Data Processing Addendum
Baseline customer terms: 6 September 2026
This baseline addendum is intended for business customers that use GapCheckUK to store assessment information or supporting evidence containing personal data. It should be reviewed and completed by the service provider and customer before relying on it as a contract.
1. Roles and scope
For customer content submitted through the service, the customer determines the purposes and means of processing and acts as controller or equivalent business responsible for that content. GapCheckUK acts as processor or service provider and processes customer content only to provide, secure, support, and improve the contracted service as instructed by the customer and permitted by the Terms & Conditions.
2. Processing details
Processing may include collection, storage, organisation, retrieval, display, export, deletion, and security monitoring of account details, company information, assessment answers, notes, action-plan records, and supporting evidence. The duration is the customer subscription period plus the limited period needed for deletion, backups, legal records, security investigations, or dispute handling.
3. Confidentiality and security
Access to customer content is limited to authorised users and service personnel who need access to operate or support the service. The service uses authenticated sessions, account-level database controls, private evidence storage, server-only credentials, and payment processing through Stripe. Customers should avoid uploading unnecessary sensitive personal data.
4. Subprocessors
Current infrastructure providers include Supabase for authentication, database services and private storage, Vercel for hosting and server routes, and Stripe for paid subscription payment processing. The service is intended to use UK/EEA processing locations; GapCheckUK must verify each provider’s actual region and transfer safeguards before relying on that position. GapCheckUK should maintain a current subprocessor list and give customers a suitable notice and objection process before adding material subprocessors.
5. Assistance and rights requests
GapCheckUK will provide reasonable assistance with access, correction, deletion, export, security enquiries, and data-protection requests that relate to the service, subject to the customer’s instructions and the information available within the product.
6. Deletion and return
At the customer’s request or when the service ends, GapCheckUK will make customer content available for export where supported and delete it within a reasonable operational period, unless retention is required by law, security records, payment obligations, backups, or dispute resolution.
7. Completing this addendum
This page is a product baseline, not a substitute for a signed data-processing contract. The service provider is GapCheckUK and the operational contact is GapcheckUK@gmail.com. Add the registered address, customer legal names, incident-notification times, audit terms, and verified subprocessor details before using it for customer contracting.