Data Processing Agreement

Parties

Fixray Ltd, a company registered in England and Wales (company number 17347585), contactable at hello@fixray.app ("Fixray", "we", "us", the processor); and the customer organisation identified in the Fixray account ("you", the controller).

This agreement forms part of, and is governed by, our Terms of Service (the "Agreement"). If this agreement and the Agreement conflict on personal data, this agreement wins. It applies from the date it was first published on our website to every customer whose Terms of Service refer to our Data Processing Agreement, including the Terms dated 20 July 2026, and to every new customer from sign-up.

1. What this agreement does

In short: you decide what personal data goes into Fixray and why. We only handle it to run the service for you, on your instructions.

When your team uses Fixray, personal data about your staff (and, where you use guest reporting, about members of the public) is stored and processed in your workspace. You are the controller: you decide what data goes in and what it's used for. We are the processor: we handle it on your behalf, on your instructions.

This agreement sets out the terms required by Article 28 of the UK GDPR. "UK GDPR", "personal data", "processing", "personal data breach", "data subject", "controller" and "processor" have the meanings given in the UK GDPR and the Data Protection Act 2018 ("Data Protection Law").

Separately, we are an independent controller for a limited set of data we process for our own purposes: your billing contact details, our account and support records, product analytics, short excerpts of issues and comments that our staff translate for support and monitoring (cached for 14 days), and an audit record of account deletions (kept for 12 months). That processing is described in our privacy policy and is outside this agreement. The providers we use for it are listed in Annex 3B for transparency only.

2. Your responsibilities as controller

You confirm that:

• you have a lawful basis for the personal data you put into Fixray, and have given the people it relates to the privacy information the law requires;
• your instructions to us comply with Data Protection Law; and
• you won't use Fixray to collect special category data (such as health, biometric, racial or ethnic origin, religious belief, trade union membership, sex life or sexual orientation) or criminal offence data, and you'll take reasonable steps, such as guidance to your staff, to keep it out of free-text reports and photos. Fixray isn't designed for that data. If some reaches us incidentally, we handle it under this agreement.

3. Scope of the processing

We process personal data only as needed to provide the service, as described in Annex 1: the subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subject.

4. Our instructions

We process personal data only on your documented instructions, including on international transfers, unless the law requires otherwise. If it does, we'll tell you first unless the law prohibits that. Your instructions are this agreement, the Agreement, and your use of the service's features and settings. If we think an instruction breaches Data Protection Law, we'll tell you immediately and may pause that processing until it's resolved.

5. Confidentiality and our access

Everyone we authorise to process your personal data is bound by a duty of confidentiality, by contract or by statute, and gets access only to what they need.

Access to production data is limited to named Fixray operators with an operational need, each required to hold a verified multi-factor authentication method. When an operator enters a customer workspace through our support tool, that session is logged server-side and the log cannot be altered by the operator. Direct database access by those operators is restricted to the same people and is not logged per query.

6. Security

We implement appropriate technical and organisational measures to protect personal data, as Article 32 of the UK GDPR requires. Annex 2 describes them. We may update those measures, provided the overall level of protection doesn't fall.

7. Sub-processors

In short: we use a small number of suppliers to run Fixray. They're listed, and we tell you before we add one.

You give us general authorisation to engage the sub-processors listed in Annex 3A. If we intend to add or replace one, we'll give you at least 30 days' notice by email or in the app. If you reasonably object on data protection grounds within that period, we'll work with you in good faith to find an alternative. If we can't, you may end the affected part of the service without penalty and we'll refund any prepaid fees for it, pro rata.

We impose data protection obligations no less protective than this agreement's on every sub-processor, except two with no data processing agreement in place today: GitHub, whose Data Protection Agreement does not cover our current account (Annex 3A), and Apple for notifications to the Fixray iPhone app, which offers no data processing agreement for its push notification service. We remain fully liable to you for every sub-processor's performance, theirs included.

Notifications to the Fixray iPhone app go through Apple's push notification service, which receives the notification text, so Apple is a sub-processor for them and is listed in Annex 3A. Apple receives the text of your organisation's notifications only once you have agreed to it in writing, or you accepted this version of this agreement when you signed up, or 30 days have passed since we notified you of Apple's addition. Until then it receives only the device token, a fixed alert that reads the same for every notification, the link the app opens, an opaque key that groups notifications about the same issue, and a delivery priority.

Web Push notifications reach your users' browsers through the push service built into the browser or operating system (Apple, Google or Mozilla, depending on the device). We encrypt each Web Push notification to the device before it leaves us (RFC 8291), so the push service carries only an opaque device address and content it cannot read. That push service acts as a communications carrier chosen by the device, not as our sub-processor, and is listed in Annex 3C for transparency.

8. Helping you with data subject rights

Your administrators can view and correct records and remove people from your workspace in the app. Your users can delete their own Fixray accounts in the app, unless they are your organisation's only administrator while others still use it (they make someone else an administrator first) or the only member of an organisation on a paid plan (they cancel the plan first). Their name, email and photo are then replaced with anonymous placeholders straight away, and the records they created stay in your workspace. If the last remaining user deletes their account, the organisation is closed and handled as in §11. On the Plus and Pro plans your administrators can also export issue records as CSV or PDF. On the Free plan, your administrators can't view a locked issue (Terms §5) in the app until you upgrade. We include it in any copy of your data you ask for, and we'll act on a data subject request that concerns it within 30 days. For anything else, including a full copy of your data or deletion of your whole organisation, your administrator can email hello@fixray.app and we act within 30 days. Anyone who can't sign in can email us the same way.

Beyond that, we'll give you reasonable help with data subject requests, taking into account the nature of the processing. If a data subject contacts us directly about data in your workspace, we won't respond on the substance; we'll pass the request to you promptly.

9. Breaches, impact assessments, and regulators

Personal data breaches. If we become aware of a personal data breach affecting your personal data, we'll notify you without undue delay, and in any event within 72 hours of becoming aware of it. We'll describe, as far as we know them: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point. Where we can't provide everything at once, we'll provide it in phases without undue delay. We won't make a public statement or a regulator notification that identifies you without consulting you first, unless the law requires it.

Impact assessments. We'll give reasonable help with data protection impact assessments (Article 35) and prior consultation with the Information Commissioner's Office (Article 36), taking into account the nature of the processing and the information available to us.

Complaints. Where you receive a data protection complaint under the complaints process introduced by the Data (Use and Access) Act 2025 that relates to processing we carry out for you, we'll give reasonable help with your investigation.

10. International transfers

Your workspace data is hosted in the United Kingdom (Supabase on AWS, London, eu-west-2). Our encrypted off-site backups are held by Cloudflare, which may store them outside the UK and EU.

AI features send the content involved to OpenRouter (United States), which routes it to Google Gemini. Every request requires zero data retention and excludes providers that store or train on data; the request fails rather than fall back. This transfer relies on the UK Addendum to the EU Standard Contractual Clauses.

Other sub-processors that process personal data outside the UK are identified in Annex 3A. Where we make a restricted transfer, we rely on a safeguard Data Protection Law permits: the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations where they apply. We carry out a transfer risk assessment before relying on those safeguards. There are two exceptions, both named in §7. GitHub has no transfer safeguard in place until we move to an account its Data Protection Agreement covers. Apple offers none for its push notification service, so notifications to the Fixray iPhone app reach Apple without one. You instruct us to make these transfers to the extent needed to provide the service.

11. Deletion and return

You can ask us for a copy of your data at any time, and on the Plus and Pro plans you can also export issue records in the app. A copy you ask for includes locked issues. If you ask in writing before deletion, we'll return your personal data in a commonly used, machine-readable format.

After your organisation's account is closed, we keep your data for 30 days so you can reactivate it or ask for a copy; at the end of that period we delete it, and backup copies are removed within a further 90 days. A request to delete your whole organisation is honoured within 30 days on the same basis. When one of your users deletes their own account, their personal details are anonymised straight away and backup copies are removed within a further 90 days. We keep an internal audit record of the deletion, including the person's original name and email, for 12 months, then remove those identifiers automatically. We keep data longer only where the law requires it, or as described here.

12. Audit and information

We'll make available the information reasonably needed to demonstrate our compliance with Article 28, including this agreement, Annex 2, and answers to reasonable security questionnaires.

If that isn't enough, you may audit us, or appoint an independent auditor who isn't our competitor and who signs a confidentiality undertaking, subject to: 30 days' written notice; no more than once in any 12-month period (unless a regulator requires it or it follows a personal data breach); normal business hours; and no disruption to the service or to the confidentiality of other customers' data. You bear your own costs of an audit, and we bear ours unless the audit reveals a material breach by us.

13. Liability

Each party's liability under this agreement is subject to the limitations and exclusions in the Agreement, except where Data Protection Law prohibits limiting it.

14. Duration and general

This agreement applies for as long as we process personal data on your behalf. The obligations that by their nature should survive (confidentiality, deletion, liability) continue afterwards. This agreement is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1 – Details of the processing

Annex 2 – Technical and organisational security measures

Measures in place on the date this agreement was last updated. We may update them, provided the overall level of protection doesn't fall.

• Hosting and data location. The service runs on Supabase (Postgres, authentication, file storage and server functions) in AWS's London region (eu-west-2). The web app and marketing site are served through Cloudflare.
• Tenant isolation. Fixray is multi-tenant. Separation between customer organisations is enforced in the database with PostgreSQL row-level security policies on the tables holding customer data, not by filtering in the app alone.
• Encryption. Traffic is encrypted in transit with TLS, with HTTPS enforced (HSTS) on every surface. Data is encrypted at rest by our hosting provider. Off-site backups are encrypted on the backup runner before upload, and the plaintext copy is destroyed within minutes.
• Access control. Within your workspace, role-based permissions (reporter, fixer, manager, organisation administrator) are controlled by your own administrators. Multi-factor authentication is available to users; it is not enforced unless your organisation turns the requirement on. Our own operators must hold a verified factor. New and changed passwords are checked against a database of known breached passwords. Administrative access to production is limited to authorised Fixray personnel.
• Authentication. Authentication is provided by Supabase Auth. Passwords are stored hashed and salted; we never store or can retrieve them in plain text.
• Abuse protection. Guest reporting is protected by Cloudflare Turnstile and rate limits. Submitter IP addresses are stored only hashed with a secret key and deleted after 14 days.
• Secure development. Changes are version-controlled. Every change is reviewed before release by an automated review step independent of its author, and gated on automated checks: secret scanning, static analysis, dependency checks, rules targeting tenant-isolation and data-exposure patterns, and tests of access-control behaviour. Database schema changes are applied only after those checks pass.
• Security review. We run a recurring automated audit of database access policies, privileged database functions, storage permissions and API authorisation, and triage findings by severity.
• Backup and recovery. The production database is backed up daily by our hosting provider. A separately encrypted copy is also written daily to off-site storage with a different provider, and restores are documented and tested (most recently July 2026). Point-in-time recovery is not enabled, so a restore may lose up to 24 hours of changes.
• Monitoring. An external service checks availability continuously and alerts us when something stops responding; a public status page runs at status.fixray.app. Application errors are captured by an error-tracking service. Issue activity keeps a database audit trail.
• Continuity. A release reaches production only after its checks pass; a failed release leaves the last good version serving. Earlier versions can be redeployed from the hosting provider's history.
• Personnel. Fixray is run by a small team. Everyone with access to production data is bound by confidentiality obligations and given access on a need-to-know basis.
• Deletion. An organisation's data is deleted within 30 days of a verified request to delete it, or at the end of the 30 days after its account is closed. A user who deletes their own account in the app is anonymised straight away; an internal audit record of the deletion, including the person's original name and email, is kept for 12 months, then those identifiers are removed automatically. Backup copies are removed within a further 90 days.

Annex 3 – Sub-processors and other providers

3A. Sub-processors of your workspace data

The sub-processors §7 authorises. We give 30 days' notice before adding or replacing one.

3B. Providers for data we process as controller

Listed for transparency. Fixray is the controller for this data (DPA §1 and our privacy policy); these are not sub-processors under this DPA and §7 does not apply to them.

3C. Communication services (not sub-processors)

Listed for transparency. These services carry Web Push notifications Fixray has encrypted to your users' devices; they act as carriers chosen by the device, not as our sub-processors (§7).

Provider list last updated: 5 November 2026.