Data Processing Agreement
This agreement forms part of the unitbook Terms of Service and applies automatically when a customer accepts them. To sign a copy, email privacy@unitbook.io.
1. Parties and roles
This agreement is between the business using unitbook ("Customer", the controller) and [to be confirmed] ("unitbook", the processor). It covers personal data that Customer and its users put into unitbook about Customer's staff and clients. unitbook processes that data only to provide the Service and only on Customer's documented instructions: the Terms, Customer's settings and its use of the Service.
It is written to meet the processor requirements of Jamaica's Data Protection Act, 2020, and comparable laws elsewhere. If it conflicts with the Terms on data protection, this agreement wins.
2. Processing details
| Subject matter | Hosting and processing Customer's field-service records |
|---|---|
| Nature and purpose | Storing, displaying, generating PDFs, emailing reports and invoices, exporting, backing up |
| Data subjects | Customer's users (admins, office staff, technicians); Customer's clients and their contacts |
| Personal data | Names, emails, phone numbers, addresses, account numbers, tax numbers (TRN), signatures, form answers and notes, job photos, job locations (where a job was submitted and photos were taken, when location recording is on), service dates, login and usage records |
| Special categories | None expected. Customer should not record health or other sensitive data in custom form fields unless it has a lawful basis |
| Duration | The subscription term, plus the export and deletion period in section 7 |
3. unitbook's obligations
- Process the data only on Customer's instructions, and tell Customer if an instruction appears to break the law.
- Make sure anyone with access is bound by confidentiality.
- Keep the security measures in section 5 in place.
- Not sell the data, or use it for its own purposes beyond running and securing the Service.
- Help Customer answer data subject requests using the Service's tools or, where needed, on request.
- Give reasonable help with impact assessments and regulator enquiries about the Service.
Customer is responsible for its lawful basis for collecting the data, including notices to its clients about recording signatures and personal details, and to its technicians about recording job locations.
4. Sub-processors
| Sub-processor | Purpose | Data location |
|---|---|---|
| DigitalOcean, LLC | Application and database hosting | DigitalOcean, New York, USA |
| Amazon Web Services, Inc. | Encrypted storage of invoice and service-report PDFs | AWS us-east-2 |
| Postmark (ActiveCampaign, LLC) | Sending invoices, reports and account emails | United States |
Stripe processes subscription billing as a separate merchant of record and receives no Customer client data. unitbook binds each sub-processor to data protection terms at least as protective as these, and remains responsible for them. unitbook will email Customer's admin at least 30 days before adding or replacing a sub-processor. Customer may object on reasonable data protection grounds and, if unresolved, cancel with a pro-rated refund.
5. Security measures
- HTTPS for all traffic; storage reached only over TLS.
- PDFs in a private, versioned bucket with all public access blocked and server-side encryption.
- Production credentials limited to the folders the app needs.
- Passwords hashed; login attempts rate-limited; technician app tokens expire.
- Each customer's records separated by company, with in-app access by assigned role.
- Error alerts, a daily health check, and off-server database backups.
6. Breaches, assistance and audits
Breach notification. unitbook will notify Customer without undue delay, and within 48 hours of confirming a personal data breach affecting Customer's data, with what happened, the data involved, likely consequences and the steps taken.
Audits. Once a year, or after a breach, unitbook will answer a reasonable written security questionnaire. On-site audits are by mutual agreement, at Customer's cost, with reasonable notice.
7. Return and deletion
When the subscription ends, Customer has 30 days to export its data using CSV export and PDF downloads, or by asking privacy@unitbook.io for a full export. After that, unitbook deletes Customer's data and stored PDFs from the live system; backup copies expire afterwards. unitbook keeps only what the law requires and will confirm deletion in writing on request.