Data processing agreement
Version 19 October 2026 · Cross Compliance Training Limited
This agreement forms part of the RiskRoster SaaS terms between the subscribing customer (controller) and Cross Compliance Training Limited (processor). It takes priority over conflicting service terms for the processing of customer workforce personal data.
Processing schedule
Subject and purpose: hosting and administering workforce training, requirements, certificate evidence, reports, searches and renewal communications on the customer’s behalf. Operations include collection, storage, organisation, retrieval, transmission, export and deletion.
Duration: the service period and the limited time needed for instructed return or deletion. People: employees, contractors, customer team users and business contacts entered by the customer. Data: names, work contact details, roles, employer, photos where supplied, training history, qualification identifiers, dates, certificates and activity records. Special category data is not required: do not upload medical details or other sensitive data unless separately agreed with appropriate safeguards.
1. Instructions and controller obligations
The customer determines lawful purposes, provides privacy information, establishes lawful bases, minimises uploads and controls authorised users. Its use of platform functions and written support requests are documented instructions. We process data only on those instructions, including for transfers, unless UK law requires otherwise; we will inform the customer of that requirement before processing unless legally prohibited. We will immediately notify the customer if an instruction appears to infringe applicable data protection law.
2. Confidentiality and security
We will ensure that persons authorised to process customer data are bound by confidentiality and limit their access to the service tasks they need to perform. We will implement appropriate technical and organisational measures under Article 32, proportionate to risk, addressing confidentiality, integrity, availability, resilience, restoration and regular assessment of effectiveness.
The application includes company membership access controls, sign-in, permission management, private certificate access and workspace exports. These controls do not constitute an independent security certification. Provider configuration must be assessed alongside application controls.
3. Service providers and transfers
The service uses Supabase for authentication, database and files; Cloudflare for application hosting; and Stripe for subscription payments. Stripe’s independent payment processing is described in the privacy notice. A complete processing schedule must identify any email-delivery and other providers with access to workforce data.
Operational schedule awaiting confirmation: the configured database region, provider legal entities and processing locations, email-delivery provider, transfer safeguards, backup retention and recovery arrangements have not yet been verified for publication. No UK-only or EU-only hosting commitment is made. Request the completed schedule before uploading data subject to those requirements.
The customer grants general written authorisation for the listed workforce processing services. We will notify the customer at least 30 days before adding or replacing a sub-processor, allowing a reasonable data protection objection. We will work to resolve an objection or allow termination of the affected service with a refund of unused prepaid fees. We will impose equivalent data protection obligations by written contract and remain responsible for our sub-processors’ performance. Restricted international transfers require an applicable adequacy decision or valid safeguards, including a UK IDTA or UK Addendum where appropriate; a provider’s presence in this list alone does not establish those safeguards.
4. Rights and regulatory assistance
Taking account of the nature of processing and information available, we will provide appropriate technical and organisational assistance with individual rights requests, security obligations, breach assessment and notification, DPIAs and prior consultation with the ICO. We will forward relevant requests received from individuals to the customer and will not respond substantively except on instructions or as required by law.
5. Personal data breaches
We will notify the customer without undue delay after becoming aware of a personal data breach affecting its data. We will supply available information on the nature of the breach, affected people and records, likely consequences, contact point and remedial measures, with updates as more becomes known. The customer remains responsible for its regulatory and individual notifications.
6. Return and deletion
At the customer’s choice, we will return or securely delete personal data at the end of the service and delete remaining copies unless UK law requires retention. The customer can export workspace records and separately download certificates; support can assist with a return request. Any data retained solely in backups must be isolated from ordinary use and deleted on the applicable retention cycle. The cycle and completion arrangements must be confirmed in the operational schedule; no specific backup deletion period is represented here.
7. Evidence and audits
We will make available information needed to demonstrate compliance with Article 28 and allow and contribute to customer or appointed-auditor inspections. Practical arrangements will protect other customers’ data and system security without preventing legally required access or urgent investigation. Nothing in this agreement relieves either party of its own statutory obligations.
Registered in England and Wales, number 12076785. Registered office: 82 Pascal Close, Corby, Northamptonshire, NN17 4AG.