Data processing agreement (DPA)

When you use Simple Certificate Tracker to store employee and certificate records, you are typically the data controller and Simple Certificate Tracker acts as your data processor.

Roles

• You (customer): You are the data controller for employee and certificate data you enter. You decide what to record, how long to keep it, and whether it is accurate.
• Simple Certificate Tracker: Simple Certificate Tracker acts as a data processor when storing and processing that data on your behalf to provide the service.

What we process on your behalf

• Employee names and optional contact details you enter.
• Certificate and training records, dates, and notes.
• Certificate documents you upload (Premium).
• Audit log entries (Premium) — who changed records and when.

Our obligations as processor

• Process personal data only on your documented instructions (using the product as intended).
• Keep data confidential and limit access to authorised personnel.
• Implement appropriate technical and organisational security measures (see Security).
• Assist with data subject requests where feasible.
• Notify you of personal data breaches without undue delay where legally required.
• Use sub-processors listed on our sub-processor page.
• Delete or return personal data on termination, subject to our retention policy.

Your obligations as controller

• Ensure you have a lawful basis to record employee certificate data.
• Provide privacy information to your employees where required.
• Keep data accurate and delete records you no longer need.
• Use strong passwords and restrict account access within your organisation.

Sub-processing

We engage sub-processors to provide hosting, database, email, payments, and analytics. The current list is published at /sub-processors. We will update that page if sub-processors change materially.

Data location

Production infrastructure should be configured with UK or EU regions where available. Contact us if you need written confirmation of your deployment region for procurement records.

Term and termination

Processing continues while your account is active. On cancellation or deletion request, we delete or anonymise personal data within 90 days unless retention is required by law. Export your data before closure using printable reports (all plans) or CSV export (Premium).

Request a signed DPA

This page is a summary for transparency and AI/search discoverability. For a countersigned DPA copy for your records, email bluehammy122@gmail.com with your organisation name and billing contact.