logging of sensitive actions, including IP addresses, for security purposes.
- Application hardening: rate limiting, validation of uploaded files, signed/ verified inbound integration webhooks, and content/prompt safeguards for AI features.
- AI data minimisation: we send only the content needed to provide the AI feature in use — for example text and, where relevant, images — and only to provide that feature.
Encryption at rest is enabled by the underlying storage and database platforms (Supabase and AWS) as standard. We keep these measures under review and enhance them as the Services grow. Vancap is not currently certified to ISO 27001 or SOC 2; the measures above describe our current controls.
Annex 3 — Authorised sub-processors
The Customer authorises the following sub-processors. We give notice of changes under section 4.3. “When” indicates whether a sub-processor is always engaged, or only when the Customer enables the relevant integration.
| Sub-processor | Purpose | Location | When |
|---|---|---|---|
| Supabase | Authentication and database | UK (London) | Always |
| Amazon Web Services (S3) | File and media storage | UK (London) | Always |
| Anthropic | AI processing † | United States | Always |
| Cloudflare | CDN, TLS, and security | Global edge | Always |
| Railway | Application hosting | EU (Amsterdam) | Always |
| Google / Microsoft | Single sign-on | US / global | Always |
| Microsoft (Office) | Document preview, Word add-in | US / global | Always |
| Mapbox | Map rendering | US / global | Always |
| Meta (WhatsApp) | Inbound messaging capture | US / global | If enabled |
| Telegram | Inbound messaging capture | Global | If enabled |
† Anthropic does not use content submitted via its API to train its models.