Data Processing Agreement
Version: 1.2
Document Date: 14 October 2026Effective Date: Date of acceptance by the Customer
1. Introduction and Parties
This Data Processing Agreement ("Agreement" or "DPA") forms part of the contractual arrangements between:
Stealth Systems Ltd, of 1B Mountjoy Terrace, Musselburgh, East Lothian, EH21 6JR, United Kingdom ("Stealth Systems", "TrackerPro", "Processor", "we" or "us"); and
The subscribing business or organisation using TrackerPro software services ("Customer" or "Controller").
This Agreement governs the processing of personal data by Stealth Systems on behalf of the Customer in connection with the provision of TrackerPro software and associated services.
It is intended to satisfy the requirements of Article 28 of the UK General Data Protection Regulation ("UK GDPR").
Where an existing service agreement is in place, this Agreement supplements that agreement. In the event of a conflict concerning the processing of personal data, this Agreement takes precedence to the extent required by applicable data protection legislation.
This Data Processing Agreement ("Agreement" or "DPA") forms part of the contractual arrangements between:
Stealth Systems Ltd, of 1B Mountjoy Terrace, Musselburgh, East Lothian, EH21 6JR, United Kingdom ("Stealth Systems", "TrackerPro", "Processor", "we" or "us"); and
The subscribing business or organisation using TrackerPro software services ("Customer" or "Controller").
This Agreement governs the processing of personal data by Stealth Systems on behalf of the Customer in connection with the provision of TrackerPro software and associated services.
It is intended to satisfy the requirements of Article 28 of the UK General Data Protection Regulation ("UK GDPR").
Where an existing service agreement is in place, this Agreement supplements that agreement. In the event of a conflict concerning the processing of personal data, this Agreement takes precedence to the extent required by applicable data protection legislation.
2. Roles and Responsibilities
2.1 The Customer acts as the Data Controller for personal data entered, uploaded, stored or managed within its TrackerPro environment, except where another party lawfully acts as Controller.
2.2 Stealth Systems acts as the Data Processor when processing such personal data on behalf of the Customer.
2.3 The Customer determines the purposes and lawful basis for processing personal data within its TrackerPro environment.
2.4 Stealth Systems shall process Customer Personal Data only in accordance with documented Customer instructions, including those established in this Agreement, unless otherwise required by applicable law.
2.5 Nothing in this Agreement removes either party's statutory obligations under applicable data protection legislation.
2.1 The Customer acts as the Data Controller for personal data entered, uploaded, stored or managed within its TrackerPro environment, except where another party lawfully acts as Controller.
2.2 Stealth Systems acts as the Data Processor when processing such personal data on behalf of the Customer.
2.3 The Customer determines the purposes and lawful basis for processing personal data within its TrackerPro environment.
2.4 Stealth Systems shall process Customer Personal Data only in accordance with documented Customer instructions, including those established in this Agreement, unless otherwise required by applicable law.
2.5 Nothing in this Agreement removes either party's statutory obligations under applicable data protection legislation.
3. Scope and Purpose of Processing
Stealth Systems processes Customer Personal Data where necessary to provide and operate TrackerPro, including:
- Hosting and maintaining customer databases and associated records.
- Providing access to TrackerPro software functionality.
- Processing information entered or uploaded by authorised users.
- Managing application services and associated infrastructure.
- Providing software updates, maintenance and technical support.
- Investigating and correcting software faults and data inconsistencies.
- Operating database backup, recovery and disaster recovery arrangements.
- Providing necessary security, monitoring and administration services.
- Supporting email communications through Nylas.
- Supporting SMS communications through Twilio.
- Supporting authorised integrations and related functionality.
The subject matter, nature, purpose, duration and categories of processing are further described in Schedule 1.
Stealth Systems processes Customer Personal Data where necessary to provide and operate TrackerPro, including:
- Hosting and maintaining customer databases and associated records.
- Providing access to TrackerPro software functionality.
- Processing information entered or uploaded by authorised users.
- Managing application services and associated infrastructure.
- Providing software updates, maintenance and technical support.
- Investigating and correcting software faults and data inconsistencies.
- Operating database backup, recovery and disaster recovery arrangements.
- Providing necessary security, monitoring and administration services.
- Supporting email communications through Nylas.
- Supporting SMS communications through Twilio.
- Supporting authorised integrations and related functionality.
The subject matter, nature, purpose, duration and categories of processing are further described in Schedule 1.
4. Documented Instructions and Technical Support Access
4.1 General Instructions
The Customer instructs and authorises Stealth Systems to process Customer Personal Data for purposes reasonably necessary to provide, operate, maintain, secure and support TrackerPro.
These instructions include processing initiated through the Customer's authorised use of the software.
Additional instructions may be provided in writing, including by email or documented technical support requests.
The Customer instructs and authorises Stealth Systems to process Customer Personal Data for purposes reasonably necessary to provide, operate, maintain, secure and support TrackerPro.
These instructions include processing initiated through the Customer's authorised use of the software.
Additional instructions may be provided in writing, including by email or documented technical support requests.
4.2 Standing Technical Support Authorisation
The Customer expressly authorises Stealth Systems and its authorised personnel to access, inspect, investigate and, where reasonably necessary, modify information within the Customer's TrackerPro environment for the purposes of:
- Investigating and resolving customer-reported technical support issues.
- Diagnosing application and database faults.
- Identifying and correcting data inconsistencies.
- Performing authorised data corrections.
- Undertaking essential system administration and maintenance.
- Investigating performance, operational or security issues.
- Implementing software updates and necessary repairs.
- Maintaining the integrity, reliability and security of TrackerPro.
These provisions constitute standing documented instructions for the defined activities.
Individual Customer approval is not required for each support incident where the processing remains within the agreed scope.
Where reasonably necessary, authorised personnel may perform direct database administration or modification to resolve technical issues.
Stealth Systems shall restrict access to authorised personnel and shall not process Customer Personal Data for unrelated purposes.
The Customer expressly authorises Stealth Systems and its authorised personnel to access, inspect, investigate and, where reasonably necessary, modify information within the Customer's TrackerPro environment for the purposes of:
- Investigating and resolving customer-reported technical support issues.
- Diagnosing application and database faults.
- Identifying and correcting data inconsistencies.
- Performing authorised data corrections.
- Undertaking essential system administration and maintenance.
- Investigating performance, operational or security issues.
- Implementing software updates and necessary repairs.
- Maintaining the integrity, reliability and security of TrackerPro.
These provisions constitute standing documented instructions for the defined activities.
Individual Customer approval is not required for each support incident where the processing remains within the agreed scope.
Where reasonably necessary, authorised personnel may perform direct database administration or modification to resolve technical issues.
Stealth Systems shall restrict access to authorised personnel and shall not process Customer Personal Data for unrelated purposes.
4.3 Additional Instructions
Processing outside the authorised purposes requires further documented Customer instructions unless otherwise permitted or required by applicable law.
Stealth Systems shall inform the Customer if, in its opinion, an instruction infringes applicable data protection legislation, unless legally prohibited from doing so.
Processing outside the authorised purposes requires further documented Customer instructions unless otherwise permitted or required by applicable law.
Stealth Systems shall inform the Customer if, in its opinion, an instruction infringes applicable data protection legislation, unless legally prohibited from doing so.
4.4 Legally Required Processing
Where Stealth Systems is required by applicable law to process Customer Personal Data outside the Customer's instructions, it shall inform the Customer before doing so unless the law prohibits notification on important grounds of public interest.
Where Stealth Systems is required by applicable law to process Customer Personal Data outside the Customer's instructions, it shall inform the Customer before doing so unless the law prohibits notification on important grounds of public interest.
5. Confidentiality
5.1 Stealth Systems shall ensure that personnel authorised to process Customer Personal Data are subject to appropriate contractual or statutory confidentiality obligations.
5.2 Access shall be limited to persons requiring such access for authorised operational, development, maintenance, administration or technical support activities.
5.3 Confidentiality obligations shall continue following the termination of a person's authorisation to access Customer Personal Data.
5.4 Customer Personal Data shall not be sold or used for unrelated independent marketing purposes.
5.1 Stealth Systems shall ensure that personnel authorised to process Customer Personal Data are subject to appropriate contractual or statutory confidentiality obligations.
5.2 Access shall be limited to persons requiring such access for authorised operational, development, maintenance, administration or technical support activities.
5.3 Confidentiality obligations shall continue following the termination of a person's authorisation to access Customer Personal Data.
5.4 Customer Personal Data shall not be sold or used for unrelated independent marketing purposes.
6. Security of Processing
6.1 Stealth Systems shall implement appropriate technical and organisational measures in accordance with Article 32 of the UK GDPR.
6.2 Such measures shall take account of the nature, scope, context and purposes of processing, implementation costs, the state of the art and the risks to individuals.
6.3 Appropriate measures shall include, where applicable:
- User authentication and access restrictions.
- Secure communications and encryption.
- Database and infrastructure protection.
- Controls over administrative and developer access.
- Security monitoring and software maintenance.
- Backup and recovery procedures.
- Personal data breach identification and response arrangements.
- Measures supporting the confidentiality, integrity, availability and resilience of processing systems.
- Processes for regularly testing, assessing and evaluating the effectiveness of security measures.
6.4 Stealth Systems shall take reasonable and proportionate steps to ensure that authorised personnel comply with applicable security and confidentiality requirements.
6.5 The specific database backup, storage and recovery arrangements currently provided by TrackerPro are described in Schedule 3.
6.6 The existence of backup copies does not, by itself, constitute a guarantee that information can be restored in every circumstance.
6.1 Stealth Systems shall implement appropriate technical and organisational measures in accordance with Article 32 of the UK GDPR.
6.2 Such measures shall take account of the nature, scope, context and purposes of processing, implementation costs, the state of the art and the risks to individuals.
6.3 Appropriate measures shall include, where applicable:
- User authentication and access restrictions.
- Secure communications and encryption.
- Database and infrastructure protection.
- Controls over administrative and developer access.
- Security monitoring and software maintenance.
- Backup and recovery procedures.
- Personal data breach identification and response arrangements.
- Measures supporting the confidentiality, integrity, availability and resilience of processing systems.
- Processes for regularly testing, assessing and evaluating the effectiveness of security measures.
6.4 Stealth Systems shall take reasonable and proportionate steps to ensure that authorised personnel comply with applicable security and confidentiality requirements.
6.5 The specific database backup, storage and recovery arrangements currently provided by TrackerPro are described in Schedule 3.
6.6 The existence of backup copies does not, by itself, constitute a guarantee that information can be restored in every circumstance.
7. Sub-Processors
7.1 General Authorisation
The Customer grants Stealth Systems general written authorisation to engage sub-processors where necessary for the provision, operation, maintenance and support of TrackerPro, subject to the requirements of this Agreement.
The Customer grants Stealth Systems general written authorisation to engage sub-processors where necessary for the provision, operation, maintenance and support of TrackerPro, subject to the requirements of this Agreement.
7.2 Existing Sub-Processors
The Customer authorises the sub-processors identified in Schedule 2 for the stated purposes.
These include applicable Microsoft Azure services, Nylas, Twilio and an authorised independent software development and technical support contractor based in Chennai, India.
The Customer authorises the sub-processors identified in Schedule 2 for the stated purposes.
These include applicable Microsoft Azure services, Nylas, Twilio and an authorised independent software development and technical support contractor based in Chennai, India.
7.3 Changes to Sub-Processors
Stealth Systems shall inform Customers of intended additions or replacements of sub-processors and provide an opportunity to object on reasonable data protection grounds.
Notice shall ordinarily be given at least 30 days before a material new sub-processor begins processing Customer Personal Data, unless urgent operational or security circumstances reasonably require a shorter period.
Where a Customer raises a reasonable objection, the parties shall discuss an appropriate resolution.
Stealth Systems shall inform Customers of intended additions or replacements of sub-processors and provide an opportunity to object on reasonable data protection grounds.
Notice shall ordinarily be given at least 30 days before a material new sub-processor begins processing Customer Personal Data, unless urgent operational or security circumstances reasonably require a shorter period.
Where a Customer raises a reasonable objection, the parties shall discuss an appropriate resolution.
7.4 Sub-Processor Obligations
Stealth Systems shall establish written arrangements with relevant sub-processors imposing data protection obligations providing an equivalent level of protection to those required under Article 28 of the UK GDPR, insofar as applicable to their services.
Stealth Systems remains responsible to the Customer for the performance of its sub-processors' applicable data protection obligations.
Stealth Systems shall establish written arrangements with relevant sub-processors imposing data protection obligations providing an equivalent level of protection to those required under Article 28 of the UK GDPR, insofar as applicable to their services.
Stealth Systems remains responsible to the Customer for the performance of its sub-processors' applicable data protection obligations.
8. International Transfers
8.1 Customer Personal Data may be accessed or processed outside the United Kingdom where necessary for authorised service provision, development, technical support or communications services.
8.2 This includes remote technical access by an independent contractor based in Chennai, India.
8.3 Third-party service providers, including Nylas, Twilio and applicable cloud service providers, may process or transfer personal information internationally in accordance with their respective services and contractual arrangements.
8.4 Restricted international transfers shall be undertaken only where permitted by applicable data protection legislation and supported by appropriate legal transfer mechanisms.
8.5 Such safeguards may include the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, applicable UK adequacy regulations or another lawful mechanism.
8.6 Where required, Stealth Systems shall undertake an appropriate transfer risk assessment or data protection test and implement necessary supplementary protections.
8.7 The Customer's acceptance of this Agreement constitutes a documented instruction permitting the international processing activities described, subject to compliance with applicable international transfer requirements.
8.8 This Agreement does not itself replace any separate international transfer agreement or other safeguard required between Stealth Systems and an overseas recipient.
8.1 Customer Personal Data may be accessed or processed outside the United Kingdom where necessary for authorised service provision, development, technical support or communications services.
8.2 This includes remote technical access by an independent contractor based in Chennai, India.
8.3 Third-party service providers, including Nylas, Twilio and applicable cloud service providers, may process or transfer personal information internationally in accordance with their respective services and contractual arrangements.
8.4 Restricted international transfers shall be undertaken only where permitted by applicable data protection legislation and supported by appropriate legal transfer mechanisms.
8.5 Such safeguards may include the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, applicable UK adequacy regulations or another lawful mechanism.
8.6 Where required, Stealth Systems shall undertake an appropriate transfer risk assessment or data protection test and implement necessary supplementary protections.
8.7 The Customer's acceptance of this Agreement constitutes a documented instruction permitting the international processing activities described, subject to compliance with applicable international transfer requirements.
8.8 This Agreement does not itself replace any separate international transfer agreement or other safeguard required between Stealth Systems and an overseas recipient.
9. Assistance with Individual Rights
9.1 Taking into account the nature of the processing, Stealth Systems shall assist the Customer, through appropriate technical and organisational measures insofar as possible, in responding to requests by individuals exercising their rights under the UK GDPR.
9.2 Such requests may concern access, rectification, erasure, restriction, portability or objection.
9.3 Where Stealth Systems receives a request concerning Customer-controlled personal information, it shall, where appropriate and legally permitted, refer the request to the Customer or notify the Customer.
9.4 Stealth Systems shall not independently determine the outcome of requests concerning Customer-controlled personal information unless legally required.
9.1 Taking into account the nature of the processing, Stealth Systems shall assist the Customer, through appropriate technical and organisational measures insofar as possible, in responding to requests by individuals exercising their rights under the UK GDPR.
9.2 Such requests may concern access, rectification, erasure, restriction, portability or objection.
9.3 Where Stealth Systems receives a request concerning Customer-controlled personal information, it shall, where appropriate and legally permitted, refer the request to the Customer or notify the Customer.
9.4 Stealth Systems shall not independently determine the outcome of requests concerning Customer-controlled personal information unless legally required.
10. Personal Data Breaches
10.1 Stealth Systems shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.
10.2 Notification shall provide information reasonably available concerning the nature of the incident, its possible consequences and measures taken or proposed.
10.3 Where complete information is not immediately available, further information may be provided as an investigation progresses.
10.4 Stealth Systems shall provide reasonable assistance to the Customer in investigating the incident and meeting applicable notification obligations.
10.5 The Customer remains responsible for determining whether notification to the Information Commissioner's Office or affected individuals is necessary where it acts as Data Controller.
10.1 Stealth Systems shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.
10.2 Notification shall provide information reasonably available concerning the nature of the incident, its possible consequences and measures taken or proposed.
10.3 Where complete information is not immediately available, further information may be provided as an investigation progresses.
10.4 Stealth Systems shall provide reasonable assistance to the Customer in investigating the incident and meeting applicable notification obligations.
10.5 The Customer remains responsible for determining whether notification to the Information Commissioner's Office or affected individuals is necessary where it acts as Data Controller.
11. Assistance with Data Protection Compliance
Taking into account the nature of the processing and information available to it, Stealth Systems shall provide reasonable assistance to the Customer in meeting its obligations concerning:
- Security of processing.
- Personal data breach assessment and notification.
- Data protection impact assessments.
- Prior consultation with supervisory authorities where legally required.
Such assistance shall be proportionate to the nature of the services and information reasonably available to Stealth Systems.
Taking into account the nature of the processing and information available to it, Stealth Systems shall provide reasonable assistance to the Customer in meeting its obligations concerning:
- Security of processing.
- Personal data breach assessment and notification.
- Data protection impact assessments.
- Prior consultation with supervisory authorities where legally required.
Such assistance shall be proportionate to the nature of the services and information reasonably available to Stealth Systems.
12. Data Retention, Return and Deletion
12.1 The Customer generally determines the retention requirements for personal information maintained within its TrackerPro environment.
12.2 Upon termination of services, Stealth Systems shall, at the Customer's choice, return or securely delete Customer Personal Data, unless applicable law requires continued storage.
12.3 The Customer shall provide reasonable instructions concerning the return or deletion of information.
12.4 Following termination and deletion of the active customer database, residual information may remain in applicable database backups until those backups expire through the established retention process.
12.1 The Customer generally determines the retention requirements for personal information maintained within its TrackerPro environment.
12.2 Upon termination of services, Stealth Systems shall, at the Customer's choice, return or securely delete Customer Personal Data, unless applicable law requires continued storage.
12.3 The Customer shall provide reasonable instructions concerning the return or deletion of information.
12.4 Following termination and deletion of the active customer database, residual information may remain in applicable database backups until those backups expire through the established retention process.
12.5 Database Backup Arrangements
TrackerPro provides a standard 7-day point-in-time database recovery facility.
Separately, Stealth Systems maintains weekly database disaster recovery archives for approximately 6 months as an additional precaution.
These extended archives are not routinely tested for successful restoration and are retained solely as a best-efforts recovery option of last resort.
Their availability, integrity and recoverability are not guaranteed.
The applicable recovery arrangements and limitations are described in Schedule 3.
TrackerPro provides a standard 7-day point-in-time database recovery facility.
Separately, Stealth Systems maintains weekly database disaster recovery archives for approximately 6 months as an additional precaution.
These extended archives are not routinely tested for successful restoration and are retained solely as a best-efforts recovery option of last resort.
Their availability, integrity and recoverability are not guaranteed.
The applicable recovery arrangements and limitations are described in Schedule 3.
12.6 Blob Storage
Stealth Systems does not currently maintain separate historical backups of customer files held within Azure Blob Storage as part of its standard TrackerPro backup arrangements.
Database backup retention periods do not apply to Blob Storage files.
Stealth Systems does not currently maintain separate historical backups of customer files held within Azure Blob Storage as part of its standard TrackerPro backup arrangements.
Database backup retention periods do not apply to Blob Storage files.
12.7 Protection of Retained Information
Information retained in applicable backup systems shall remain subject to appropriate confidentiality and security measures and shall not be processed for unrelated purposes.
Information retained in applicable backup systems shall remain subject to appropriate confidentiality and security measures and shall not be processed for unrelated purposes.
12.8 Legal Retention
Where personal information must be retained to comply with applicable law, appropriate safeguards shall continue to apply.
Where personal information must be retained to comply with applicable law, appropriate safeguards shall continue to apply.
13. Audit and Compliance Information
13.1 Stealth Systems shall make available to the Customer information reasonably necessary to demonstrate compliance with its Article 28 obligations.
13.2 Stealth Systems shall allow for and contribute to audits and inspections by the Customer or an auditor appointed by the Customer, as required by Article 28.
13.3 The parties shall cooperate in arranging audits in a manner that reasonably protects the security, confidentiality and commercial interests of Stealth Systems and other customers, without preventing statutory audit rights.
13.4 Existing reports, documentation and other compliance evidence may be provided where appropriate.
13.1 Stealth Systems shall make available to the Customer information reasonably necessary to demonstrate compliance with its Article 28 obligations.
13.2 Stealth Systems shall allow for and contribute to audits and inspections by the Customer or an auditor appointed by the Customer, as required by Article 28.
13.3 The parties shall cooperate in arranging audits in a manner that reasonably protects the security, confidentiality and commercial interests of Stealth Systems and other customers, without preventing statutory audit rights.
13.4 Existing reports, documentation and other compliance evidence may be provided where appropriate.
14. Customer Responsibilities
The Customer is responsible for:
- Determining the lawful basis for processing personal data.
- Providing necessary privacy information to individuals.
- Managing authorised users and system permissions.
- Maintaining appropriate business records and retention policies.
- Providing lawful documented processing instructions.
- Responding to individuals exercising their data protection rights.
- Ensuring its use of employee monitoring and location tracking functionality complies with applicable law.
- Avoiding unnecessary collection or storage of personal information.
- Assessing whether its use of TrackerPro requires additional safeguards or a data protection impact assessment.
The Customer warrants that it is entitled to provide the documented processing instructions covered by this Agreement.
The Customer is responsible for:
- Determining the lawful basis for processing personal data.
- Providing necessary privacy information to individuals.
- Managing authorised users and system permissions.
- Maintaining appropriate business records and retention policies.
- Providing lawful documented processing instructions.
- Responding to individuals exercising their data protection rights.
- Ensuring its use of employee monitoring and location tracking functionality complies with applicable law.
- Avoiding unnecessary collection or storage of personal information.
- Assessing whether its use of TrackerPro requires additional safeguards or a data protection impact assessment.
The Customer warrants that it is entitled to provide the documented processing instructions covered by this Agreement.
15. Liability and Applicable Law
15.1 Each party remains responsible for its own obligations and liabilities under applicable data protection legislation.
15.2 Nothing in this Agreement excludes or restricts liability where such exclusion or restriction is prohibited by law.
15.3 This Agreement shall be governed by the laws of Scotland, with the Scottish courts having jurisdiction, subject to mandatory applicable legal requirements.
15.4 Descriptions of recovery capabilities and limitations within this Agreement do not exclude any statutory security, data protection or other obligations that cannot lawfully be excluded.
15.1 Each party remains responsible for its own obligations and liabilities under applicable data protection legislation.
15.2 Nothing in this Agreement excludes or restricts liability where such exclusion or restriction is prohibited by law.
15.3 This Agreement shall be governed by the laws of Scotland, with the Scottish courts having jurisdiction, subject to mandatory applicable legal requirements.
15.4 Descriptions of recovery capabilities and limitations within this Agreement do not exclude any statutory security, data protection or other obligations that cannot lawfully be excluded.
6. Duration and Changes
16.1 This Agreement takes effect when validly accepted by an authorised representative of the Customer.
16.2 It continues for the duration of TrackerPro services and any subsequent period during which Stealth Systems processes Customer Personal Data on behalf of the Customer.
16.3 Stealth Systems may propose changes to this Agreement to reflect changes in legislation, services or processing arrangements.
16.4 Material contractual changes requiring agreement shall be communicated to the Customer and accepted through an appropriate contractual process.
16.5 Changes to the Privacy Policy alone do not amend this Agreement.
16.1 This Agreement takes effect when validly accepted by an authorised representative of the Customer.
16.2 It continues for the duration of TrackerPro services and any subsequent period during which Stealth Systems processes Customer Personal Data on behalf of the Customer.
16.3 Stealth Systems may propose changes to this Agreement to reflect changes in legislation, services or processing arrangements.
16.4 Material contractual changes requiring agreement shall be communicated to the Customer and accepted through an appropriate contractual process.
16.5 Changes to the Privacy Policy alone do not amend this Agreement.
17. Electronic Acceptance
17.1 This Agreement may be accepted electronically by a person authorised to act on behalf of the Customer.
17.2 By selecting the acceptance confirmation within TrackerPro, the authorised representative confirms that they have reviewed this Agreement and agree to its terms on behalf of the Customer.
17.3 Electronic acceptance shall be recorded by Stealth Systems, including the Customer identity, accepting user, date and time, and Agreement version.
17.4 Once validly accepted, this Agreement forms part of the contractual arrangements governing the Customer's use of TrackerPro.
17.1 This Agreement may be accepted electronically by a person authorised to act on behalf of the Customer.
17.2 By selecting the acceptance confirmation within TrackerPro, the authorised representative confirms that they have reviewed this Agreement and agree to its terms on behalf of the Customer.
17.3 Electronic acceptance shall be recorded by Stealth Systems, including the Customer identity, accepting user, date and time, and Agreement version.
17.4 Once validly accepted, this Agreement forms part of the contractual arrangements governing the Customer's use of TrackerPro.
Schedule 1 — Description of Personal Data Processing
Subject Matter
Provision of TrackerPro cloud-based software for security, fire protection, installation, maintenance, job management and associated business administration.
Provision of TrackerPro cloud-based software for security, fire protection, installation, maintenance, job management and associated business administration.
Duration
For the duration of the Customer's subscription and any subsequent authorised retention, return or deletion period.
For the duration of the Customer's subscription and any subsequent authorised retention, return or deletion period.
Nature of Processing
Collection, recording, organisation, storage, retrieval, consultation, transmission, updating, correction, backup, restoration, deletion and other processing reasonably necessary to provide and support TrackerPro.
Collection, recording, organisation, storage, retrieval, consultation, transmission, updating, correction, backup, restoration, deletion and other processing reasonably necessary to provide and support TrackerPro.
Purposes
- Customer and installation management.
- Job, appointment and service administration.
- Quotation, invoice and financial administration.
- Engineer and employee activity management.
- Technical support and fault correction.
- Software operation, administration and maintenance.
- Data protection, security and recovery.
- Customer-initiated email and SMS communications.
- Authorised third-party integrations.
- Customer and installation management.
- Job, appointment and service administration.
- Quotation, invoice and financial administration.
- Engineer and employee activity management.
- Technical support and fault correction.
- Software operation, administration and maintenance.
- Data protection, security and recovery.
- Customer-initiated email and SMS communications.
- Authorised third-party integrations.
Categories of Individuals
- The Customer's customers and contacts.
- Employees, engineers and contractors.
- Site and property contacts.
- Suppliers and business contacts.
- Authorised TrackerPro users.
- Other individuals whose information the Customer lawfully enters into TrackerPro.
- The Customer's customers and contacts.
- Employees, engineers and contractors.
- Site and property contacts.
- Suppliers and business contacts.
- Authorised TrackerPro users.
- Other individuals whose information the Customer lawfully enters into TrackerPro.
Types of Personal Data
- Names, addresses, email addresses and telephone numbers.
- Job titles and employer information.
- Account and user access information.
- Installation, maintenance and service records.
- Job and appointment histories.
- Engineer activities and, where enabled, location information.
- Quotations, invoices and associated financial records.
- Documents, photographs, notes and attachments.
- Email and SMS communication content and associated metadata where processed through enabled services.
- Other personal information lawfully entered by the Customer.
Special category or other sensitive information may be processed where customers enter such information, subject to applicable legal requirements and additional safeguards.
- Names, addresses, email addresses and telephone numbers.
- Job titles and employer information.
- Account and user access information.
- Installation, maintenance and service records.
- Job and appointment histories.
- Engineer activities and, where enabled, location information.
- Quotations, invoices and associated financial records.
- Documents, photographs, notes and attachments.
- Email and SMS communication content and associated metadata where processed through enabled services.
- Other personal information lawfully entered by the Customer.
Special category or other sensitive information may be processed where customers enter such information, subject to applicable legal requirements and additional safeguards.
Controller Rights and Obligations
The Customer may provide lawful documented processing instructions, exercise applicable contractual information and audit rights, and request return or deletion of Customer Personal Data in accordance with this Agreement.
The Customer may provide lawful documented processing instructions, exercise applicable contractual information and audit rights, and request return or deletion of Customer Personal Data in accordance with this Agreement.
Schedule 2 — Authorised Sub-Processors
The Customer provides general written authorisation for the processing arrangements described below, subject to Section 7.
The Customer provides general written authorisation for the processing arrangements described below, subject to Section 7.
1. Microsoft Azure
Provider: Microsoft Corporation and applicable Microsoft contracting entities.
Purpose: Application hosting, cloud database infrastructure, data storage, system operation and associated cloud services.
Information processed: Customer information hosted within TrackerPro and related infrastructure.
Processing locations: Applicable Microsoft Azure service regions and any additional locations permitted under relevant Microsoft contractual arrangements.
Data protection: Subject to applicable Microsoft data protection and cloud services contractual terms.
Provider: Microsoft Corporation and applicable Microsoft contracting entities.
Purpose: Application hosting, cloud database infrastructure, data storage, system operation and associated cloud services.
Information processed: Customer information hosted within TrackerPro and related infrastructure.
Processing locations: Applicable Microsoft Azure service regions and any additional locations permitted under relevant Microsoft contractual arrangements.
Data protection: Subject to applicable Microsoft data protection and cloud services contractual terms.
2. Nylas
Provider: Nylas and its applicable contracting entities.
Purpose: Enabling email functionality, including sending and processing email communications through TrackerPro.
Information processed: Email addresses, sender and recipient details, message content, attachments where applicable, communication metadata and related authentication or service information necessary for enabled functionality.
Processing locations: Locations applicable to the Nylas services used, subject to the provider's published data processing and international transfer arrangements.
Data protection: Subject to applicable Nylas data processing terms and relevant contractual safeguards.
Provider: Nylas and its applicable contracting entities.
Purpose: Enabling email functionality, including sending and processing email communications through TrackerPro.
Information processed: Email addresses, sender and recipient details, message content, attachments where applicable, communication metadata and related authentication or service information necessary for enabled functionality.
Processing locations: Locations applicable to the Nylas services used, subject to the provider's published data processing and international transfer arrangements.
Data protection: Subject to applicable Nylas data processing terms and relevant contractual safeguards.
3. Twilio
Provider: Twilio and its applicable contracting entities.
Purpose: Providing SMS messaging and related communications functionality within TrackerPro.
Information processed: Mobile telephone numbers, SMS message content, delivery information, timestamps and associated communications metadata.
Processing locations: Locations applicable to the Twilio services used, including any relevant international processing and communications routing.
Data protection: Subject to applicable Twilio data processing terms and relevant contractual safeguards.
Provider: Twilio and its applicable contracting entities.
Purpose: Providing SMS messaging and related communications functionality within TrackerPro.
Information processed: Mobile telephone numbers, SMS message content, delivery information, timestamps and associated communications metadata.
Processing locations: Locations applicable to the Twilio services used, including any relevant international processing and communications routing.
Data protection: Subject to applicable Twilio data processing terms and relevant contractual safeguards.
4. Independent Software Development and Technical Support Contractor — Chennai, India
Provider: Independent contractor engaged directly by Stealth Systems Ltd.
Purpose: Software development, maintenance, technical support, fault investigation and authorised database corrections.
Processing location: Chennai, India, through remote access to TrackerPro systems.
Information processed: Customer Personal Data accessible within relevant TrackerPro environments where necessary for authorised activities, including live customer information.
Access: Controlled technical and administrative access for activities authorised under this Agreement.
Data protection: Subject to applicable sub-processing, confidentiality, security and international transfer requirements.
Provider: Independent contractor engaged directly by Stealth Systems Ltd.
Purpose: Software development, maintenance, technical support, fault investigation and authorised database corrections.
Processing location: Chennai, India, through remote access to TrackerPro systems.
Information processed: Customer Personal Data accessible within relevant TrackerPro environments where necessary for authorised activities, including live customer information.
Access: Controlled technical and administrative access for activities authorised under this Agreement.
Data protection: Subject to applicable sub-processing, confidentiality, security and international transfer requirements.
5. Additional Sub-Processors
Where additional providers are engaged to process Customer Personal Data, Stealth Systems shall identify them in its current sub-processor information and provide notice of intended additions or replacements in accordance with Section 7.
Where additional providers are engaged to process Customer Personal Data, Stealth Systems shall identify them in its current sub-processor information and provide notice of intended additions or replacements in accordance with Section 7.
Schedule 3 — Data Hosting, Backup and Recovery Arrangements
1. Cloud Infrastructure
TrackerPro operates using Microsoft Azure cloud infrastructure for application hosting, customer databases and associated storage services.
The database and file storage services have different recovery arrangements, as described below.
TrackerPro operates using Microsoft Azure cloud infrastructure for application hosting, customer databases and associated storage services.
The database and file storage services have different recovery arrangements, as described below.
2. Standard Database Recovery — 7 Days
TrackerPro provides point-in-time recovery capability for applicable Azure SQL customer databases, with a configured retention period of 7 days.
This is the primary database recovery mechanism and is intended to allow restoration to an available point within the preceding seven-day period, subject to Microsoft Azure service availability, technical limitations and successful completion of the recovery process.
Although this is the standard recovery facility, successful restoration cannot be guaranteed in every circumstance.
The recovery period relates to database information and does not automatically apply to associated documents or files held separately in Azure Blob Storage.
TrackerPro provides point-in-time recovery capability for applicable Azure SQL customer databases, with a configured retention period of 7 days.
This is the primary database recovery mechanism and is intended to allow restoration to an available point within the preceding seven-day period, subject to Microsoft Azure service availability, technical limitations and successful completion of the recovery process.
Although this is the standard recovery facility, successful restoration cannot be guaranteed in every circumstance.
The recovery period relates to database information and does not automatically apply to associated documents or files held separately in Azure Blob Storage.
3. Extended Disaster Recovery Archives — Last Resort
As an additional precaution, Stealth Systems maintains weekly disaster recovery database backups, retained for approximately 6 months.
These backups are maintained as a supplementary, best-efforts disaster recovery measure and are not part of TrackerPro's standard or guaranteed recovery service.
Customers should specifically note that:
- These backups are intended solely as a recovery option of last resort.
- Individual backup archives are not routinely tested or verified through restoration exercises.
- The existence of a backup archive does not guarantee that its contents are complete, accessible, uncorrupted or capable of successful restoration.
- Restoration from these archives may require substantial technical investigation, manual intervention or reconstruction.
- Recovery may be unsuccessful, incomplete or technically impracticable.
- No guaranteed recovery time, recovery point or successful restoration commitment is provided in relation to these archives.
Customers must not rely upon the extended disaster recovery archives as a guaranteed means of recovering information older than the standard 7-day point-in-time recovery period.
Stealth Systems may, where technically feasible, attempt restoration from these archives following a significant data loss incident.
Any such attempt will be undertaken on a best-efforts basis, without guaranteeing that a usable database can be recovered.
These archives are supplementary precautions and do not replace the standard database recovery arrangements.
As an additional precaution, Stealth Systems maintains weekly disaster recovery database backups, retained for approximately 6 months.
These backups are maintained as a supplementary, best-efforts disaster recovery measure and are not part of TrackerPro's standard or guaranteed recovery service.
Customers should specifically note that:
- These backups are intended solely as a recovery option of last resort.
- Individual backup archives are not routinely tested or verified through restoration exercises.
- The existence of a backup archive does not guarantee that its contents are complete, accessible, uncorrupted or capable of successful restoration.
- Restoration from these archives may require substantial technical investigation, manual intervention or reconstruction.
- Recovery may be unsuccessful, incomplete or technically impracticable.
- No guaranteed recovery time, recovery point or successful restoration commitment is provided in relation to these archives.
Customers must not rely upon the extended disaster recovery archives as a guaranteed means of recovering information older than the standard 7-day point-in-time recovery period.
Stealth Systems may, where technically feasible, attempt restoration from these archives following a significant data loss incident.
Any such attempt will be undertaken on a best-efforts basis, without guaranteeing that a usable database can be recovered.
These archives are supplementary precautions and do not replace the standard database recovery arrangements.
4. Azure Blob Storage
TrackerPro may use Azure Blob Storage for customer documents, photographs, attachments and other files.
Stealth Systems does not currently maintain a separate historical backup of Azure Blob Storage files as part of its standard TrackerPro backup arrangements.
Database backups, including both the standard 7-day point-in-time recovery facility and the extended disaster recovery archives, should not be interpreted as providing equivalent backup protection for files stored in Azure Blob Storage.
Customers should not assume that accidentally deleted, overwritten or corrupted Blob Storage files can be recovered from a separate historical backup.
Any underlying storage redundancy, recovery capability or other protection available through Microsoft Azure depends on the configuration and capabilities of the relevant Azure service.
TrackerPro may use Azure Blob Storage for customer documents, photographs, attachments and other files.
Stealth Systems does not currently maintain a separate historical backup of Azure Blob Storage files as part of its standard TrackerPro backup arrangements.
Database backups, including both the standard 7-day point-in-time recovery facility and the extended disaster recovery archives, should not be interpreted as providing equivalent backup protection for files stored in Azure Blob Storage.
Customers should not assume that accidentally deleted, overwritten or corrupted Blob Storage files can be recovered from a separate historical backup.
Any underlying storage redundancy, recovery capability or other protection available through Microsoft Azure depends on the configuration and capabilities of the relevant Azure service.
5. Recovery Limitations
Stealth Systems maintains backup arrangements intended to reduce the impact of data loss and support service continuity.
However, backup retention does not itself constitute a guarantee of data recoverability.
In particular:
- The standard 7-day point-in-time recovery facility is the primary database recovery mechanism.
- Extended disaster recovery archives are supplementary and intended only for exceptional circumstances.
- The extended archives are not routinely restoration-tested and may not be recoverable.
- No guaranteed restoration time or recovery outcome applies to the extended archives.
- Blob Storage files are not covered by a separate historical backup arrangement.
- Restoration may be affected by circumstances beyond the direct control of Stealth Systems, including service availability, backup integrity and technical recovery limitations.
Nothing in this Schedule excludes or limits any obligation or liability that cannot lawfully be excluded under applicable legislation.
Stealth Systems maintains backup arrangements intended to reduce the impact of data loss and support service continuity.
However, backup retention does not itself constitute a guarantee of data recoverability.
In particular:
- The standard 7-day point-in-time recovery facility is the primary database recovery mechanism.
- Extended disaster recovery archives are supplementary and intended only for exceptional circumstances.
- The extended archives are not routinely restoration-tested and may not be recoverable.
- No guaranteed restoration time or recovery outcome applies to the extended archives.
- Blob Storage files are not covered by a separate historical backup arrangement.
- Restoration may be affected by circumstances beyond the direct control of Stealth Systems, including service availability, backup integrity and technical recovery limitations.
Nothing in this Schedule excludes or limits any obligation or liability that cannot lawfully be excluded under applicable legislation.
6. Backup Retention Following Termination
Following termination of services and deletion of an active customer database, residual database information may remain within applicable backup systems until expiry of the relevant retention periods.
These currently comprise:
- Up to 7 days for standard point-in-time database recovery.
- Approximately 6 months for weekly extended disaster recovery archives.
During these periods, retained information remains subject to applicable confidentiality, security and data protection obligations.
Such information shall not be restored for routine operational use except where authorised and necessary for legitimate recovery, legal or compliance purposes.
Backup information will be deleted through the normal expiry and deletion process, unless further retention is legally required.
Following termination of services and deletion of an active customer database, residual database information may remain within applicable backup systems until expiry of the relevant retention periods.
These currently comprise:
- Up to 7 days for standard point-in-time database recovery.
- Approximately 6 months for weekly extended disaster recovery archives.
During these periods, retained information remains subject to applicable confidentiality, security and data protection obligations.
Such information shall not be restored for routine operational use except where authorised and necessary for legitimate recovery, legal or compliance purposes.
Backup information will be deleted through the normal expiry and deletion process, unless further retention is legally required.
7. Changes to Backup Arrangements
Stealth Systems may update its backup and recovery arrangements to reflect developments in technology, infrastructure or operational requirements.
Material changes affecting the protection, retention or recoverability of Customer Personal Data shall be communicated to Customers where required by applicable law or contractual obligations.
Any changes shall remain subject to Stealth Systems' applicable security and data protection obligations.
Stealth Systems may update its backup and recovery arrangements to reflect developments in technology, infrastructure or operational requirements.
Material changes affecting the protection, retention or recoverability of Customer Personal Data shall be communicated to Customers where required by applicable law or contractual obligations.
Any changes shall remain subject to Stealth Systems' applicable security and data protection obligations.
Schedule 4 — Technical Support and Administrative Access
The Customer acknowledges that effective provision of TrackerPro requires Stealth Systems to maintain the ability to undertake authorised technical support and database administration activities.
These may include:
- Investigating technical support issues reported by the Customer.
- Examining affected records and database information.
- Correcting data inconsistencies and software-related errors.
- Updating or repairing records where necessary to resolve faults.
- Performing essential software and database maintenance.
- Investigating security and operational issues.
- Performing customer-requested technical activities.
This Schedule constitutes standing documented instructions for these defined activities.
Stealth Systems shall limit such activities to authorised purposes and shall maintain appropriate confidentiality and security protections.
The Customer acknowledges that authorised development and support services may involve access by approved external personnel, including independent contractors based in Chennai, India, subject to applicable data protection obligations.
Stealth Systems Ltd1B Mountjoy TerraceMusselburghEast LothianEH21 6JRUnited KingdomEmail: info@stealthsys.co.ukWebsite: www.stealthsys.co.ukTrackerPro Data Processing Agreement — Version 1.2
The Customer acknowledges that effective provision of TrackerPro requires Stealth Systems to maintain the ability to undertake authorised technical support and database administration activities.
These may include:
- Investigating technical support issues reported by the Customer.
- Examining affected records and database information.
- Correcting data inconsistencies and software-related errors.
- Updating or repairing records where necessary to resolve faults.
- Performing essential software and database maintenance.
- Investigating security and operational issues.
- Performing customer-requested technical activities.
This Schedule constitutes standing documented instructions for these defined activities.
Stealth Systems shall limit such activities to authorised purposes and shall maintain appropriate confidentiality and security protections.
The Customer acknowledges that authorised development and support services may involve access by approved external personnel, including independent contractors based in Chennai, India, subject to applicable data protection obligations.
TrackerPro Data Processing Agreement — Version 1.2