Data Processing Agreement

1. Agreement overview

This Data Processing Agreement (“DPA”) sets out how personal data and client information are processed, protected, accessed and controlled in connection with the HSEQ ConsultHub software platform. It is written for the consultancy firm. It is not annexed as a client organisation’s processor terms. A signed client contract may name different processor terms. It applies between HSEQ ConsultHub Ltd and each approved consultancy firm that uses the platform, whether or not a separate signed copy of this DPA exists, and sits alongside the Consultancy Platform Agreement, the published Terms of Service, the End-Client Access Terms, the Verification Access Terms and the Privacy Policy.

HSEQ ConsultHub Ltd provides the platform infrastructure, consultancy and client workspaces, workflows, reporting tools and access controls. It does not offer professional advice. The consultancy firm remains responsible for its professional advice, client relationship, service delivery, client onboarding decisions and any instructions it gives about the use of client information within the platform. Completing a workflow or signing an agreement does not certify legal compliance. The client organisation remains the duty holder for its own operations.

2. Parties and roles

For the purposes of this DPA, HSEQ ConsultHub Ltd (“HSEQ ConsultHub”) is the platform provider and processor where it processes personal data on behalf of an approved consultancy firm. The consultancy firm is normally the controller in relation to its consultants, client users, client workspaces, client instructions, service records and professional use of platform data. End-client businesses and Verification registrants may also act as controllers in relation to personal data they provide or upload, depending on their own use of the platform and their contract with the consultancy firm.

3. Scope of processing

HSEQ ConsultHub will process personal data only to provide, maintain, secure and support the platform. Processing may include creating consultancy workspaces, setting up client workspaces, managing consultant and client user accounts, recording module activity, generating reports, managing health checks, handling support request workflows, operating Verification, calculating platform usage and maintaining audit records.

The platform is not a substitute for professional consultancy judgement. HSEQ ConsultHub Ltd does not independently verify the legal accuracy, completeness or suitability of client-provided information unless a separate written service has been agreed.

4. Categories of data

• Consultancy account information, including company name, administrator details, consultant users and billing contact details.
• Client workspace information, including client organisation details, named users, role permissions, uploaded or entered compliance information and module activity.
• Platform usage information, including logins, module use, report generation, support requests and audit trail events.
• HSE and quality workflow information, including hazard and incident reports, actions, inspections, health check responses, root cause analysis records, controlled documents, training and competence records, asset and plant records, Verification evidence and reporting data.
• Limited technical information required for security, diagnostics, authentication, audit history and platform performance monitoring.

5. Processing instructions

HSEQ ConsultHub will process personal data only on documented instructions from the consultancy firm, unless required to do otherwise by applicable law. The consultancy firm’s instructions include configuration settings, user permissions, client onboarding choices, module allocation, support request settings, reporting activity, Verification routing and any written instructions provided through the platform or agreed commercial documents.

If HSEQ ConsultHub believes that an instruction infringes applicable data protection law, it may suspend the relevant processing activity and notify the consultancy firm, unless prohibited from doing so by law.

6. Security measures

HSEQ ConsultHub will implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure. These measures must be proportionate to the nature of the platform, the categories of data processed and the risks associated with a multi-consultancy compliance environment.

• Consultancy-space isolation so that each consultancy firm’s users can access only their own workspace, users, clients, reports and billing data, enforced by membership and role checks rather than by a separate database per consultancy.
• Role-based access controls for consultancy administrators, consultants, client administrators and report-only users.
• Secure authentication, including password hashing, session cookies or device tokens, optional MFA and step-up checks for privileged owner actions.
• Audit records for authentication events, key administrative changes, Verification decisions and selected operational activity. Not every user action is logged.
• Hosted database backups and recovery depend on the PostgreSQL provider configuration for that environment. This DPA does not claim a separately tested, published backup runbook for every deployment.
• Access limitation for HSEQ ConsultHub personnel and contractors on a need-to-know basis, including an audited time-limited impersonation path for client-user support that requires a written reason.

7. Confidentiality

HSEQ ConsultHub will ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations. The consultancy firm must ensure that its own consultants, administrators and client-facing users are authorised, trained where appropriate and subject to suitable confidentiality obligations in relation to client information accessed through the platform.

8. Sub-processors

HSEQ ConsultHub may appoint sub-processors to support hosting, infrastructure, email, payments, monitoring, rate limiting, communications, support or related platform services. HSEQ ConsultHub will ensure that each sub-processor is bound by written obligations that provide an appropriate level of data protection and confidentiality. HSEQ ConsultHub remains responsible for the performance of its sub-processors in relation to processing carried out on behalf of the consultancy firm.

The current material sub-processors are listed in the Privacy Policy. HSEQ ConsultHub Ltd will update that list before a new material sub-processor starts processing personal data on behalf of consultancy firms. The consultancy firm may object in writing within 14 days of that update. If the parties cannot resolve the objection, the consultancy firm may stop using the affected processing, including by terminating the relevant platform services, without using the objection to demand a change that would affect other consultancies.

9. Data subject rights and DPIAs

Taking into account the nature of the processing, HSEQ ConsultHub will provide reasonable assistance to the consultancy firm to help respond to data subject rights requests relating to personal data processed through the platform, including access, correction, deletion, restriction, portability or objection requests where those requests relate to data held within the platform.

HSEQ ConsultHub will also provide reasonable assistance with data protection impact assessments and prior consultation with a supervisory authority, where the consultancy firm’s use of the platform makes that assistance necessary and the consultancy firm makes a written request.

The consultancy firm remains responsible for determining whether and how to respond to data subject requests from its consultants, client users or end-client contacts, unless HSEQ ConsultHub has a direct controller obligation under applicable law.

10. Personal data breaches

HSEQ ConsultHub will notify the consultancy firm without undue delay, and in any event within 48 hours of becoming aware, of a personal data breach affecting personal data processed on behalf of the consultancy firm. The notification will include, where available, a description of the nature of the breach, the categories of data affected, likely consequences and measures taken or proposed to address the breach.

The consultancy firm remains responsible for deciding whether notification to any regulator, end client or affected individual is required, unless HSEQ ConsultHub has a separate legal duty to notify.

11. International transfers

HSEQ ConsultHub will not transfer personal data outside the United Kingdom or European Economic Area unless appropriate safeguards are in place. Where an international transfer is required, HSEQ ConsultHub will use a recognised transfer mechanism, such as standard contractual clauses, an adequacy decision or another lawful transfer basis under applicable data protection law.

12. Deletion and return of data

On expiry or termination of the relevant platform services, the consultancy firm may give a written instruction to return or delete personal data processed on its behalf. HSEQ ConsultHub will complete that return or deletion within 90 days, except where UK or other applicable law requires HSEQ ConsultHub Ltd to retain a copy. Return is provided through the organisation export function where that function is available, or otherwise by a reasonable alternative agreed in writing.

While a client workspace is archived, access is withdrawn immediately. Client-owned files and operational records for that client become due for permanent deletion 12 months after archive, unless a legal hold or other lawful retention applies. Consultant papers created for that client stay on HSEQ ConsultHub for five years from archive and are not included in a client hop. Demonstration sandbox documents become due for deletion three days after upload. Organisation export download packages expire.

Deleting a named user removes that person’s login and membership. It does not delete consultant or client operational records they created or were assigned. Those records stay with the workspace, with the user link reassigned or cleared. Subject access requests and Organisation Migration remain separate workflows. Credentials, PINs, QR tokens, sessions and reusable storage URLs are not exported.

13. Audit and compliance support

HSEQ ConsultHub will make available reasonable information necessary to demonstrate compliance with this DPA, taking into account the size and maturity of the platform, the confidentiality of security controls and the need to protect other consultancy workspaces. Any audit or inspection must be agreed in advance, be limited to relevant processing activities and avoid disruption to the platform or other users.

14. Responsibilities of the consultancy firm

The consultancy firm must:

• Ensure it has a lawful basis for uploading, entering or otherwise processing personal data in the platform.
• Ensure client users and report-only users are authorised and given suitable access permissions.
• Maintain accuracy of client, user and workspace information.
• Use platform reports, health checks and data outputs as professional support tools, not as a replacement for competent advice.
• Inform end clients of the End-Client Access Terms, Privacy Policy and data handling responsibilities.
• Promptly disable access for users who no longer require access.
• Ensure that any support request or report generated through the platform is reviewed within the consultancy’s agreed service process.

15. Schedule 1 — Processing details

16. Schedule 2 — Minimum security controls

• Consultancy-space data separation enforced in application authorisation.
• Role-based permissions for consultant, client and report-only users.
• Secure authentication controls and user access management.
• Audit logging for key platform activity as implemented.
• Administrative access restricted to authorised HSEQ ConsultHub personnel, with audited impersonation for client support.
• Provider-hosted database backup according to the hosted PostgreSQL configuration.
• Security incident response procedures.
• Periodic review of access rights, security controls and sub-processor arrangements.

17. Governing law

This Data Processing Agreement is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any dispute arising out of or in connection with it, except that HSEQ ConsultHub Ltd may seek injunctive or other relief in any court of competent jurisdiction to protect its intellectual property, confidential information or platform security.