28 October 2026
Data Processing Agreement
This agreement is between Venguard Ltd and each customer that uses the Venguard platform. It is part of our Terms of Service.
It applies from the moment the customer first adds personal data to the platform, including during sign-up and any free trial. It lasts for as long as we hold that data.
It meets the rules for processor contracts in Article 28 of the UK GDPR. If it conflicts with the Terms on data protection, this agreement wins.
We can sign a copy if the customer asks. Email info@venguard.co.uk.
Who does what
The customer is the controller. It decides why and how personal data on the platform is used.
Venguard Ltd is the processor. We run the platform for the customer.
The customer must have a lawful basis for the data it puts on the platform, and must tell people how their data is used.
What we process
Purpose. To provide the platform: plans, public concern reports, alerts, training records, drills, evidence and audit records.
People. Customer staff, members of the public who report a concern, venue emergency contacts, and other people named in venue records.
Data. Names, work contact details, roles, sign-in and audit records, PIN hashes, training records, time on site at a venue, push tokens and device details, concern reports, chat messages, photos and videos, and uploaded documents.
Concern reports may describe a suspected crime or a person's health. The customer must have a lawful basis for that data too, and should not ask for more than it needs.
Duration. For as long as the customer's account is active, and then until we delete the data as set out below.
Following instructions
We only process customer data on the customer's documented instructions. This agreement, the Terms and the customer's use of the platform settings are those instructions.
We will tell the customer if we think an instruction breaks data protection law.
If the law makes us process data in another way, we will tell the customer first, unless the law stops us.
We do not use customer data for our own purposes, and we do not sell it.
Our staff
Only Venguard staff who need access to support the customer or run the platform can see customer data. They are bound by confidentiality.
Each time a Venguard staff member opens a customer's account, we log it.
Security
We protect customer data with measures that fit the risk. These include:
- Hosting in the UK on Amazon Web Services, region eu-west-2.
- Encrypted connections, and encryption of stored data and files.
- Each customer's data kept separate from other customers.
- Role-based access, so staff only see what their role allows.
- Audit logs of key actions.
- Database backups, kept for 7 days.
We review these measures and may change them, as long as protection does not get weaker.
Sub-processors
The customer agrees that we may use sub-processors to run the platform. The current list is in our Privacy Policy.
We will email the account contact at least 30 days before we add or replace a sub-processor. If we must change one urgently to keep the service running, we will tell the customer as soon as we can.
The customer can object on reasonable data protection grounds. If we cannot resolve it, the customer may end its plan. We will refund fees already paid for the time after the plan ends.
Each sub-processor must agree to data protection duties at least as strong as ours. We are responsible to the customer for what our sub-processors do.
Data outside the UK
Customer data is stored in the UK. Some sub-processors work outside the UK, as set out in the Privacy Policy.
We only send customer data outside the UK when UK law allows it. That means the UK-US data bridge, the UK International Data Transfer Agreement or Addendum, or another lawful way.
Helping the customer
If someone asks us to see, change or delete their data, we will pass it to the customer and not reply ourselves, unless the customer asks us to.
We will help the customer answer those requests, mainly through the platform's own tools.
We will help with data protection impact assessments and with questions from the Information Commissioner's Office, as far as is reasonable.
Data breaches
If we find a personal data breach affecting customer data, we will tell the customer without undue delay, and within 48 hours.
We will say what happened, what data and people are affected, and what we are doing about it. We will share more detail as we learn it.
We will help the customer report the breach to the ICO and tell affected people, if the law requires it.
When the account ends
The customer has 90 days to export its records.
After that we delete the customer's data from the platform. Copies in backups are deleted within a further 7 days.
We only keep data longer if the law requires it. We will keep it secure and only use it for that reason.
Showing we comply
We will give the customer the information it reasonably needs to show we meet this agreement.
The customer may audit us, or appoint an independent auditor to do so. It must give 30 days' notice, and may audit once a year, unless there has been a breach or a regulator asks for it.
Audits must keep other customers' data and our security safe. Each side pays its own costs.
Liability
The liability limits in our Terms of Service apply to this agreement.
Changes
We may update this agreement when the law or the service changes. We will email the account contact about any change that affects how we protect customer data. We will not make protection weaker.