Data Processing Agreement — Jiffy Compliance

This DPA is part of the Jiffy Compliance Terms of Service. It applies automatically when you register for a Jiffy Compliance account or purchase eLearning courses for a team. It sets out how we handle personal data that you upload or input into the platform on behalf of your workers.

Data Controller

The Customer

The business that registers for a Jiffy Compliance platform account or purchases eLearning courses for a team — and who decides what personal data is uploaded and why.

Data Processor

Loxbrook Associates Limited

Trading as Jiffy Compliance and Marble Training
Company No. 04924146
182 Worcester Road, Bromsgrove, B61 7AZ

Contents

Definitions
Scope and who this applies to
What we commit to as processor
What you commit to as controller
Sub-processors
International transfers
Security
Data breaches
Data subject rights
Data protection impact assessments
Audit rights
Deleting data when it's no longer needed
Liability
When this DPA ends
Governing law
Annex 1 — Processing details
Annex 2 — Approved sub-processors

01 Definitions

Capitalised terms not defined here have the same meaning as in the Jiffy Compliance Terms of Service.

"Applicable Data Protection Law" — UK GDPR, the Data Protection Act 2018, and any successor legislation, together with guidance from the ICO.
"Controller" — the Customer: the business that decides the purposes and means of processing Customer Personal Data.
"Customer Personal Data" — any personal data uploaded or input by the Customer into the Jiffy Compliance platform, including Workforce Data and learner records.
"Data Subject" — the individual whose personal data is being processed.
"ICO" — the UK Information Commissioner's Office.
"Processing" — has the meaning in Article 4(2) UK GDPR.
"Processor" — Loxbrook Associates Limited (trading as Jiffy Compliance), who processes Customer Personal Data on the Controller's behalf.
"Security Incident" — a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
"Sub-processor" — any third party we engage to process Customer Personal Data on our behalf.
"UK GDPR" — the UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018.

02 Scope and who this applies to

This DPA applies wherever we process Customer Personal Data on your behalf. That includes:

Full platform accounts — where you upload workforce data about your employees and contractors into the compliance hub, LMS or H&S modules.
Light business eLearning accounts — where you purchase courses for a team and we hold learner registration details, progress records and completion certificates for your team members.

It does not apply to individual standalone learner accounts, where the person purchasing the course is also the learner and there is no third-party workforce relationship. In that case, we act as data controller directly under our Privacy Policy.

You are the data controller and we are the data processor. We'll only process Customer Personal Data on your documented instructions, unless the law requires otherwise.

This DPA supplements the Jiffy Compliance Terms of Service. If there's ever a conflict between the two on data processing matters, this DPA takes precedence.

03 What we commit to as processor

We agree to:

Process Customer Personal Data only on your instructions and for no other purpose — unless the law requires otherwise.
Ensure everyone on our team who handles Customer Personal Data is bound by appropriate confidentiality obligations.
Maintain appropriate technical and organisational security measures (see Section 7).
Help you meet your obligations around data subject rights (Section 9), security (Section 7), breach notification (Section 8) and data protection impact assessments (Section 10).
Delete or return Customer Personal Data at the end of the service relationship (Section 12).
Make information available to demonstrate compliance and cooperate with audits (Section 11).
Tell you promptly if we believe any instruction you give us would breach Applicable Data Protection Law.

04 What you commit to as controller

You agree to:

Meet your obligations as data controller under Applicable Data Protection Law — including having a lawful basis for all processing you instruct us to carry out.
Make sure your workers have been given appropriate privacy information about how their personal data is used on the platform.
Only instruct us to process data in ways that comply with Applicable Data Protection Law.
Ensure that any special category data (such as occupational health information in accident records) is processed in accordance with Article 9 UK GDPR and that you have the appropriate conditions in place.
For light business eLearning accounts: ensure you have a lawful basis to enrol named team members and collect their course completion data.

05 Sub-processors

You give us general authorisation to use the sub-processors listed in Annex 2. We'll:

Put data protection obligations on each sub-processor that are equivalent to this DPA.
Remain responsible to you for what sub-processors do with Customer Personal Data.
Give you at least 14 days' notice of any changes to the sub-processor list.

If you have reasonable data protection grounds to object to a new sub-processor, let us know in writing within 14 days of our notice. If we can't resolve the issue together, you may terminate the agreement on written notice.

06 International transfers

We won't transfer Customer Personal Data outside the UK or EEA without appropriate safeguards in place. Permitted mechanisms include:

UK International Data Transfer Agreements (IDTAs)
UK Addendum to EU Standard Contractual Clauses (ICO-approved under s.119A DPA 2018)
UK adequacy regulations

Platform data is hosted in the EU region by default through Lovable. Where data is transferred to the USA (for example for analytics purposes, with your consent), the UK-US Data Privacy Framework and/or appropriate contractual safeguards apply.

07 Security

We maintain appropriate technical and organisational security measures proportionate to the risk, including:

Encryption of Customer Personal Data in transit (TLS) and at rest
Role-based access controls so only authorised people can access your data
Regular testing, assessment and review of security measures
Logical separation of customer data to prevent cross-account access
Incident response procedures as described in Section 8

Our platform infrastructure partner (Lovable) maintains a 24/7 incident response team. Details of their security measures are at lovable.dev/security. We require all sub-processors to maintain equivalent standards.

08 Data breaches

If we become aware of a Security Incident affecting Customer Personal Data, we'll:

Notify you without undue delay and in any event within 72 hours of becoming aware.
Give you enough information to meet any obligations you may have to notify the ICO and/or affected individuals.
Cooperate with you and take reasonable steps to contain and mitigate the incident.
Keep a record of the incident, its effects and the steps we took.

Notifying you of an incident doesn't mean we're accepting liability for it.

You're responsible for notifying the ICO (within 72 hours where required) and any affected individuals, based on the information we provide you.

09 Data subject rights

If we receive a request directly from one of your workers exercising their rights under Applicable Data Protection Law (access, rectification, erasure, restriction, portability or objection), we'll:

Forward the request to you promptly and within 5 business days.
Not respond to it on your behalf without your prior written consent — except to confirm that we've passed it on.
Give you reasonable assistance in responding, including access to the relevant data held in the platform.

10 Data protection impact assessments

Where you need to carry out a Data Protection Impact Assessment (DPIA) under Article 35 UK GDPR, we'll give you reasonable assistance — including cooperating with any required consultation with the ICO. It's your responsibility to decide whether a DPIA is needed.

11 Audit rights

We'll make available all information reasonably needed to demonstrate compliance with this DPA. On reasonable prior written notice of at least 30 days, and no more than once per year, you may request an audit of our data processing activities. We'll agree the scope, timing and cost with you in advance. You cover the cost of any audit unless it reveals material non-compliance on our part.

We may satisfy audit obligations by providing third-party audit reports or certifications where these are reasonably sufficient.

12 Deleting data when it's no longer needed

When your account closes or this DPA ends — or when you request it in writing — we'll:

Delete all Customer Personal Data within 3 months of the account closure date, unless we're legally required to keep it longer.
Provide written confirmation of deletion on request.

For light business eLearning accounts, learner data will be deleted within 3 months of account closure or the end of the 12-month course access period, whichever comes later.

Sub-processors are required to delete data in line with their own retention terms. Lovable retains customer data for up to 90 days after account termination before permanent deletion.

13 Liability

Each party's liability under this DPA is subject to the limitations set out in the Jiffy Compliance Terms of Service. Nothing here limits either party's liability for: (a) breaches of Applicable Data Protection Law that can't be limited by contract; or (b) death or personal injury caused by negligence.

As between us, you bear primary responsibility for ensuring that your instructions to us are lawful.

14 When this DPA ends

This DPA runs for as long as the Jiffy Compliance Terms of Service are in force between us and ends automatically when those Terms end — subject to the survival of our data deletion obligations (Section 12) and our confidentiality obligations.

15 Governing law

This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any disputes arising from it.

Annex 1 — Processing details

Item	Detail
Subject matter	Operation of the Jiffy Compliance workforce compliance platform and eLearning services on behalf of the Controller
Duration	For the term of the Jiffy Compliance Terms of Service, plus up to 3 months post-termination deletion period (or the end of the eLearning course access period for light business accounts)
Nature of processing	Storage, retrieval, structuring, display, export, deletion and security protection of Customer Personal Data
Purpose of processing	Full platform accounts: workforce compliance features including employee and contractor onboarding, document management, certification tracking, H&S module (RAMS, COSHH, incidents, investigations), training and eLearning, workforce announcements, and employee and contractor portals. Light business eLearning accounts: enrolment of team members onto purchased courses, tracking of course progress and completion, issuance and storage of completion certificates, and management reporting for the account holder.
Data subjects	Employees, workers, contractors and self-employed individuals engaged by the Controller. For light business eLearning accounts: team members enrolled by the Controller onto purchased courses.
Types of personal data	Full platform: names, contact details (email, phone), job role/position, certifications and qualification records, training completion records, H&S documentation (including risk assessment details), incident and accident records, employment status, PPE assignment records. Light business eLearning: names, email addresses, course enrolment and progress data, completion dates and scores, certificate details.
Special category data	Potentially: occupational health information within accident/incident records uploaded by the Controller on the full platform. The Controller is responsible for ensuring a lawful basis under Article 9 UK GDPR for any such processing. Special category data is not expected to arise in light business eLearning accounts.

Annex 2 — Approved sub-processors

Sub-processor	Purpose	Location	Safeguard
Lovable Technologies Inc.	Platform infrastructure, application hosting, database services (via Supabase) and platform development tooling. Acts as sub-processor to us.	EU region (Customer data hosted in EU by default)	UK Addendum to EU SCCs · DPA at lovable.dev/data-processing-agreement

We'll notify you of any changes to this list with at least 14 days' prior written notice. A current list of Lovable's own sub-processors (including Supabase) is at trust.lovable.dev.

Note on Stripe: Stripe, Inc. processes payment card data on our behalf for purchases and subscriptions. Stripe does not process Customer Personal Data (workforce data or learner records) — only payment transaction data relating to the account holder. Stripe is therefore listed in our Privacy Policy rather than this DPA. Stripe's DPA is available at stripe.com/gb/legal/dpa.