CircuitHQ Data Processing Agreement

Version: 2026-10b
Last updated: 29 October 2026

This Data Processing Agreement ("DPA") forms part of the CircuitHQ Terms of Service (https://www.circuithq.co.uk/terms) between:

• P P M Electrical Ltd, company number 09676729, registered office 29 Wedgewood Drive, Spalding, Lincolnshire, PE11 3FJ, trading as CircuitHQ ("we", "us", the "Processor"); and
• the business that has signed up for CircuitHQ ("you", the "Controller").

It is accepted when you accept the Terms of Service. It meets the requirements of Article 28 of the UK GDPR.

1. What this DPA covers

1.1 When you use CircuitHQ, you put in personal data about your own customers, staff and other people, for example on customers, jobs, quotes, invoices, certificates, photos and enquiries ("Customer Personal Data").

1.2 For Customer Personal Data, you are the controller and we are your processor. This DPA sets out how we handle it.

1.3 This DPA does not cover data we use as a controller, such as your account login details and billing details. Our Privacy Policy (https://www.circuithq.co.uk/privacy) covers that.

1.4 Words like "controller", "processor", "personal data", "personal data breach" and "data subject" have the meanings in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended from time to time.

1.5 The details of the processing (subject matter, duration, nature, purpose, types of data and data subjects) are in Annex 1.

2. Your responsibilities

2.1 You are responsible for:

• having a lawful basis for putting Customer Personal Data into CircuitHQ and for asking us to process it;
• giving your customers and staff any privacy information they need, including on your own website if you use the CircuitHQ enquiry form;
• the accuracy of Customer Personal Data;
• your own use of Lead Finder and any contact you make with leads, including under PECR; and
• your decision to connect your own Xero account, and Xero's processing under your agreement with Xero;
• when you submit DNO connection applications to ENA Connect Direct through CircuitHQ: reviewing each application before a user presses Submit; its accuracy and completeness; having the right to submit everything in it, including the cut-out photo; submitting only genuine domestic applications and not misusing our ENA access (see section 14A of our Terms of Service); and giving your customers the privacy information ENA recommends installers give (naming the relevant DNO and linking to its privacy notice).

2.2 Your use of CircuitHQ's settings and features (for example, uploading a file, requesting an AI read, connecting Xero, pressing Submit on a DNO connection application to ENA Connect Direct, or requesting deletion) counts as your documented instructions to us.

3. Our responsibilities

We will:

3.1 Follow your instructions. Process Customer Personal Data only on your documented instructions (in the Terms of Service, this DPA and your use of CircuitHQ), unless UK law requires otherwise. If so, we will tell you before processing unless the law prevents us.

3.2 Tell you about unlawful instructions. Tell you promptly if we think an instruction breaks Data Protection Law.

3.3 Keep it confidential. Make sure anyone we authorise to process Customer Personal Data is under a duty of confidentiality.

3.4 Keep it secure. Use appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 UK GDPR. The current measures are in Annex 2.

3.5 Keep it separate. Keep each business's data separate from other businesses' data.

3.6 Help with data subject requests. Taking into account the nature of the processing, help you respond to people using their rights (for example access, correction or deletion). If we receive a request directly, we will pass it to you and will not respond ourselves unless you ask us to.

3.7 Help with your other obligations. Give you reasonable help with security, breach notifications, data protection impact assessments and consultations with the ICO, taking into account the information available to us. We do not charge for this help, unless a request is manifestly unfounded or excessive, in which case we may charge our reasonable costs and will tell you before we do.

3.8 Not use it for our own purposes. Not sell Customer Personal Data or use it for our own purposes, except to provide, secure and support CircuitHQ.

4. Personal data breaches

4.1 If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay and in any case within 48 hours of becoming aware.

4.2 We will give you the information we reasonably can to help you meet your own obligation to report the breach to the ICO and, where needed, to the people affected, and we will take reasonable steps to contain it.

5. Sub-processors

5.1 You give us general authorisation to use the sub-processors listed in Annex 3.

5.2 We will tell you at least 30 days before we add or replace a sub-processor, by email or in the app. You may object on reasonable data protection grounds. If we cannot resolve your objection, you may cancel your subscription before the change takes effect.

5.3 We will put a written contract in place with each sub-processor that gives Customer Personal Data protections that meet Article 28 UK GDPR. We remain responsible to you for our sub-processors' performance.

5.4 Xero is not our sub-processor. If you connect your own Xero account, data is sent to Xero on your instructions, and Xero processes it under your own agreement with Xero.

5.5 Public data sources used by Lead Finder (planning.data.gov.uk open data and council planning lists that you import) are data sources, not sub-processors.

5.6 ENA Connect Direct and the DNOs are not our sub-processors. When a user presses Submit on a DNO connection application, we send that application's details (listed in section 4 of our Privacy Policy) to Energy Networks Association Limited ("ENA") through ENA Connect Direct, on your instructions. This is a disclosure you direct, not processing we hand to ENA. We use our own ENA access to send it, but you decide what is sent and when, and nothing is sent automatically. ENA passes the application to the relevant distribution network operator (DNO). The DNO is the controller for the application, and ENA and the DNO handle that data under their own terms and privacy notices, not for us. We remain your processor for the Customer Personal Data held in your CircuitHQ account, including ENA's response to each application (the application reference, the DNO, the status, the time it was submitted and any DNO comment), which we store in your account and update only when a user presses Refresh.

6. International transfers

6.1 We will only transfer Customer Personal Data outside the UK (or allow a sub-processor to do so) where the transfer is permitted by Data Protection Law, for example because:

• the destination is covered by UK adequacy regulations (such as the European Economic Area); or
• appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any transfer risk assessment required.

6.2 The transfer safeguard for each sub-processor is shown in Annex 3.

7. Deletion and return

7.1 During your subscription, you can export your business's data from CircuitHQ.

7.2 When a trial ends or a subscription is cancelled, your account becomes read-only and we keep Customer Personal Data so you can export it or resubscribe, for 12 months. After that we delete Customer Personal Data, and backup copies are removed within a further 30 days, unless the law requires us to keep it. We will show an in-app notice with the deletion date from 60 days beforehand.

7.3 On request, we will delete your business's users, records and files. Copies in our backups are deleted automatically within 30 days.

7.4 We do not keep Customer Personal Data after deletion unless UK law requires us to.

7.5 You are responsible for keeping your own copies of certificates and records you need to keep by law or under scheme rules. We keep Customer Personal Data for as long as your account is open, following your instructions; you decide how long certificates and records need to be kept.

8. Information and audits

8.1 We will make available to you the information reasonably needed to show that we are meeting our obligations under Article 28 UK GDPR.

8.2 We will allow for and contribute to reasonable audits, including inspections, by you or an auditor you appoint, on reasonable notice (at least 30 days), no more than once a year unless required by the ICO or following a personal data breach, and subject to confidentiality. You pay your own costs and your auditor's costs. We do not charge for our reasonable cooperation with one audit a year.

9. Liability and duration

9.1 This DPA lasts for as long as we process Customer Personal Data for you.

9.2 The limits on liability in the Terms of Service apply to this DPA, except where Data Protection Law does not allow this.

9.3 If this DPA conflicts with the Terms of Service on anything about Customer Personal Data, this DPA wins.

9.4 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1: Details of the processing

Annex 2: Security measures

• Passwords stored in hashed form; logins use a secure session cookie.
• Role-based permissions, set by you, control what each user can see and do.
• Each business's data is kept separate from other businesses' data.
• Audit log of user actions within each business.
• Nightly backups, kept for 30 days.
• Card details are handled by Stripe and never reach CircuitHQ.
• The app does not send email to your customers, and uses no third-party analytics or error-tracking services.

Annex 3: Authorised sub-processors

Services that receive limited data: the app also uses postcodes.io for postcode lookup, which receives the postcode looked up, and OpenStreetMap map tiles for the jobs map, which are loaded directly by the user's browser, so OpenStreetMap's tile servers receive the user's IP address and the map area viewed. These services may be located inside or outside the UK.

Not sub-processors: Stripe handles only your billing details, which we use as a controller (see our Privacy Policy). Xero, ENA Connect Direct and the DNOs receive data only on your instructions (see sections 5.4 and 5.6).