FixMargin — Data Processing Addendum (DPA)
Version 1.3 · Effective date: 5 September 2026
This Data Processing Addendum forms part of the FixMargin Terms of Service between Quantix Prime Ltd (trading as FixMargin, company number 16680674) (“Processor”, “we”) and the Customer (“Controller”, “you”). It applies whenever we process personal data on your behalf in providing the Service. Capitalised terms not defined here have the meaning in the Terms.
1. Roles and scope
1.1 For Customer Data (personal data you and your Users put into the Service), you are the controller and we are your processor.
1.2 For account, billing, usage and marketing data we are an independent controller as described in the Privacy Policy; this DPA does not apply to that processing.
1.3 “Data Protection Law” means the UK GDPR, the Data Protection Act 2018, PECR, and, where applicable to you, the EU GDPR.
2. Details of processing (Art. 28(3))
| Subject matter | Provision of the FixMargin commercial-control application |
|---|---|
| Duration | The Subscription Term plus the export/deletion period in §9 |
| Nature and purpose | Hosting, storage, calculation, display, export, backup and support of Customer Data so that you can estimate, procure, reconcile, plan and report on construction projects |
| Types of personal data | Names, job titles and business contact details of your staff, operatives, subcontractors, suppliers, clients and consultants; signatures; photographs taken on site (which may incidentally include individuals); labour records (hours, rates, crew allocations); free-text notes; audit logs of user actions |
| Categories of data subjects | Your employees and Authorised Users; site operatives and gang members; supplier, client and consultant staff; any individuals appearing in uploaded documents or photographs |
| Special category data | Not intended. You must not upload special-category or criminal-offence data unless we have agreed additional measures in writing (e.g. medical details on site reports) |
3. Our obligations as processor
We will:
-
process Customer Data only on your documented instructions (which are: the Terms, this DPA — including the international transfers described in §10 and Annex 1 — and your and your Users’ use of the Service’s features), unless required by law — in which case we will inform you unless the law prohibits it;
-
ensure that personnel authorised to process Customer Data are bound by confidentiality obligations;
-
implement the technical and organisational measures in Annex 2, appropriate to the risk;
-
engage sub-processors only in accordance with §5;
-
taking into account the nature of the processing, assist you by appropriate technical and organisational measures in responding to data-subject requests (§6);
-
assist you in meeting your obligations regarding security, breach notification, data-protection impact assessments and prior consultation, taking into account the information available to us;
-
at your choice, delete or return Customer Data at the end of the Service (§9);
-
make available the information necessary to demonstrate compliance with Art. 28 and allow for and contribute to audits (§8);
-
inform you immediately if, in our opinion, an instruction infringes Data Protection Law.
4. Your obligations as controller
You are responsible for: the lawfulness of Customer Data and your instructions; providing any privacy notices required to your operatives, suppliers and other data subjects; configuring user roles and access appropriately; keeping your Users’ credentials secure; and not uploading data outside the scope of §2 without agreement.
5. Sub-processors
5.1 You give general authorisation for the sub-processors listed in Annex 1.
5.2 We will notify you (by email to the Account’s Admin contact and/or through our published sub-processor list) at least 14 days before adding or replacing a sub-processor, where reasonably practicable. Where an urgent change is necessary for security, legal or service-continuity reasons and advance notice is not reasonably practicable, we will notify you as soon as reasonably practicable. You may object on reasonable data-protection grounds within 14 days of the notice; we will work with you in good faith to resolve the objection and, if we cannot within 30 days, you may terminate the affected subscription with a pro-rata refund of prepaid Fees.
5.3 We impose data-protection obligations on sub-processors that are no less protective than this DPA and remain liable for their performance.
6. Data-subject requests
If we receive a request from a data subject relating to Customer Data, we will not respond directly (except to redirect them to you) and will notify you within 5 business days. The Service provides self-service export, correction and deletion of most Customer Data; where it does not, we will assist on request.
7. Personal data breach
We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Data, giving the information reasonably available to us (nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, measures taken or proposed), and updating as further information becomes available. We will cooperate with your notification to the ICO and data subjects where required.
8. Audit
8.1 Once per 12 months, and additionally after a breach affecting your data, you may request our then-current security documentation, sub-processor list and a written response to a reasonable security questionnaire.
8.2 If that information does not reasonably satisfy your obligations, you (or an independent auditor bound by confidentiality) may audit our relevant controls on at least 30 days’ written notice, during business hours, no more than once per year, at your cost, without disrupting our operations. Audit findings are confidential.
9. Return and deletion
9.1 During the Subscription Term you may export Customer Data using the Service’s export features at any time.
9.2 For 30 days after the end of the Service we will keep Customer Data available for export on request. After that period we will delete Customer Data within a further 60 days, except: (a) data in backups, which is overwritten in the ordinary course (typically within 30 days) and is not restored except for disaster recovery; and (b) data we must retain under law, which we will continue to protect under this DPA and delete when the retention obligation ends.
9.3 On request we will confirm deletion in writing.
10. International transfers
Customer Data is stored in the United Kingdom (London region). Where we make a restricted transfer of Customer Data within the meaning of Data Protection Law — which includes contracting with a sub-processor established outside the UK even where the data remains hosted in the UK (see Annex 1) — the transfer is covered by UK adequacy regulations or made under an appropriate safeguard — the UK International Data Transfer Agreement (IDTA) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as identified for each sub-processor in Annex 1 — or another mechanism valid under Data Protection Law, and we carry out a transfer risk assessment applying the statutory data-protection test.
11. Liability
Each party’s liability under this DPA is subject to the exclusions and limitations in the Terms (including the Data and Security Cap in Terms §14.3A), except that nothing limits liability that cannot be limited under Data Protection Law. Nothing in this DPA or the Terms restricts any right that a data subject has directly under Data Protection Law.
12. Order of precedence; term
This DPA prevails over the Terms in relation to processing of Customer Data. It lasts for as long as we process Customer Data.
Annex 1 — Authorised sub-processors (as at 5 September 2026)
| Sub-processor | Service | Processing location | Transfer mechanism |
|---|---|---|---|
| Supabase Pte. Ltd (Singapore) | Database, file storage, authentication infrastructure | Data hosted in AWS eu-west-2 (London, UK) | Restricted transfer (Singapore contracting entity): UK International Data Transfer Addendum (B.1.0) to the EU SCCs, Modules 2 and 3, incorporated in Supabase’s DPA (Schedule 2) |
| Vercel Inc. (USA) | Application hosting and content delivery | Compute in Vercel London (lhr1); global edge for static content | Restricted transfer (US contracting entity): UK International Data Transfer Addendum to the EU SCCs, incorporated in Vercel’s DPA (Schedule 3 §2, Schedule 5) |
| Anthropic Ireland, Limited | AI-assisted document extraction (supplier price lists, invoices, credit notes) — only when a User submits content to the feature (Terms §7.8) | Contracting entity in Ireland (EEA); processing infrastructure primarily in the USA | UK adequacy regulations (EEA); UK International Data Transfer Addendum to the EU SCCs, Modules 2 and 3, incorporated in Anthropic’s DPA (Schedule 3 §B) for US processing; content retained up to 30 days for safety purposes only; not used to train models |
| Amazon Web Services EMEA SARL (Amazon SES) | Outbound transactional email (invitations, notifications, supplier call-off emails when used) | AWS eu-west-2 (London, UK) | Contracting entity in Luxembourg (EEA): UK adequacy regulations; AWS GDPR DPA incorporating the UK International Data Transfer Addendum for any onward access |
| PostHog Inc. | Product analytics — User identifiers and interaction events only, not document content; only with cookie consent; session replay disabled | PostHog EU Cloud (Frankfurt) | EU adequacy regulations for storage in the EU; DPA signed 2 Sep 2026 incorporating the UK International Data Transfer Addendum to the EU SCCs for any onward access; EU-US Data Privacy Framework + UK Extension |
Not a sub-processor: Stripe Payments UK Ltd processes payment transactions as an independent controller; we share only billing-contact data with it.
The current list is also published at fixmargin.com/subprocessors, together with the change notices described in §5.
Annex 2 — Technical and organisational measures
Access control: role-based permissions (Admin / Pro Control / Pro / Operative) enforced server-side; organisation-scoped data isolation on every query; per-user credentials; hashed passwords (bcrypt/argon2); email verification; rate-limited authentication; multi-factor authentication for production infrastructure access; least-privilege service credentials.
Encryption: TLS 1.2+ for all traffic; encryption at rest for database and object storage (AES-256, provider-managed keys); signed, time-limited URLs for file access.
Availability and resilience: managed database with automated daily backups and point-in-time recovery; multi-zone hosting; separate preview and production environments; deployment protection; infrastructure-as-code migrations with review.
Integrity and auditability: application audit log of material user actions (who/what/when); immutable action histories for call-offs, invoices and variations; change control via pull-request review and automated tests before production release.
Monitoring and incident response: application error logging; security alerting on authentication and billing endpoints; documented incident-response and breach-notification procedure (48h to customers); post-incident review.
Data minimisation and retention: only data needed for the feature is collected; analytics pseudonymised and consent-gated; retention schedule per Privacy Policy; deletion on termination per §9.
Organisational: confidentiality obligations for all personnel and contractors; sub-processor due diligence and DPAs; data-protection responsibility assigned to a named director; annual review of this Annex.