TeamTrack
Request Free TrialBook A Demo
Policies & Legal

Data Processing Agreement

The controller and processor obligations that apply when TeamTrack processes customer personal data.

Last updated: 2 March 2026

Back To PoliciesDownload PDF

Contract Details

SUPPLIER

Company Name and Company Number: THRIVE IT LTD. (company number: 10220836) Registered Address: Thornhill Road, Stockport, SK4 3HJ Email: hello@thrivewithus.co.uk

CUSTOMER

Company Name:

Registered Address:

Primary Contact Name:

Primary Contact Email:

Each of the parties shall be referred to as a Party or together, the Parties.

Processing Details

Purpose

The purpose of the Data Processing Agreement (DPA) is to set out the terms on which TeamTrack, acting as a data processor, processes personal data on behalf of the Customer, acting as the data controller, in connection with the provision of the Services.

The DPA defines the scope, nature and purpose of the processing, the types of personal data involved, the categories of data subjects, and the respective rights and obligations of the parties. It ensures that personal data is processed in accordance with applicable data protection legislation, including the UK GDPR and the Data Protection Act 2018, and establishes appropriate safeguards relating to confidentiality, security, sub-processors, international transfers, data subject rights, and data breach notification.

Scope and nature of the processing Categories of data subject

Under the Agreement, TeamTrack processes company, event and personal data on behalf of the Customer solely for the purpose of providing the Services.

The scope of processing includes the hosting, storage, organisation, retrieval, use, transmission, synchronisation and deletion of personal data entered into or generated within the TeamTrack system by authorised users. This may include personal data relating to employees, contractors, freelancers and other personnel, such as names, contact details, roles, availability, working hours, leave records, assignments, qualifications, and related scheduling information.

The nature of the processing is limited to activities necessary to operate, maintain, support and improve the functionality of the Service, including providing customer support, system administration, security monitoring, backup, and disaster recovery. TeamTrack does not process personal data for its own independent purposes and acts solely on documented instructions from the Customer, except where required by law.

Categories of data subject

The categories of data subjects whose personal data may be processed by TeamTrack under the Agreement include:

  • The Customer’s employees and staff members;
  • Freelancers, contractors and temporary workers engaged by the Customer;
  • Agency workers or third-party personnel assigned to the Customer’s projects or events;
  • Administrative users and authorised representatives of the Customer; and
  • Other individuals whose personal data is entered into the Service by the Customer for the purposes of scheduling, workforce management or operational planning.

The precise categories of data subjects shall be determined by the Customer’s use of the Services.

Categories of personal data

The categories of personal data processed by TeamTrack on behalf of the Customer may include identification data such as names, job titles and personnel identifiers; contact details including email addresses, telephone numbers and business addresses; employment and engagement information such as roles, departments, skills, qualifications and engagement status; and scheduling and availability data including working hours, assignments, leave, holiday and absence records.

Depending on the Customer’s use of the Services, personal data may also include travel-related information such as passport details, passport numbers, visa information and other identification document details required for travel or event access purposes. Operational and event-related information entered by the Customer, together with system usage data relating to user access and activity within the Service, may also be processed.

The precise categories of personal data processed will vary according to the Customer’s configuration and use of the Services.

Duration of Processing

Personal data shall be processed by TeamTrack for the duration of the Agreement and for such additional period as is necessary to provide the Services in accordance with the Customer’s instructions.

Upon termination or expiry of the Agreement, personal data shall be retained only for so long as required to comply with applicable law, resolve disputes, enforce contractual rights, or complete any agreed data export or deletion process, after which it shall be securely deleted or anonymised in accordance with the Agreement and the Data Processing Agreement.

Background

A. The Supplier is providing services to the Customer where the Supplier is required to process Customer Personal Data to fulfil the Purpose (as defined in the Contract Details). B. This Agreement sets out the terms on which the Supplier will process the Customer Personal Data, in accordance with Data Protection Laws.

1 Definitions And Interpretation

1.1 In this Agreement, unless the context otherwise requires, the following expressions have the following meanings:

Agreement: refers to this TeamTrack data processing agreement and includes the Contract Details and any Schedules attached to it.

Customer Personal Data: the personal data processed by the Supplier on behalf of the Customer under this Agreement. This personal data being processed is detailed as the ‘Scope and nature of processing’, the ‘Categories of personal data’ and the ‘Categories of data subjects’ in the Contract Details at the front of this Agreement. Contract Details: refers to the terms agreed between the Parties on the front pages of this Agreement titled “Contract Details”.

Data Protection Laws: all applicable data protection and privacy legislation in force in the United Kingdom, including but not limited to: (i) the UK GDPR as defined in section 3(10) of the Data Protection Act 2018, and supplemented by section 205(4) (“UK GDPR”); (ii) the Data Protection Act 2018; and (iii) the Privacy and Electronic Communications Regulations 2003 (SI 2003 No. 2426), in each case as amended, updated or replaced from time to time.

Data controller, data processor, personal data, processing and appropriate technical and organisational measures shall each have the meanings given to them in the UK GDPR.

Duration of Processing: the length of time the Supplier will process the Customer Personal Data as described in the Contract Details at the front of this Agreement.

DP Regulator: a valid supervisory authority (as defined under the UK GDPR), which in the UK is the Information Commissioner's Office.

Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

Purpose: means the purpose for processing the Customer Personal Data, as detailed in the Contract Details.

Sub-Processor(s): any processor, including any agent, sub-contractor or other third party, engaged by the Supplier (or by any other Sub-Processor) for carrying out any processing activities in respect of the Customer Personal Data.

1.2 A person means an individual, a firm, a company, an unincorporated body or a government entity (whether or not having a separate legal identity from its members or owners) and any of its successors, permitted transferees or permitted assignees.

1.3 Clause, schedule and paragraph headings shall not affect the interpretation of this Agreement.

1.4 References to statutes, regulations or other legislation or enactments referenced herein shall be deemed to be references to that enactment as amended, supplemented, re-enacted or replaced from time to time.

1.5 The words include, including and similar words or expressions will not limit the meaning of the words that come before them.

1.6 Reference to writing or written includes e-mail but not any other form of electronic communication.

2 Data Protection Roles And Relationship

2.1 The Parties acknowledge that the Customer is the data controller of the Customer Personal Data uploaded, stored and/or transmitted by the Customer’s personnel via TeamTrack and the Supplier is the data processor of the Customer Personal Data.

2.2 Both Parties will comply with all applicable requirements of Data Protection Laws in relation to personal data that is shared or processed under this Agreement. This Agreement does not relieve, remove or replace, a Party's obligations or rights under applicable Data Protection Laws.

3 Data Processing Obligations

3.1 Each Party shall maintain records which indicate how that Party processes personal data under its responsibility. These records will contain at least the minimum information required by the Data Protection Laws and each Party shall make that information available to any DP Regulator on request.

3.2 To the extent that the Supplier processes Customer Personal Data on behalf of the Customer, the Supplier shall:

3.2.1 process that Customer Personal Data only on the documented instructions of the Customer, which shall include processing the Customer Personal Data to the extent necessary for the Purpose, unless the Supplier is otherwise required by applicable laws. The Supplier shall notify the Customer if its instructions infringe Data Protection Laws or other applicable laws;

3.2.2 implement appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Customer Personal Data and against accidental loss or destruction of, or damage to, Customer Personal Data, including as appropriate:

  • the pseudonymisation and encryption of Customer Personal Data;
  • the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
  • the ability to restore the availability and access to Customer Personal Data in a timely manner in the event of a physical or technical incident; and
  • a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing;

3.2.3 notwithstanding the obligations in clause 3.2.2, the Supplier shall comply at all times with its security policy, as set out in the attachment to this Agreement;

3.2.4 maintain the confidentiality of the Customer Personal Data, not disclose the Customer Personal Data to any third party other than as authorised to do so under this Agreement and ensure that any personnel engaged and authorised by the Supplier to process Customer Personal Data have committed themselves to obligations of confidentiality;

3.2.5 assist the Customer in responding to any request from a data subject and in ensuring the Customer's compliance with its obligations under applicable Data Protection Laws. This process shall be provided (at the Customer’s cost) and shall include:

  • recording and referring all requests and communications received from data subjects or any DP Regulator to the Customer which relate to any Customer Personal Data promptly (and in any event within seven days of receipt); and
  • not responding to any such requests without the Customer’s express written approval and strictly in accordance with the Customer’s instructions unless and to the extent required by applicable law.

3.2.6 promptly (and in any event within 2 days):

  • notify the Customer if it (or any of the Sub-Processors or the Supplier personnel) becomes aware of any actual occurrence of any Personal Data Breach in respect of any Customer Personal Data; and
  • provide all information as the Customer reasonably requires to report the circumstances to a DP Regulator and to notify affected data subjects under Data Protection Laws.

3.3 Where the Supplier is relying on applicable laws as the basis for processing Customer Processor Data under clause

3.2.1 above, the Supplier shall use reasonable efforts to notify the Customer of this before performing the processing required by the applicable laws unless those applicable laws prohibit the Supplier from so notifying the Customer.

4 Sub-Processors

4.1 The Customer hereby provides its prior, general authorisation for the Supplier to appoint Sub-Processors to process the Customer Personal Data, provided that the Supplier:

4.1.1 shall ensure any Sub-Processors will comply with applicable Data Protection Laws, and will comply with terms that are materially similar to those imposed on the Supplier in this clause 4;

4.1.2 shall remain responsible for the acts and omissions of any such Sub-Processor as if they were the acts and omissions of the Supplier; and

4.1.3 shall inform the Customer of any intended changes concerning the addition or replacement of the Sub- Processors; giving the Customer the opportunity to object to such changes. Where the Customer objects to the changes and cannot demonstrate, in the Supplier's reasonable opinion, that the objection is due to an actual or likely breach of applicable Data Protection Law, the Customer shall indemnify the Supplier for any losses, damages, costs (including legal fees) and expenses suffered by the Supplier in accommodating the objection.

5 International Transfers

5.1 The Supplier may transfer Customer Personal Data outside of the United Kingdom and European Economic Area as required to process the Customer Personal Data for the Purpose under this Agreement, provided that the Supplier shall ensure that all such transfers are made in accordance with applicable Data Protection Laws. For these purposes, the Customer shall promptly comply with any reasonable request of the Supplier, including any request to enter into standard data protection clauses to safeguard international transfers, as adopted by the UK Information Commissioner.

6 Liability

6.1 Neither Party excludes nor limits any liability for:

6.1.1 personal injury (including sickness and death) to the extent that such injury results from the negligence or wilful default of a Party or its employees; or

6.1.2 fraud or fraudulent misrepresentation; or

6.1.3 any other liability to the extent it cannot be excluded or limited by law.

6.2 Subject to the provisions of this clause 6, the Supplier's total aggregate liability arising under or in connection with this Agreement, or applicable Data Protection Laws, shall be limited to The Service Provider’s total aggregate liability under or in connection with this Agreement shall not exceed the total Fees paid or payable by the Customer for the Services in the preceding three (3) months, save where liability cannot lawfully be limited or excluded.

7 Termination And Effect Of Termination

7.1 This Agreement shall remain in full effect for the Duration of Processing following which it shall automatically terminate.

7.2 Where the Supplier no longer requires the Customer Personal Data for the Purpose, it shall, at the written direction of the Customer, delete (so far as technically possible) or return Customer Personal Data and any copies to the Customer within 30 days of termination of this Agreement, unless the Supplier is required by any applicable law to continue to process that Customer Personal Data.

7.3 For the purposes of this clause 7, Customer Personal Data shall be considered deleted where it can longer be used further by the Supplier.

8 General

8.1 Costs Each Party is responsible for its legal and other costs in relation to the preparation and performance of this Agreement.

8.2 Survival of terms The Parties intend the following terms to survive termination: clauses 1, 6, 7, and 8 and all clauses required for their interpretation.

8.3 Relationship of the Parties The Parties are independent businesses and not partners, principal and agent, or employer and employee, or in any other relationship of trust to each other.

8.4 Third party rights For the purposes of the Contracts (Rights of Third Parties) Act 1999, this Agreement is not intended to and does not give any person who is not a party to it any right to enforce any of its provisions. However, this does not affect any rights or remedy of such a person that exists or is available apart from that Act.

8.5 Assignment and other dealings No Party may assign, subcontract or encumber any right or obligation under this Agreement, in whole or in part, without the other Party’s prior written consent or except as expressly permitted in this Agreement.

8.6 Entire Agreement This Agreement, and any document referred to in it, contains the whole Agreement between the Parties relating to its subject matter and supersedes any prior Agreements, representations or understandings between them unless expressly referred to in this Agreement. Each Party acknowledges that it has not relied on, and will have no remedy in respect of, any representation (whether innocent or negligent) made but not covered in this Agreement. Nothing in this clause limits or excludes any liability for fraud or fraudulent misrepresentation.

8.7 Variation No amendment or variation of this Agreement will be valid unless agreed in writing by an authorised signatory of each Party.

8.8 Severability If any clause in this Agreement (or part of a clause) is or becomes illegal, invalid or unenforceable under applicable law, but would be legal, valid and enforceable if the clause or some part of it was deleted or modified (or the duration of the relevant clause reduced), the relevant clause (or part of it) will apply with such deletion or modification as may be required to make it legal, valid and enforceable, and the Parties will promptly and in good faith seek to negotiate a replacement provision consistent with the original intent of this Agreement as soon as possible.

8.9 Waiver No delay, act or omission by either Party in exercising any right or remedy will be deemed a waiver of that, or any other, right or remedy.

8.10 Notices Notices under this Agreement must be in writing and sent to the other Party's address, as set out above in the Contract Details. Letters sent in the United Kingdom will be deemed delivered 3 business days (excluding English Bank Holidays), after sending. Emails will be deemed delivered the same day (or the next business day, if sent on a non-business day or after 5pm on any business day at the recipient's location).

8.11 Counterparts This Agreement may be signed in any number of counterparts and by the Parties on separate counterparts, each of which when signed and dated will be an original, and such counterparts taken together will constitute one and the same Agreement. This Agreement will not be effective until each Party has signed one counterpart.

8.12 Governing law and jurisdiction This Agreement is governed by the law of England and Wales. All disputes under this Agreement will be subject to the exclusive jurisdiction of the courts of England and Wales.

By signing below the Parties agree to the terms set out in this TeamTrack data processing agreement, with effect from the date that it is signed by both Parties.