Hybrid Comply Customer Data Processing Agreement

Effective date: 16 August 2026 · Last updated: 16 August 2026 · Version: 1.0

This Data Processing Agreement (“DPA”) forms part of the agreement between:

The Customer (“Customer” or “Controller”); and
Hybrid HQ LTD, trading as Hybrid Comply, a company registered in England and Wales under company number 17344036, whose registered office is at 142-143 Parrock Street, Gravesend, Kent, United Kingdom, DA12 1EY (“Hybrid Comply” or “Processor”).

Each is a “Party” and together they are the “Parties”.

1. Background

1.1 The Customer has entered into an agreement with Hybrid Comply for access to the Hybrid Comply property health and safety inspection and compliance-reporting platform.

1.2 In providing the Services, Hybrid Comply may process Personal Data on behalf of the Customer.

1.3 The Parties enter into this DPA to establish their respective obligations concerning that processing and to satisfy applicable Data Protection Laws, including the requirements governing contracts between controllers and processors.

2. Incorporation and Priority

2.1 This DPA is incorporated into and forms part of:

the Hybrid Comply Terms of Service;
any order form;
any subscription agreement;
any statement of work; or
any other agreement under which Hybrid Comply provides the Services to the Customer,

together referred to as the “Main Agreement”.

2.2 If there is a conflict concerning the processing of Customer Personal Data, the following order of priority applies:

any mandatory International Transfer Mechanism incorporated under this DPA;
this DPA;
the Main Agreement; and
any other document incorporated into the Main Agreement.

2.3 Except as modified by this DPA, the Main Agreement remains in full force.

3. Definitions

In this DPA:

3.1 “Applicable Data Protection Laws”

means all laws and legally binding regulatory requirements applicable to the processing of Personal Data under this DPA, including, where applicable:

the UK GDPR;
the Data Protection Act 2018;
the Privacy and Electronic Communications (EC Directive) Regulations 2003;
any legislation replacing, amending or supplementing those laws; and
binding requirements of a competent Supervisory Authority.

3.2 “Authorised Personnel”

means Hybrid Comply employees, workers, contractors and other individuals authorised to process Customer Personal Data who are subject to appropriate confidentiality obligations.

3.3 “Controller”

has the meaning given in Applicable Data Protection Laws.

3.4 “Customer Data”

means information, documents, photographs, videos, audio, inspection responses, property records, reports and other material submitted to or generated through the Services for the Customer.

3.5 “Customer Personal Data”

means Personal Data contained in Customer Data that Hybrid Comply processes on behalf of the Customer under the Main Agreement.

3.6 “Data Subject”

has the meaning given in Applicable Data Protection Laws.

3.7 “Data Subject Request”

means a request from a Data Subject to exercise a right under Applicable Data Protection Laws.

3.8 “Delete” or “Deletion”

means to remove Personal Data so that it is no longer available for ordinary processing, subject to secure backup rotation, legal retention requirements and the provisions of this DPA.

3.9 “International Transfer Mechanism”

means a legally recognised mechanism for making a restricted transfer of Personal Data, including:

an adequacy regulation;
the UK International Data Transfer Agreement;
the UK International Data Transfer Addendum to the European Commission Standard Contractual Clauses;
binding corporate rules;
an approved code or certification mechanism; or
another valid safeguard under Applicable Data Protection Laws.

3.10 “Personal Data”

has the meaning given in Applicable Data Protection Laws.

3.11 “Personal Data Breach”

means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.

3.12 “Process”, “Processed” and “Processing”

have the meaning given in Applicable Data Protection Laws.

3.13 “Processor”

has the meaning given in Applicable Data Protection Laws.

3.14 “Restricted Transfer”

means a transfer of Personal Data that requires an adequacy decision, appropriate safeguard, derogation or other transfer mechanism under Applicable Data Protection Laws.

3.15 “Services”

means the Hybrid Comply mobile application, web portal, administration tools, inspection functions, reporting services, support services and related features supplied under the Main Agreement.

3.16 “Special Category Data”

has the meaning given in Applicable Data Protection Laws.

3.17 “Subprocessor”

means another processor appointed by Hybrid Comply to process Customer Personal Data on behalf of the Customer.

3.18 “Supervisory Authority”

means the UK Information Commissioner’s Office and any other data-protection authority having jurisdiction over the relevant processing.

3.19 “UK GDPR”

means the United Kingdom General Data Protection Regulation as incorporated into UK law and amended from time to time.

4. Roles of the Parties

4.1 Customer as Controller

The Customer determines the purposes and essential means of processing Customer Personal Data through the Services and will normally act as Controller.

4.2 Hybrid Comply as Processor

Hybrid Comply will act as Processor when processing Customer Personal Data on behalf of the Customer to provide the Services.

4.3 Hybrid Comply’s independent processing

Hybrid Comply may act as an independent Controller for limited Personal Data processed for its own legitimate purposes, including:

customer account administration;
billing and financial records;
direct communications with account administrators;
fraud prevention;
platform and network security;
legal compliance;
establishment, exercise or defence of legal claims; and
appropriately limited business records.

Such processing is governed by Hybrid Comply’s Privacy and Data Protection Policy and is not Customer Personal Data processing under this DPA.

4.4 Customer responsibility for role assessment

The Customer is responsible for determining whether it acts as:

a Controller;
a joint Controller;
a Processor for another organisation; or
in another capacity,

in relation to Personal Data it enters into Hybrid Comply.

4.5 Customer acting as Processor

Where the Customer itself acts as a Processor for another Controller:

the Customer confirms it is authorised to appoint Hybrid Comply as a Subprocessor;
references to the Customer’s rights and instructions include the relevant Controller’s lawful instructions communicated through the Customer;
Hybrid Comply will process the Personal Data only as permitted by this DPA and the Customer’s documented instructions; and
the Customer remains responsible for communicating all relevant restrictions and requirements to Hybrid Comply.

5. Details of Processing

The subject matter, duration, nature and purpose of processing, categories of Data Subjects and types of Personal Data are described in Schedule 1.

The Customer may configure or vary certain processing details through:

its Hybrid Comply account;
inspection templates;
authorised integrations;
retention settings;
user permissions;
order forms; and
documented support instructions.

Such configuration forms part of the Customer’s documented instructions, provided it is consistent with the Main Agreement and Applicable Data Protection Laws.

6. Customer Instructions

6.1 Hybrid Comply will process Customer Personal Data only:

on the Customer’s documented instructions;
as necessary to provide the Services;
as required by the Main Agreement and this DPA; or
as required by applicable law.

6.2 Documented instructions

The Customer instructs Hybrid Comply to process Customer Personal Data to:

host and store Customer Personal Data;
provide property inspection functionality;
allow authorised users to collect and update inspection information;
process photographs, videos, audio, signatures and documents;
associate records with properties and inspection locations;
create risk ratings, reports and action lists;
synchronise information between devices and Hybrid Comply systems;
authenticate users;
manage authorised access;
generate exports;
provide support;
maintain security, audit trails and backups;
carry out Customer-configured retention and deletion;
disclose data to authorised recipients and integrations selected by the Customer; and
perform other processing reasonably necessary to provide the Services.

6.3 Additional instructions

Additional instructions must be:

made in writing;
issued by an authorised Customer representative;
consistent with the Main Agreement;
technically and operationally feasible; and
compliant with Applicable Data Protection Laws.

6.4 Charges for additional instructions

Where an instruction requires material work outside the ordinary Services, Hybrid Comply may charge reasonable fees based on the work required, provided those fees are disclosed and agreed before the work begins.

This does not affect assistance that Hybrid Comply is legally required to provide under this DPA.

6.5 Unlawful instructions

Hybrid Comply will promptly inform the Customer if, in Hybrid Comply’s reasonable opinion, an instruction infringes Applicable Data Protection Laws.

Hybrid Comply may suspend the affected processing until:

the instruction is amended;
the Parties agree on a lawful approach; or
a competent authority resolves the matter.

Hybrid Comply is not required to carry out an instruction that would cause it to breach applicable law.

6.6 Processing required by law

If Hybrid Comply is required by law to process Customer Personal Data other than on the Customer’s instructions, Hybrid Comply will inform the Customer before processing unless the law prohibits notice on important grounds of public interest.

7. Customer Obligations

The Customer must:

7.1 Lawfulness

Ensure that:

its collection and use of Customer Personal Data are lawful;
it has a valid lawful basis for processing;
any required Special Category Data condition applies;
its instructions to Hybrid Comply are lawful; and
it is legally entitled to disclose Customer Personal Data to Hybrid Comply.

7.2 Transparency

Provide Data Subjects with all privacy information required by law, including information about:

property inspections;
photography and video;
inspection reports;
location verification;
disclosure to Hybrid Comply;
relevant recipients;
retention periods; and
Data Subject rights.

7.3 Accuracy and minimisation

Take reasonable steps to ensure Customer Personal Data is:

accurate;
relevant;
adequate;
not excessive;
limited to the inspection or compliance purpose; and
corrected or deleted when appropriate.

7.4 Access to properties

Obtain all permissions, notices, consents or other legal authority required to:

enter a property;
inspect a property;
take photographs or video;
record signatures or audio;
collect location information;
process tenant or occupant details; and
disclose reports to third parties.

7.5 User administration

Ensure that:

only authorised individuals have Hybrid Comply accounts;
access is role-appropriate;
administrator privileges are restricted;
users receive appropriate privacy and security training;
departing users are removed promptly; and
access rights are reviewed regularly.

7.6 Customer security

Maintain appropriate security for:

Customer devices;
credentials;
downloaded reports;
exported Customer Data;
connected systems;
Customer-controlled integrations;
customer-managed backups; and
Personal Data outside Hybrid Comply’s systems.

7.7 Data Subject Requests

Remain responsible for:

receiving Data Subject Requests;
determining whether they are valid;
responding within the applicable legal period;
identifying any exemption;
communicating with the Data Subject; and
instructing Hybrid Comply where assistance is required.

7.8 Regulatory responsibilities

Remain responsible for:

determining whether a Data Protection Impact Assessment is required;
carrying out any required assessment;
consulting a Supervisory Authority where legally required;
notifying reportable Personal Data Breaches;
informing affected Data Subjects where required; and
maintaining its own records of processing.

7.9 Children and vulnerable persons

Where Hybrid Comply is used in schools, homes, care settings, leisure facilities or other places involving children or vulnerable persons, the Customer must apply enhanced safeguards and avoid collecting identifiable information unless it is necessary, proportionate and lawful.

8. Hybrid Comply’s General Processor Obligations

Hybrid Comply will:

comply with obligations directly applicable to processors under Applicable Data Protection Laws;
process Customer Personal Data only in accordance with this DPA and lawful documented instructions;
ensure Authorised Personnel are subject to confidentiality obligations;
implement appropriate technical and organisational security measures;
assist the Customer as described in this DPA;
maintain required processor records;
cooperate with competent Supervisory Authorities where legally required;
appoint Subprocessors only in accordance with this DPA;
notify the Customer of Personal Data Breaches without undue delay;
delete or return Customer Personal Data at the end of the Services, subject to applicable exceptions; and
make information reasonably necessary to demonstrate compliance available to the Customer.

9. Confidentiality

9.1 Hybrid Comply will ensure that Authorised Personnel who process Customer Personal Data:

are bound by contractual or statutory confidentiality obligations;
receive access only where necessary for their duties;
receive appropriate data-protection and security training; and
process Customer Personal Data only in accordance with lawful instructions.

9.2 Hybrid Comply will periodically review privileged access to production systems.

9.3 The confidentiality obligations in this section survive termination of the Main Agreement.

10. Security Measures

10.1 Taking into account:

the state of the art;
implementation costs;
the nature, scope, context and purposes of processing; and
the risk to the rights and freedoms of individuals,

Hybrid Comply will implement appropriate technical and organisational measures to protect Customer Personal Data.

10.2 Hybrid Comply’s baseline security measures are described in Schedule 2.

10.3 Depending on risk and technical feasibility, measures may include:

encryption in transit;
encryption at rest;
secure authentication;
multi-factor authentication for privileged access;
role-based access controls;
least-privilege permissions;
logical separation of customer accounts;
secure software-development practices;
code and dependency review;
vulnerability management;
malware protection;
logging and monitoring;
backup and recovery controls;
incident-response procedures;
staff screening and training;
supplier due diligence;
secure deletion;
business continuity measures; and
periodic security testing.

10.4 Hybrid Comply may update its security measures to reflect:

technological developments;
new risks;
changes to the Services;
new legal requirements; or
improved practices,

provided the overall level of protection is not materially reduced during the term.

10.5 The Customer acknowledges that security is a shared responsibility and must implement appropriate measures for systems and devices under its control.

11. Personal Data Breach Management

11.1 Notification

Hybrid Comply will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

Hybrid Comply’s target is to provide an initial notification within 48 hours after confirming that an incident constitutes a Personal Data Breach affecting the Customer, where reasonably practicable.

Failure to provide every detail in the initial notification will not delay notification.

11.2 Notification channel

Notification will be sent to:

the Customer’s nominated security or privacy contact;
an account administrator; or
another contact specified in the order form.

The Customer must keep those details current.

11.3 Information supplied

As information becomes reasonably available, Hybrid Comply will provide:

the nature of the breach;
the categories and approximate number of affected Data Subjects;
the categories and approximate number of affected records;
when the breach occurred or was discovered;
the likely consequences;
measures taken or proposed;
relevant containment and remediation steps;
a contact point for further information; and
other information reasonably required for the Customer’s assessment.

11.4 Investigation and cooperation

Hybrid Comply will:

take reasonable steps to contain, investigate and remediate the breach;
preserve relevant evidence;
document the incident;
cooperate reasonably with the Customer;
provide follow-up information in phases where necessary; and
take reasonable steps to prevent recurrence.

11.5 External notification

Unless legally required to do so, Hybrid Comply will not notify a Supervisory Authority or Data Subject on behalf of the Customer without the Customer’s prior written instruction.

The Customer remains responsible for deciding whether notification is required.

11.6 No admission

A breach notification does not constitute an admission of fault or liability.

11.7 Costs

Each Party bears its own internal breach-response costs.

Where a breach was caused by a Party’s proven breach of this DPA or applicable law, allocation of recoverable costs and liability will be governed by the Main Agreement and applicable law.

12. Data Subject Requests

12.1 Taking into account the nature of the processing, Hybrid Comply will provide reasonable technical and organisational assistance to help the Customer respond to Data Subject Requests.

12.2 Direct requests

If Hybrid Comply receives a request directly from a Data Subject relating to Customer Personal Data, Hybrid Comply will, unless prohibited by law:

promptly refer the request to the Customer;
not respond substantively except on the Customer’s documented instructions;
confirm that Hybrid Comply processes the relevant data on behalf of a customer where appropriate; and
take reasonable steps to preserve information relevant to the request.

12.3 Assistance

Available assistance may include:

search tools;
account exports;
inspection exports;
correction functions;
deletion functions;
restriction of access;
retrieval of audit records;
information about processing; and
reasonable technical support.

12.4 Identity verification

The Customer remains responsible for verifying the identity and authority of the requester.

Hybrid Comply will not be required to disclose Customer Personal Data where the Customer has not adequately verified the request.

12.5 Timing

The Customer must submit assistance requests sufficiently early to allow both Parties to comply with applicable deadlines.

12.6 Fees

Ordinary self-service functionality is included in the Services.

Hybrid Comply may charge reasonable fees for unusually complex, repetitive or customised assistance outside standard functionality, unless the assistance is required because Hybrid Comply breached this DPA.

13. Assistance with Compliance

Taking into account the nature of processing and information available to Hybrid Comply, Hybrid Comply will provide reasonable assistance concerning:

security of processing;
Personal Data Breach assessment;
regulatory breach notification;
notification to affected Data Subjects;
Data Protection Impact Assessments;
prior consultation with a Supervisory Authority;
records relevant to Hybrid Comply’s processing;
international transfer assessments; and
investigations by a competent Supervisory Authority.

The Customer remains responsible for making all legal decisions as Controller.

14. Data Protection Impact Assessments

14.1 The Customer is responsible for determining whether its use of Hybrid Comply requires a Data Protection Impact Assessment.

14.2 Hybrid Comply will provide information reasonably available to it concerning:

the nature and scope of Hybrid Comply’s processing;
relevant security measures;
Subprocessors;
processing locations;
retention arrangements;
data flows; and
product functionality.

14.3 Hybrid Comply may maintain a general product security or privacy assessment that can be supplied instead of completing individual customer questionnaires where it reasonably addresses the requested information.

14.4 The Customer should consider a Data Protection Impact Assessment where its use may involve:

systematic monitoring;
extensive use of precise location data;
schools or children;
vulnerable individuals;
large-scale Special Category Data;
covert or intrusive inspection practices;
automated significant decisions;
innovative high-risk technology; or
extensive property surveillance.

15. Subprocessors

15.1 General authorisation

The Customer gives Hybrid Comply general written authorisation to appoint Subprocessors in accordance with this section.

15.2 Subprocessor list

Hybrid Comply will maintain a current list of Subprocessors, available on request from hello@hybrid-hq.co.uk.

The list should include, where relevant:

the Subprocessor’s name;
the service provided;
the categories of processing;
the processing location; and
the applicable transfer safeguard.

15.3 Advance notice

Hybrid Comply will provide at least 30 days’ prior notice before appointing a new Subprocessor that will process Customer Personal Data, normally by:

email;
account notification; or
update to a subscription-based Subprocessor notification service.

Emergency replacement may occur on shorter notice where necessary to maintain security or service continuity. Hybrid Comply will notify the Customer as soon as reasonably practicable.

15.4 Objections

The Customer may object to a new Subprocessor on reasonable grounds relating to data protection by notifying Hybrid Comply within 15 days after notice.

The objection must explain:

the specific data-protection concern;
the Customer Personal Data affected; and
why reasonable safeguards would not address the concern.

15.5 Resolution

The Parties will work in good faith to resolve an objection, including by considering:

additional safeguards;
configuration changes;
limiting the Subprocessor’s processing;
providing a commercially reasonable alternative; or
discontinuing the affected feature.

If no reasonable solution is available, either Party may terminate only the affected Service.

Any refund will be limited to prepaid fees for the unused period of the terminated affected Service.

15.6 Subprocessor agreements

Before permitting a Subprocessor to process Customer Personal Data, Hybrid Comply will enter into a written contract imposing data-protection obligations providing a level of protection materially equivalent to the relevant obligations in this DPA.

15.7 Responsibility

Hybrid Comply remains responsible to the Customer for the performance of its Subprocessors’ data-processing obligations to the extent required by Applicable Data Protection Laws.

15.8 Affiliate access

A Hybrid Comply affiliate that processes Customer Personal Data is treated as a Subprocessor unless it acts as an independent Controller for a separately disclosed purpose.

16. International Transfers

16.1 Hybrid Comply will not make a Restricted Transfer of Customer Personal Data unless the transfer is covered by:

applicable adequacy regulations;
an appropriate International Transfer Mechanism; or
another lawful exception or derogation.

16.2 Where Hybrid Comply initiates a Restricted Transfer, Hybrid Comply will ensure that an appropriate transfer safeguard is in place, which may include:

the UK International Data Transfer Agreement;
the UK Addendum to the European Commission Standard Contractual Clauses;
binding corporate rules; or
another approved safeguard.

16.3 Where required, Hybrid Comply will carry out or support an appropriate transfer risk assessment and implement supplementary measures proportionate to the identified risks.

16.4 The Customer authorises Hybrid Comply to enter into an appropriate International Transfer Mechanism with a Subprocessor on the Customer’s behalf where this is necessary to provide the Services.

16.5 Where the UK Addendum or another transfer document must be directly entered into between the Customer and a recipient, the Parties agree to cooperate reasonably to complete it.

16.6 If an International Transfer Mechanism relied upon by the Parties becomes invalid or insufficient, the Parties will work in good faith to implement an alternative lawful mechanism.

16.7 Hybrid Comply will make reasonable information about its international transfer arrangements available to the Customer, subject to:

confidentiality;
security;
third-party rights; and
legal restrictions.

17. Government and Law-Enforcement Requests

Where Hybrid Comply receives a legally binding request for Customer Personal Data from a government, court, law-enforcement body or public authority, Hybrid Comply will, unless prohibited by law:

assess the validity and scope of the request;
redirect the requesting authority to the Customer where appropriate;
notify the Customer before disclosure;
disclose only the minimum data legally required;
challenge an unlawful or excessive request where there are reasonable grounds to do so; and
document the request and response.

Hybrid Comply will not voluntarily provide bulk access to Customer Personal Data to a public authority unless legally required.

18. Audit and Compliance Information

18.1 Information rights

Hybrid Comply will make information reasonably necessary to demonstrate compliance with this DPA available to the Customer.

This may include:

security summaries;
relevant policies;
penetration-test summaries;
independent audit or certification reports;
data-flow information;
Subprocessor information;
responses to security questionnaires;
breach-response procedures; and
deletion or retention information.

18.2 Audit hierarchy

The Parties will normally use the following sequence:

available documentation and reports;
a reasonable written questionnaire;
a remote review meeting; and
an on-site audit only where reasonably necessary.

18.3 Customer audits

The Customer may conduct or appoint an independent professional auditor to conduct an audit where:

required by Applicable Data Protection Laws;
reasonably requested by a competent Supervisory Authority;
available documentation is insufficient to demonstrate compliance;
a material Personal Data Breach has occurred; or
there is reasonable evidence of material non-compliance.

18.4 Audit conditions

Unless a Personal Data Breach, regulator or urgent legal requirement justifies different arrangements, an audit must:

be requested on at least 30 days’ written notice;
occur no more than once in any 12-month period;
take place during normal business hours;
avoid unreasonable disruption;
be limited to systems relevant to Customer Personal Data;
comply with Hybrid Comply’s security and confidentiality requirements;
not expose another customer’s information;
not require disclosure of source code, penetration-test exploit details or legally privileged material; and
be conducted by an auditor who is independent, appropriately qualified and not a direct competitor of Hybrid Comply.

18.5 Audit costs

The Customer bears its audit costs and Hybrid Comply’s reasonable costs of supporting an audit.

Hybrid Comply will bear reasonable audit-support costs where the audit establishes Hybrid Comply’s material breach of this DPA.

18.6 Remediation

Hybrid Comply will address verified material findings within a reasonable period, taking account of:

risk;
severity;
available mitigations;
technical complexity; and
applicable legal deadlines.

19. Regulatory Cooperation

Hybrid Comply will cooperate, to the extent legally required, with a competent Supervisory Authority concerning Customer Personal Data.

Hybrid Comply will notify the Customer of a regulatory enquiry specifically concerning the Customer unless prohibited by law.

The Customer remains responsible for its own communications and obligations as Controller.

20. Return, Export and Deletion

20.1 During the Services

During the subscription term, the Customer may use available functionality to:

export reports;
download inspection information;
delete records;
amend retention settings; and
remove users.

20.2 End of Services

On termination or expiry of the Main Agreement, and at the Customer’s choice, Hybrid Comply will:

return Customer Personal Data in a commonly used format where the applicable plan provides an export; or
delete Customer Personal Data,

subject to this section.

20.3 Export period

Unless otherwise stated in the Main Agreement, the Customer will have 30 days after termination to request or complete an export.

After this period, Hybrid Comply may disable access and begin deletion.

20.4 Active-system deletion

Hybrid Comply will ordinarily delete Customer Personal Data from active production systems within 30 days after:

the export period expires;
the Customer confirms no export is needed; or
the Customer provides a valid immediate deletion instruction.

20.5 Backups

Customer Personal Data may remain in encrypted or protected backups until overwritten through the ordinary backup cycle, which will not normally exceed 90 days.

Backup data will:

not be restored to ordinary use except for disaster recovery;
remain subject to security and confidentiality protections;
not be used for a new purpose; and
be re-deleted where restored after an applicable deletion instruction.

20.6 Legal retention

Hybrid Comply may retain limited Customer Personal Data where required by law.

Where legally permitted, Hybrid Comply will inform the Customer of:

the information retained;
the reason;
the expected period; and
applicable restrictions.

Retained data will be isolated from ordinary use and processed only for the legally required purpose.

20.7 Legal holds

Deletion may be suspended for information subject to:

actual or anticipated legal proceedings;
a regulatory investigation;
a law-enforcement request;
a contractual dispute;
a Data Subject Request;
an insurance claim;
a Personal Data Breach investigation; or
another lawful preservation requirement.

20.8 Deletion confirmation

On written request, Hybrid Comply will provide reasonable confirmation that deletion has been completed or scheduled through applicable backup cycles.

20.9 Customer copies

Hybrid Comply is not responsible for deleting copies of Customer Personal Data held:

on Customer devices;
in Customer email accounts;
in Customer-controlled storage;
in reports downloaded by the Customer;
in Customer-managed integrations; or
by recipients to whom the Customer disclosed the data.

21. Retention During the Agreement

21.1 Hybrid Comply will retain Customer Personal Data in accordance with:

Customer-configured retention settings;
the Main Agreement;
the Hybrid Comply Data Retention and Deletion Schedule;
documented Customer instructions; and
applicable law.

21.2 Where the Customer has not selected a retention period, Hybrid Comply’s published default retention period applies.

21.3 The Customer is responsible for determining whether the default period is appropriate for:

its legal obligations;
property type;
inspection type;
insurance requirements;
limitation periods;
safeguarding requirements; and
regulatory obligations.

21.4 Hybrid Comply may establish limited minimum retention periods where technically necessary for:

synchronisation;
backups;
fraud prevention;
audit integrity;
security; or
service recovery.

22. Special Category and Sensitive Data

22.1 Hybrid Comply is not designed for the routine storage of Special Category Data, criminal-offence data, safeguarding case files, medical records or biometric templates.

22.2 The Customer must not upload such information unless:

it is necessary for a legitimate inspection or compliance purpose;
the Customer has identified a valid lawful basis;
an applicable additional condition has been established;
the processing is covered by appropriate privacy information;
access is restricted;
retention is limited; and
appropriate safeguards are applied.

22.3 The Customer should avoid capturing:

identifiable children;
health information;
identity documents;
private correspondence;
religious or political material;
computer screens;
personal photographs;
employee records;
pupil records; and
other information not relevant to the inspection.

22.4 Hybrid Comply may restrict access to, quarantine or delete clearly unlawful or high-risk material after giving notice where reasonably possible.

23. Accuracy and Correction

The Customer is responsible for the accuracy of Customer Personal Data.

Hybrid Comply will provide available technical functions to allow authorised users to:

correct account information;
amend inspection records;
add corrective notes;
update property details;
replace inaccurate evidence; and
record an appropriate audit history.

Hybrid Comply may preserve an audit record of changes where necessary for evidential integrity, security or compliance.

24. Business Continuity and Recovery

Hybrid Comply will maintain reasonable business-continuity and disaster-recovery measures proportionate to the Services.

Such measures may include:

protected backups;
service monitoring;
documented recovery procedures;
availability controls;
infrastructure redundancy;
incident escalation; and
periodic recovery testing.

No backup system guarantees that every unsynchronised device record or every recent change can be recovered.

The Customer should ensure inspections are synchronised and important reports are exported where independent retention is required.

25. Records of Processing

Hybrid Comply will maintain records of its processing where required by Applicable Data Protection Laws.

The Customer will maintain its own Controller records, including:

processing purposes;
categories of Data Subjects;
categories of Personal Data;
recipients;
retention periods;
international transfers;
security measures; and
lawful bases.

Hybrid Comply’s records do not replace the Customer’s accountability obligations.

26. Insurance

Hybrid Comply will maintain insurance that it considers appropriate for its business and risk profile, which may include:

cyber liability insurance;
professional indemnity insurance;
technology errors and omissions insurance; and
general commercial insurance.

On reasonable request, Hybrid Comply may provide evidence of relevant current cover, subject to confidentiality and insurer restrictions.

No insurance provision increases a liability cap in the Main Agreement.

27. Liability

27.1 The liability of each Party under this DPA is subject to the exclusions and limitations in the Main Agreement, except to the extent those exclusions or limitations are prohibited by law.

27.2 Nothing in this DPA limits liability that cannot lawfully be limited.

27.3 Each Party remains responsible for:

its own compliance with Applicable Data Protection Laws;
its own instructions and decisions;
its acts and omissions; and
liabilities allocated to it by applicable law.

27.4 Hybrid Comply’s responsibility for Subprocessors is governed by section 15 and applicable law.

27.5 The Customer will not seek to recover the same loss more than once under the Main Agreement, this DPA or applicable law.

28. Term and Termination

28.1 This DPA begins when Hybrid Comply first processes Customer Personal Data under the Main Agreement.

28.2 It continues until Hybrid Comply no longer processes Customer Personal Data on behalf of the Customer.

28.3 Termination of the Main Agreement automatically terminates this DPA, subject to provisions that must continue while Customer Personal Data remains in Hybrid Comply’s possession or control.

28.4 The following obligations survive termination where applicable:

confidentiality;
security;
breach cooperation;
audit and regulatory cooperation;
return and deletion;
international transfer safeguards;
liability; and
any provision intended by its nature to survive.

29. Changes to this DPA

29.1 Hybrid Comply may update this DPA where reasonably necessary to:

comply with law;
reflect regulatory guidance;
implement a replacement transfer mechanism;
update security or Subprocessor procedures; or
reflect changes to the Services.

29.2 Hybrid Comply will give reasonable notice of a material change.

29.3 A change will not materially reduce the protection of Customer Personal Data during a current contract term unless required by law or agreed with the Customer.

29.4 Where a change is required by law, it will take effect from the date necessary to maintain compliance.

30. General Provisions

30.1 Notices

Notices under this DPA must be sent to:

For the Customer:
Privacy contact, email and address: as specified in the Customer’s order form or account details

For Hybrid Comply:
Privacy contact: Privacy Lead
Email: hello@hybrid-hq.co.uk
Address: 142-143 Parrock Street, Gravesend, Kent, United Kingdom, DA12 1EY

30.2 Severability

If part of this DPA is invalid or unenforceable, it will be modified to the minimum extent necessary or removed, and the remaining provisions will continue.

30.3 No waiver

Failure or delay in exercising a right does not waive it.

30.4 Third-party rights

Except where an International Transfer Mechanism expressly provides otherwise, a person who is not a Party has no right to enforce this DPA.

30.5 Governing law

This DPA is governed by the law specified in the Main Agreement.

Where the Main Agreement does not specify governing law, this DPA is governed by the laws of England and Wales.

30.6 Jurisdiction

The courts specified in the Main Agreement have jurisdiction.

Where the Main Agreement does not specify jurisdiction, the courts of England and Wales have exclusive jurisdiction, subject to any mandatory rights under Applicable Data Protection Laws.

Date: 16 August 2026

Schedule 1 (Details of Processing) and Schedule 2 (Security Measures) are provided with the executed order form.