Data Processing Terms
Version 1.1 · Last updated 11 October 2026
These Data Processing Terms form part of the Terms of Use between LCS Project Solutions Ltd, trading as Science of Compliance ("we", "us"), and the business that holds a company account (the "Customer"). They form the contract required by Article 28 of the UK GDPR. Words defined in the Terms of Use have the same meaning here.
1. Roles
1.1 For Customer Content that contains personal data, the Customer is the controller and we are the processor.
1.2 For account details, billing records, security logs and support correspondence, we are the controller, as described in our Privacy Policy. These Data Processing Terms do not apply to that information.
1.3 The details of the processing (subject matter, duration, nature, purpose, types of personal data and categories of people) are set out in Annex 1.
2. Customer instructions
2.1 We will process Customer Content only on the Customer's documented instructions. The Customer's instructions are:
- these Data Processing Terms and the Terms of Use;
- the Customer's use and settings of the Service, for example creating, editing, issuing, sharing and deleting reports;
- any other reasonable written instructions the Customer gives us that are consistent with the Service.
2.2 This does not apply where the law requires us to process Customer Content in another way. In that case we will tell the Customer before processing, unless the law prevents us from doing so.
2.3 We will tell the Customer straight away if we think an instruction breaks data protection law. We may then pause the processing concerned until the instruction is confirmed or changed.
2.4 We will not:
- sell Customer Content;
- use it for advertising;
- use it to train AI models;
- use it for any purpose other than providing, securing and supporting the Service.
3. Customer obligations
3.1 The Customer is responsible for:
- having a lawful basis for the personal data it collects and puts into the Service;
- giving people the privacy information they need, for example telling people on site that photos and recordings are being taken;
- making sure its instructions to us are lawful.
3.2 The Customer should keep personal data in reports to what is needed. In particular, it should not include health information about identifiable people, or information about criminal offences, unless this is necessary and it has a lawful basis. This includes incident details that name injured people.
3.3 The Customer is responsible for managing its own users. This includes removing access for people who leave.
4. Confidentiality
4.1 We will make sure that anyone we authorise to process Customer Content is bound by a duty of confidentiality. Access is limited to people who need it to provide, secure or support the Service.
5. Security
5.1 We will keep appropriate technical and organisational measures to protect Customer Content against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
5.2 The current measures are described in Annex 3. We may update them over time, but will not reduce the overall level of protection.
6. Sub-processors
6.1 The Customer gives a general authorisation for us to use the sub-processors listed in Annex 2.
6.2 Before adding or replacing a sub-processor that will process Customer Content, we will:
- update Annex 2;
- email the Customer's administrators at least 30 days in advance.
6.3 The Customer may object on reasonable data protection grounds within that 30-day period. We will discuss the objection in good faith. If we cannot resolve it, the Customer may close its account. In that case, we will refund any fees paid in advance for the period after closure.
6.4 We will have a written contract with each sub-processor that gives Customer Content at least the same protection as these Data Processing Terms.
6.5 We remain responsible to the Customer for the work of our sub-processors.
7. International transfers
7.1 Customer Content is stored in the United Kingdom, and our application server runs in the European Union. Some sub-processors in Annex 2 are based in, or may access data from, the United States.
7.2 We will only transfer Customer Content outside the UK where the transfer is protected by one of the following:
- UK adequacy regulations;
- the UK Extension to the EU–US Data Privacy Framework, where the provider is certified;
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses;
- another safeguard allowed by UK data protection law.
8. Help with individuals' rights
8.1 If someone contacts us to exercise their data protection rights about Customer Content, we will pass the request to the Customer without undue delay. We will not respond ourselves unless the Customer asks us to.
8.2 The Service lets the Customer view, edit, download and delete its reports. Where the Customer needs more help to respond to a request, we will give reasonable help.
9. Personal data breaches
9.1 If we become aware of a personal data breach affecting Customer Content, we will tell the Customer's administrators without undue delay, and in any case within 48 hours.
9.2 We will include as much of the following as we know at the time, and send the rest as soon as we can:
- what happened and when;
- the types and approximate amount of data and people affected;
- the likely consequences;
- what we have done, or propose to do, to deal with the breach and reduce its effects;
- a contact for more information.
9.3 We will help the Customer meet its own duties to notify the Information Commissioner's Office and affected people. Telling the Customer about a breach is not an admission of fault.
10. Help with security, impact assessments and the ICO
10.1 We will give the Customer reasonable help with:
- its security obligations;
- data protection impact assessments;
- prior consultation with the Information Commissioner's Office, where these relate to the Service.
10.2 We will co-operate with the Information Commissioner's Office if it asks.
11. Records and audits
11.1 We will keep a record of our processing activities for the Customer, as the law requires.
11.2 We will make available the information reasonably needed to show that we meet these Data Processing Terms. We will start by answering written questions.
11.3 If written answers are not enough, the Customer may carry out an audit, or have one carried out by an independent auditor bound by confidentiality, under these conditions:
- at least 30 days' notice;
- no more than once a year, unless there has been a personal data breach or the Information Commissioner's Office requires an audit;
- during normal working hours;
- at the Customer's cost.
12. End of the Service
12.1 When the Customer closes its company account, its reports remain available to download for 30 days.
12.2 We will then delete Customer Content within 90 days of closure, unless the law requires us to keep it. If the Customer asks for its data back in writing before closure, we will provide its reports and photos in a common format.
12.3 Backups are deleted on a rolling basis by our database provider.
13. Liability and precedence
13.1 Each party's liability under these Data Processing Terms is subject to the limits in section 11 of the Terms of Use, except where the law does not allow liability to be limited.
13.2 If these Data Processing Terms conflict with the Terms of Use or Privacy Policy on the processing of Customer Content, these Data Processing Terms apply.
14. Changes
14.1 We may update these Data Processing Terms to reflect changes in the law, guidance or the Service.
14.2 We will email company administrators at least 30 days before any significant change takes effect. Changes required by law may apply sooner.
Annex 1 – Details of the processing
| Subject matter | Providing the Science of Compliance Service to the Customer. |
| Duration | For as long as the company account is open, and until Customer Content is deleted under section 12. |
| Nature of processing | Collection (via the app), storage, transcription, reading of uploaded company documents, AI-assisted drafting, editing, generation of Word reports, sharing within the company account, retrieval and deletion. |
| Purpose | To let the Customer record site inspections and compliance visits, carry out management system audits, prepare, review and issue reports, and keep a record of them. |
| Types of personal data | Names, job roles and contact details of people recorded in reports; site and contractor details; photos that may show people; voice recordings and their transcripts; company documents uploaded for audits, such as policies and procedures, which may include names and job roles of the client's staff; inspection and audit comments and actions; incident numbers and short incident comments. |
| Special category or criminal offence data | Not intended. Incident comments may occasionally include health information. The Customer should keep this to what is necessary (section 3.2). |
| Categories of people | The Customer's staff; the Customer's clients and their staff; principal contractors, contractors and operatives on site; other people present on site. |
| Retention | Audio recordings are deleted from our server as soon as transcription is complete. Documents uploaded for audits are deleted from our server as soon as the draft audit has been prepared. Temporary processing results are deleted within 6 hours. Other Customer Content is kept while the account is open, then deleted under section 12. |
Annex 2 – Sub-processors
| Provider | What it does | Where data is held |
|---|---|---|
| Supabase | Database, file storage (reports, photos, logos), sign-in | London, United Kingdom |
| Render | Runs our application server, which transcribes recordings and builds Word reports | Frankfurt, Germany (EU) |
| OpenAI | Transcribes recordings, reads uploaded company documents, and prepares AI draft reports and audits. Does not use API data to train its models, and may keep it for up to 30 days for abuse monitoring | United States |
Account information only, no report content:
| Provider | What it does |
|---|---|
| Resend | Sends account emails (for example invitations, password resets, welcome and trial emails) |
| Stripe | Takes payments and produces invoices |
These are listed for transparency. They are covered by our Privacy Policy as our own processors.
Annex 3 – Security measures
- All connections to the app, website and server are encrypted (HTTPS/TLS).
- Data is encrypted at rest by our database provider.
- Database access rules make sure each company can only see its own data. Within a company, roles control what each user can do.
- Only administrators can issue reports, and issued reports are locked against further changes.
- An audit log records who created, changed or issued each report, and when.
- Passwords are stored only in hashed form by our sign-in provider. We never see card details, which are handled by Stripe.
- Audio recordings are deleted from our server as soon as transcription is complete. Documents uploaded for audits are deleted from our server as soon as the draft audit has been prepared. Temporary processing results are deleted within 6 hours.
- Access to production systems and keys is limited to authorised personnel. Keys are held in our hosting providers' secure settings, not in the app.
- Reports are kept on the phone until uploaded, so they are not lost if signal drops.
- Our providers keep backups on a rolling basis.
Contact: support@scienceofcompliance.co.uk
Terms of Use · Privacy Policy · Back to Science of Compliance