Data Processing Agreement

1.1 This Data Processing Agreement ("DPA") is between EdinPro Digital Ltd, trading as GarageCloud ("GarageCloud", "we", "us", "our") and the business that holds a GarageCloud subscription ("you", "your").

1.2 EdinPro Digital Ltd is a private limited company registered in Scotland under company number SC906556. Our registered office is 11 Muir Place, Livingston, EH54 5BF. ICO registration number: C2081384. Email: [email protected].

1.3 This DPA forms part of the GarageCloud Terms of Service ("Terms") and applies whenever we process personal data on your behalf in providing the Service. It meets the requirements of Article 28 of the UK GDPR.

1.4 If this DPA conflicts with the Terms on anything to do with Your Personal Data, this DPA takes priority. If it conflicts with an IDTA or the Addendum, the IDTA or the Addendum takes priority.

2.1 Words defined in the Terms have the same meaning in this DPA. In addition:

• Addendum means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the ICO under section 119A of the Data Protection Act 2018.

• Controller, Processor, Data Subject, Personal Data, Processing and Supervisory Authority have the meanings given in the UK GDPR.

• IDTA means the International Data Transfer Agreement issued by the ICO under section 119A of the Data Protection Act 2018.

• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Your Personal Data.

• Restricted Transfer means a transfer of Your Personal Data from the UK to a country outside the UK that is not covered by UK adequacy regulations, including remote access from that country.

• Sub processor means any third party we engage to process Your Personal Data.

• Your Personal Data means the personal data within Your Data that we process on your behalf, as described in Schedule 1.

3.1 For Your Personal Data, you are the Controller and we are your Processor.

3.2 We act as a Controller, not a Processor, for personal data about you and your Authorised Users that we use to manage your Account, billing, support and service updates. Our Privacy Policy covers that data and this DPA does not apply to it.

3.3 When you connect a Third Party Service, such as your own payment, accounting, email, messaging or AI provider account, the provider of that service is not our Sub processor. Data passes to it on your instruction and your contract with that provider governs its processing.

3.4 Schedule 1 sets out the subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects.

4.1 You must:

• have a lawful basis for all Personal Data you put into the Service and for your instructions to us;

• give your End Customers and staff the privacy information the law requires, including that you use GarageCloud and its Sub processors;

• obtain any consent needed for marketing messages under the Privacy and Electronic Communications Regulations 2003;

• not upload special category data or criminal offence data unless you have a lawful condition for it and it is needed for the job; and

• deal with requests and complaints from Data Subjects about your use of their data.

4.2 You confirm that your instructions to us comply with Data Protection Laws.

5.1 We will process Your Personal Data only on your documented instructions, including for Restricted Transfers, unless the law requires otherwise. If it does, we will tell you before processing unless the law prohibits that.

5.2 Your instructions are set out in the Terms, this DPA and the way you configure and use the Service. You instruct us to process Your Personal Data to provide, secure and support the Service and to create the anonymised statistics described in clause 11.6 of the Terms.

5.3 We will tell you promptly if, in our opinion, an instruction breaches Data Protection Laws. We may suspend that instruction until it is confirmed or changed.

6.1 We will make sure that everyone we authorise to process Your Personal Data is bound by a duty of confidentiality, is trained in data protection and has access only to the data needed for their role.

7.1 We will put in place and maintain appropriate technical and organisational measures to protect Your Personal Data, as required by Article 32 of the UK GDPR. Our current measures are set out in Schedule 2.

7.2 We may update these measures over time, as long as the overall level of protection is not reduced.

8.1 You give us general authorisation to engage Sub processors. Our current Sub processors are listed in Schedule 3 and on our website at garage-cloud.co.uk.

8.2 We will give you at least 30 days' notice by email before adding or replacing a Sub processor. You may object on reasonable data protection grounds within that period. If we cannot address your objection, you may end your subscription before the change takes effect and we will refund any Fees paid in advance for the unused period.

8.3 We will put a written contract in place with each Sub processor that gives Your Personal Data the same level of protection as this DPA.

8.4 We remain fully liable to you for the performance of each Sub processor's obligations.

9.1 Your Personal Data is hosted by Amazon Web Services in its Stockholm region in Sweden. Sweden is in the European Economic Area, which is covered by UK adequacy regulations.

9.2 Some of our development and support staff are employees of EdinPro Digital Ltd based in the Philippines. They can access Your Personal Data only where access is needed and has been granted, and clause 6 applies to them. As they are our own employees, this access is not a transfer to a separate organisation, and we protect it with the same security measures that apply in the UK. Some Sub processors are based in or process data in the United States, which involves Restricted Transfers.

9.3 We will make a Restricted Transfer only where one of the following applies:

• the destination is covered by UK adequacy regulations, including the UK Extension to the EU US Data Privacy Framework where the recipient is certified under it;

• we have entered into an IDTA or the Addendum with the recipient and carried out a transfer risk assessment; or

• another lawful transfer mechanism under Data Protection Laws applies.

9.4 Schedule 3 shows the safeguard used for each Sub processor. You may ask for a copy of the relevant transfer terms, which we may redact to protect commercial information.

9.5 We assess Restricted Transfers against the data protection test for international transfers introduced by the Data (Use and Access) Act 2025.

10.1 The Service includes tools that let you find, correct, export and delete Your Personal Data. You should use these to respond to Data Subject requests.

10.2 If we receive a request directly from one of your End Customers or staff, we will pass it to you within 5 Working Days and will not respond ourselves except to tell them we have done so.

10.3 Where the tools are not enough, we will give you reasonable help to respond to requests. We may charge a reasonable fee for help that goes beyond what the Service normally provides.

11.1 Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your obligations on security, Personal Data Breach notification, data protection impact assessments and prior consultation with the ICO, under Articles 32 to 36 of the UK GDPR.

12.1 We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Your Personal Data.

12.2 Our notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the steps taken or proposed. We will send further information as it becomes available.

12.3 We will take reasonable steps to contain and investigate the breach. You are responsible for deciding whether to notify the ICO within 72 hours and whether to tell affected Data Subjects. We will not notify them on your behalf unless you ask us to or the law requires it.

12.4 Notifying you of a breach is not an admission of fault or liability.

13.1 When your subscription ends, you can export Your Personal Data for 30 days as set out in clause 20.2 of the Terms.

13.2 After that period we will delete Your Personal Data from our live systems, and from our backups within 35 days, unless the law requires us to keep it. Any data we must keep will remain protected by this DPA. We will confirm deletion in writing on request.

14.1 We will make available the information reasonably needed to show that we comply with Article 28 of the UK GDPR, including summaries of our security measures and relevant certifications of our hosting provider.

14.2 If that information is not enough, you may audit our compliance, either yourself or through an independent auditor bound by confidentiality, on at least 30 days' written notice, no more than once in any 12 month period, during normal business hours and at your own cost.

14.3 Further audits are allowed after a Personal Data Breach affecting Your Personal Data or where the ICO requires one.

14.4 Audits of our Sub processors will be carried out through the audit reports and certifications they make available.

15.1 Each party's total liability under or in connection with this DPA is limited to the greater of (a) twice the Fees paid and payable by you in the 12 months before the event giving rise to the claim and (b) £25,000. This cap is separate from the cap in clause 22.5 of the Terms. Clauses 22.1 and 22.2 of the Terms also apply to this DPA.

15.2 Nothing in this DPA limits either party's liability to Data Subjects under Article 82 of the UK GDPR.

16.1 This DPA lasts for as long as we process Your Personal Data, including after your subscription ends.

16.2 We may update this DPA where needed to reflect changes in Data Protection Laws or ICO guidance, or changes to the Service. Changes are made in the same way as changes to the Terms under clause 25.

16.3 This DPA is governed by the law of Scotland and the courts of Scotland have exclusive jurisdiction, except where an IDTA or the Addendum requires otherwise.

Data protection questions: [email protected]. EdinPro Digital Ltd, trading as GarageCloud. Registered in Scotland, company number SC906556. Registered office: 11 Muir Place, Livingston, EH54 5BF.

Our development and support staff in the Philippines are employees of EdinPro Digital Ltd, not Sub processors. See clause 9.2.

Third Party Services you connect yourself, such as Stripe, PayPal, Square, SumUp, Klarna, Xero, QuickBooks, Sage, FreeAgent, Microsoft 365, Gmail, your own SMTP, Twilio or GoHighLevel account, What3Words and the AI provider you connect for AI features, are not our Sub processors. See clause 3.3.