Nightingale Software Group — Data Processing Agreement (UK GDPR Article 28)

Effective date: 10 November 2026 · Version: 2026-11-10/v1.3

This Data Processing Agreement ("DPA") is between the business that signs up to our services (the "Customer", "you") and Nightingale Software Group ("Nightingale", "we", "us"). Contact us at team@nightingalesoftware.co.uk. Phone: 01473 487485. When Nightingale Software Group Limited is incorporated, this DPA transfers to it automatically on the same terms, as set out in the Terms of Service.

This DPA has three parts: the core terms below; Schedule 1 (sub-processors, AI providers and breach notice); and Schedule 2 (app-specific processing details).

Core terms

1. How this DPA applies

1.1 This DPA forms part of our Terms of Service (nightingalesoftware.co.uk/legal/terms). You accept it at checkout, when you tick the box agreeing to the Terms of Service and this DPA. It applies whenever we process personal data on your behalf in providing our apps, the Admin Centre and related services (the "Services"). 1.2 If this DPA conflicts with the Terms of Service or any other document on anything to do with the protection of personal data, this DPA wins. Within this DPA, Schedule 1 wins on sub-processors and breach notice, and the core terms win on everything else. 1.3 If you have signed a separate data processing agreement with us, that agreement applies instead of these core terms, but Schedule 1 (sub-processors and the 48-hour breach notice) still applies to it. 1.4 Words such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR. "Data protection law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended or replaced. "Customer personal data" means the personal data we process on your behalf under this DPA.

2. Roles

2.1 You are the controller of customer personal data: you decide why and how it is processed. We are your processor: we process it only to provide the Services to you. 2.2 Where we process personal data about your account users and billing contacts for our own purposes (for example billing, security, fraud prevention and running our business), we do so as an independent controller under our Privacy Notice (nightingalesoftware.co.uk/legal/privacy), not under this DPA.

3. What we process

3.1 Subject matter: providing the Services you subscribe to. 3.2 Duration: for as long as you use the Services, plus the 30-day export period and the deletion period in clause 10. 3.3 Nature and purpose: storing, organising, retrieving, analysing, transmitting, displaying and deleting customer personal data, and the other operations needed to provide the features of each app you use. 3.4 Types of personal data and categories of data subjects: as described for each app in Schedule 2. Do not put special category data or criminal-offence data into the Services unless Schedule 2 says the app is designed to hold it and you have a lawful basis.

4. Your responsibilities

4.1 You are responsible for having a lawful basis for the processing, for giving people any notices that the law requires (including telling staff about monitoring and telling people when calls are recorded), and for making sure your instructions comply with data protection law. 4.2 You must follow the customer duties set out for each app in Schedule 2 and our Acceptable Use Policy.

5. Processing only on your instructions

5.1 We process customer personal data only on your documented instructions. Your instructions are this DPA, the Terms of Service, and the way you configure and use the Services. You can give further reasonable instructions in writing. 5.2 We may process customer personal data otherwise only where UK law requires it. If so, we will tell you first, unless the law prevents us from doing so. 5.3 We will tell you promptly if we think an instruction breaks data protection law. We do not have to follow that instruction until it is confirmed or changed. 5.4 We do not sell customer personal data, and we do not use customer content to train AI models.

6. Confidentiality

We make sure that everyone we authorise to process customer personal data is bound by a duty of confidentiality and only has access where they need it to provide or support the Services.

7. Security

7.1 We take appropriate technical and organisational measures to protect customer personal data, as required by Article 32 UK GDPR, taking into account our size, the nature of the data and the risks involved. Our current measures include: encryption of data in transit (HTTPS/TLS) and encryption at rest provided by our hosting platform; separation of each customer's data at database level; role-based access controls, with administrative credentials used only on our servers; and nightly encrypted (AES-256) database backups, stored away from our backup server and deleted automatically on a fixed cycle. 7.2 We are actively strengthening our security and are putting in place further measures, including logging of administrative access and significant actions, and system monitoring and alerting. We will tell you on request which of these are in place at the time. 7.3 You are responsible for keeping your own copies of data that is important to you, using the export tools in each app. 7.4 We review these measures from time to time and may update them, but we will not reduce the overall level of protection.

8. Sub-processors

8.1 General written authorisation. You give us general written authorisation to use sub-processors in the categories listed in Schedule 1. We list sub-processors by category; the named providers are available on request as set out in Schedule 1. 8.2 Notice of changes. We will give you at least 30 days' notice before adding or replacing a sub-processor in a way that changes the categories in Schedule 1 or the countries where customer personal data is processed. We give notice by email to your account owner or by updating our sub-processor page (nightingalesoftware.co.uk/legal/subprocessors). 8.3 Right to object. You may object on reasonable data protection grounds by emailing team@nightingalesoftware.co.uk within the 30-day notice period. We will discuss your objection in good faith and try to find a solution. If we cannot, you may cancel the affected app with effect before the change, and we will refund any subscription fees you paid in advance for the period after cancellation. 8.4 Flow-down. We put a written contract in place with each sub-processor that imposes data protection obligations no less protective than this DPA. We remain responsible to you for each sub-processor's performance of those obligations, subject to clause 13.

9. Helping you comply

9.1 Data subject rights. Taking into account the nature of the processing, we help you respond to requests from people exercising their rights under data protection law, mainly through the tools in the Services that let you find, export, correct and delete data. If a person contacts us directly about customer personal data, we will pass the request to you without undue delay and will not answer it ourselves unless you ask us to. 9.2 Security, breaches, impact assessments and consultation. Taking into account the information available to us, we give you reasonable help to meet your obligations on security (Article 32), personal data breaches (Articles 33 and 34), data protection impact assessments (Article 35) and prior consultation with the Information Commissioner (Article 36).

10. End of the Services: return and deletion

10.1 You can export customer personal data using the export tools in the Services at any time during your subscription and for 30 days after it ends. If you cannot use the tools, ask us within that period and we will provide an export in a common machine-readable format. 10.2 After those 30 days we delete customer personal data from our live systems. Copies in backups are deleted as those backups expire on their normal cycle. We may keep data only where UK law requires us to; anything we keep stays protected by this DPA.

11. Audits and information

11.1 We will make available to you the information reasonably needed to show that we comply with this DPA and Article 28 UK GDPR. We will do this first through documentation — for example, written answers to a reasonable security questionnaire and a description of our security measures. 11.2 If that information is not enough to show compliance, or a regulator requires it, you (or an independent auditor you appoint who is bound by confidentiality) may carry out an audit, including an on-site audit. You must give at least 30 days' written notice, audits may take place no more than once in any 12-month period (unless a regulator requires more, or following a personal data breach affecting your data), and they must be carried out in business hours in a way that limits disruption and protects other customers' data and our confidential information. You pay the costs of the audit, including our reasonable costs of supporting it.

12. Personal data breaches

12.1 We will notify you without undue delay and in any event within 48 hours after becoming aware of a personal data breach affecting customer personal data. 12.2 Our notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the steps taken or proposed to deal with it. We will send further information as it becomes available and take reasonable steps to contain the breach and reduce its effects. 12.3 Notifying you of a breach is not an admission of fault or liability.

13. International transfers

13.1 Our main hosting is in the UK and the European Economic Area. Some sub-processors process data in other countries, as shown in Schedule 1. 13.2 Where a sub-processor's processing involves a restricted transfer of customer personal data out of the UK to a country without UK adequacy regulations, we make sure the transfer is covered by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (or another transfer mechanism allowed by UK data protection law), with any extra measures needed.

14. Liability

Each party's liability under or in connection with this DPA is subject to the limits and exclusions of liability in the Terms of Service (section 9). Those limits apply to this DPA and the Terms of Service together, not separately. Nothing in this DPA limits liability that cannot be limited by law.

15. Changes, duration and law

15.1 We may update this DPA in the same way as the Terms of Service (at least 30 days' notice by email or in the Admin Centre), or sooner where the law requires it. We will not reduce the protection given to customer personal data. 15.2 This DPA lasts for as long as we process customer personal data on your behalf. Clauses that by their nature should continue after the end of the Services (including clauses 10, 12 and 14) continue. 15.3 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. 15.4 Data protection questions: team@nightingalesoftware.co.uk (please put "Privacy" in the subject line).

Schedule 1 — Sub-processors, AI Providers and Breach Notice

1. Precedence

This Schedule is part of this DPA. It replaces any earlier list of sub-processors (including any earlier sub-processors page and any sub-processor annex to a signed agreement) and settles the breach-notice period. If anything else in this DPA, or in any earlier version of it, conflicts with this Schedule on sub-processors or breach notice, this Schedule wins.

2. General written authorisation (Art 28(2) UK GDPR)

2.1 The Customer gives general written authorisation for Nightingale to engage sub-processors in the categories below. 2.2 Nightingale will: (a) impose data-protection obligations on each sub-processor that are no less protective than this DPA; (b) remain liable to the Customer for each sub-processor's performance, subject to the liability terms of the main contract; (c) carry out due diligence and, for restricted transfers, put an IDTA, the UK Addendum to the EU SCCs or reliance on UK adequacy (including the UK–US data bridge) in place with a transfer risk assessment. 2.3 Notice of changes. Nightingale will give at least 30 days' notice (by email to the account owner or on our sub-processor page, nightingalesoftware.co.uk/legal/subprocessors) before adding or replacing a sub-processor in a way that changes the categories below or the countries in which Customer personal data is processed. The Customer may object on reasonable data-protection grounds within that period; if we cannot resolve the objection, the Customer may terminate the affected subscription and receive a pro-rata refund of prepaid fees for it. 2.4 Provider identities. Nightingale publishes its sub-processors by category only. The named providers are held in Nightingale's sub-processor register and are made available to a Customer on request to team@nightingalesoftware.co.uk under a short non-disclosure agreement, because the names of specialist research, data and AI providers are commercially sensitive. Named providers will always be disclosed where the law requires it, including in response to a subject access request and to the Information Commissioner. This does not limit the Customer's audit rights under clause 11 of the core terms (or under any separate data processing agreement you have signed) or any disclosure required by law, a regulator or a data subject access request (see section 5 of this Schedule).

3. Sub-processor categories

Nightingale does not use Customer content to train AI models. AI providers receive only the content needed for the request being made.

4. Personal data breach

Nightingale will notify the Customer without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting Customer personal data, with the information required by Art 33(3) UK GDPR as it becomes available. (This replaces the 72-hour period in earlier versions of our Data Processing Agreement, so the Customer can meet its own 72-hour deadline to the ICO.)

5. Data subject requests and source disclosure

Nightingale will help the Customer respond to data subject requests. Where a data subject is entitled under Art 14(2)(f) or Art 15(1)(g) UK GDPR to information about the source of their data, or under Art 15(1)(c) to the recipients, the Customer must provide it, and Nightingale will supply the information needed (including identifying a specific provider where the law requires it). Commercial confidentiality is not a ground for refusing a lawful request.

Schedule 2 — App-Specific Processing Schedules

Annex 1 descriptions under Article 28(3) UK GDPR. This Schedule is part of this DPA and also supplements our Privacy Notice.

For every app the Customer is the controller and Nightingale (Nightingale Software Group; from incorporation Nightingale Software Group Limited) is the processor, acting only on the Customer's documented instructions (configuring and using the app counts as instructions). Duration: the subscription term plus up to 30 days for export and deletion. Sub-processor categories: Schedule 1 above. Contact: team@nightingalesoftware.co.uk.

Part A — Standard profile (apps with ordinary business data)

Applies to FacilityFlow Core, Stok, e-Kwip, WasteVault, Zevolo, GaleAI and Leggdger (not currently offered) (and any app not listed in Part B).

• Data subjects: the Customer's staff, contractors, suppliers and business contacts.
• Data: names, work contact details, job roles, user IDs, activity/audit logs, content the Customer enters (asset, stock, waste-transfer, facility, ledger and task records), any photos or attachments uploaded, and AI prompts/outputs.
• Special category / criminal data: not intended. The Customer must not upload it unless it has an Art 9/10 condition.
• Purpose: providing the app's features to the Customer.
• Customer notes: WasteVault waste-transfer records may need keeping for at least 2 years (hazardous consignment notes 3 years) — the Customer sets retention/export accordingly. Leggdger may hold financial records; the Customer is responsible for its own HMRC retention.

Part B — Apps where processing genuinely differs

B1. PunchLine (time & attendance, phone clocking)

• Data subjects: employees and workers.
• Data: name, employee ID, shift and clock-in/out times, absence and holiday records, phone number and call metadata for phone (IVR) clocking, device/IP and, where the Customer enables it, location at clock-in. Pay-related data (hours, rates) if entered.
• Sub-processors: standard categories plus telephony (category 5).
• Customer duties: tell workers about time and location monitoring before it starts (ICO Employment practices: monitoring workers guidance); location only at clock events, not continuous; keep working-time records for at least 2 years (Working Time Regulations) and pay records 6 years (HMRC). Do not use the data for solely automated disciplinary decisions.

B2. Onboardly (onboarding, right-to-work)

• Data subjects: candidates, new starters, employees.
• Data: identity and contact details, date of birth, emergency contacts, bank details for payroll, right-to-work evidence (passport/BRP/share-code check results, copies of documents), contract and policy acknowledgements, and DBS check information.
• Special category / criminal-offence data: right-to-work documents may reveal nationality/ethnic origin (special category, Art 9); DBS results are criminal-offence data (Art 10) — the Customer must have a DPA 2018 Schedule 1 condition and an Appropriate Policy Document, and only request DBS checks where eligible.
• Retention (Customer): Home Office requires right-to-work copies for the duration of employment plus 2 years, then secure deletion. DBS certificate information should generally be kept no longer than 6 months after the recruitment decision.
• Security: access to right-to-work and DBS records must be restricted to named HR roles in the app.

B3. KoWurk (workforce / staffing)

• Data subjects: workers, contractors, agency staff, client contacts.
• Data: identity and contact details, availability, skills, qualifications, assignments, timesheets, and right-to-work status flags where used.
• Notes: as B2 for right-to-work; where the Customer is an employment business it is also subject to the Conduct of Employment Agencies and Employment Businesses Regulations 2003 record-keeping.

B4. Shift Check and Formermize (rota and form/inspection workflows)

• Data: worker names, rota and attendance data, checklists, signatures, photos and form responses. Formermize forms can be designed by the Customer to collect any data — the Customer must not build forms that collect special category or criminal data without a lawful condition, and must give its own privacy notice on the form.

B5. Rekuver, Rampify and CleanNest (field, driver and mobile staff)

• Data subjects: drivers, field operatives, cleaners, site contacts, and members of the public at job sites (incidentally, in photos).
• Data: name, phone number, GPS location during active shifts/jobs (where the feature is enabled), journey and site-visit records, photos, signatures, SMS verification codes (Rekuver wait-time verification), vehicle details.
• Sub-processors: standard plus telephony/SMS (category 5).
• Rekuver scope: Rekuver records and evidences UK HGV waiting time (demurrage) at distribution centres only, not port, container, shipping-line or sea-freight charges. Driver location is collected only during an active shift or waiting-time verification, and only after the driver allows location access on the device; the app remembers that choice on the device, and the driver can withdraw it there.
• Retention: app content is kept for the subscription and deleted within 30 days after it ends (export first). The Customer decides how long it keeps claim and evidence records within that period.
• Customer duties: location tracking only while on shift and disclosed in advance; carry out a DPIA where tracking is systematic (ICO guidance treats systematic monitoring of workers as likely high-risk); avoid capturing identifiable members of the public in photos where possible.

B6. Ekspedite (hospitality food safety, HACCP, temperature monitoring & allergens)

• Data subjects: kitchen staff, managers, suppliers' contacts; in limited cases customers (see below).
• Data: staff names, sign-offs and signatures, temperature and cleaning logs, HACCP checks, corrective actions, photos, supplier records, allergen matrices for dishes.
• Allergen information about dishes is not personal data. It becomes personal (and health data, Art 9) only if the Customer records a named customer's allergy or dietary need (for example on a booking or order note). Ekspedite is not designed for that; if the Customer does it, it needs explicit consent or another Art 9 condition and must restrict access.
• Staff fitness-to-work / illness exclusion records (e.g. after vomiting/diarrhoea under Food Standards Agency guidance) are health data. If recorded, keep the minimum (dates of exclusion and return, not symptoms in detail) and limit access to managers.
• Not advice: Ekspedite helps keep records; it does not replace the Customer's HACCP plan, allergen labelling duties (including PPDS "Natasha's Law" rules) or legal responsibility for food safety.

B7. Songbird (CRM, pipeline, campaigns)

• Data subjects: the Customer's prospects, customers and business contacts.
• Data: names, work contact details, company, deal and activity history, email/calendar content synced by the Customer, imported lists, AI-generated summaries.
• Customer duties: Customer is responsible for lawful basis and PECR for any marketing sent; must honour objections and keep a suppression list; must give Art 14 notice to contacts it obtains from third parties.

B8. BirdCall (calling / communications)

• Data subjects: the Customer's callers and called parties, and its staff.
• Data: phone numbers, call times and durations, call recordings and transcripts (if and when enabled), voicemail, notes, AI summaries.
• Sub-processors: standard plus telephony (5), AI language (6) and, where enabled, AI voice/transcription (7).
• Customer duties: tell callers at the start of each call if it is recorded or transcribed and why; do not make live marketing calls to people who have objected or to TPS/CTPS-registered numbers without consent (BirdCall does not check those registers for you); AI-voiced calls only to people who have consented or asked for a callback — cold outreach must be human-led; do not record payment card details (PCI DSS — pause recording).
• BirdCall Enterprise is sold by quote; processing details may be extended in the Order Form.

B9. GaleCast (AI-assisted B2B prospect discovery and outreach)

Our notice for people contacted through GaleCast, our standard opt-out wording and a summary of the PECR rules are at nightingalesoftware.co.uk/legal/galecast-prospects. In summary:

• Data subjects: business contacts (directors, officers, employees) at prospect companies.
• Data: name, job title, company, work email, work and switchboard phone numbers, professional profile link (if public), Companies House officer data, public web information, engagement history, call recordings and transcripts (of AI-voiced calls to consented or callback contacts, and of human calls where recording is enabled), opt-out/suppression records.
• Calling rule: AI-voiced calls are made only to people who have consented to receive them or who have asked for a callback. All cold outreach is human-led. Every contact is checked against the do-not-contact and suppression lists first. GaleCast does not check the TPS or CTPS registers; the Customer must screen live marketing calls against them.
• Sources: public registers (Companies House), company websites and public web pages, commercial business-data providers, and lists the Customer uploads.
• Sub-processors: standard plus categories 5–9.
• Retention (automated deletion): prospects never contacted — 90 days from collection; contacted prospects — 12 months after last contact; call recordings — 90 days; call transcripts — 12 months; suppression records — kept indefinitely (minimum data only) so objections continue to be honoured.