Scope and instructions
Parties and roles
This DPA forms part of the RAMSCloud service contract with BLACK LONDON LTD. The customer is controller, or a processor authorised by its controller, and RAMSCloud is processor or subprocessor for personal data handled on the customer’s instructions. Our own controller processing is explained in the Privacy notice. Applicable data-protection law includes the UK GDPR and Data Protection Act 2018 as amended and other law governing the relevant processing.
Subject matter and duration
Processing concerns provision of the customer’s workspace, safety-document and evidence functions and authorised support. It lasts for the service term and the return/deletion period in the retention schedule, subject to lawful restricted retention.
Nature and purpose
Processing includes receiving, storing, organising, retrieving, editing, generating and exporting documents, authorised transmission, support, backup and deletion. Selected content may be sent to the authorised AI provider for the drafting and support functions described in the Privacy notice. Private customer documents and libraries are not made shared catalogue content by this processing.
Types of personal data
Business and user contact details, company/project information, site addresses, named workers and responsibilities, document text, training or competence evidence, uploaded files and related support material. Customers must not submit unnecessary special-category or criminal-offence data; any agreed processing of such information requires the necessary documented conditions and safeguards.
Categories of data subjects
Customer users, staff, contractors, subcontractors, clients, site contacts and other people lawfully included in customer content or authorised support material.
Documented instructions
RAMSCloud processes customer personal data only on documented instructions in the contract, this DPA, authorised service use and agreed written directions, including authorised transfers, unless law requires otherwise. Where permitted, we will inform the customer of that legal requirement before processing. We will promptly inform the customer if an instruction appears to breach applicable data-protection law.
Customer obligations
The customer is responsible for lawful purposes and bases, required notices and authorisations, accurate and proportionate submissions, authorised users and lawful instructions. It must have authority to appoint RAMSCloud and the authorised subprocessors. Customers remain responsible for their safety assessments and duties.
Processor commitments
Confidentiality
Access is limited to authorised personnel who need it for the agreed processing and are bound by appropriate contractual or statutory confidentiality duties.
Security measures
RAMSCloud will implement appropriate technical and organisational measures reflecting the processing risks, as required by applicable law. These include authenticated access, server-side and database authorisation, organisation and relevant creator scoping, private storage and controlled administrative access, protected credentials, proportionate logging and appropriate provider arrangements.
Subprocessors
The customer gives general written authorisation for the subprocessors and processing in the Subprocessors schedule. RAMSCloud will impose the required written data-protection obligations and remain responsible for their performance as required by law. We will give advance notice of intended additions or replacements and a reasonable opportunity to object on data-protection grounds using the process in that schedule.
Restricted transfers
Restricted transfers will take place only on documented instructions, including agreed transfer arrangements, or as required by law. The Subprocessors schedule identifies relevant destinations and safeguards. Applicable adequacy arrangements, UK IDTA or UK Addendum and any required assessments or supplementary measures must be in place before the transfer.
Rights-request assistance
Taking account of the processing, RAMSCloud will assist the customer through appropriate technical and organisational measures, insofar as possible, with data-subject requests. We will notify the customer of requests concerning its personal data and act on its instructions unless law requires otherwise. Necessary assistance is not conditional on an active paid subscription.
Breach, DPIA and regulator assistance
Taking account of the processing and information available, RAMSCloud will assist with security, personal-data breaches, DPIAs and prior consultation. We will notify the customer without undue delay after becoming aware of a breach affecting its personal data, provide available information about its nature, likely effects and response, and update that information as it develops.
Deletion or return
At the customer’s choice, RAMSCloud will delete or return customer personal data after the processing service ends and delete copies unless law requires retention. The Privacy retention schedule states the applicable return, deletion and backup periods. Retained data is restricted to the relevant lawful purpose. The in-app PDF export does not return every category of personal data; contact support for the remaining records. Product billing/deletion checks do not override this DPA or statutory rights.
Information and audits
RAMSCloud will provide information needed to demonstrate its processor compliance and allow and contribute to legally required audits, including inspections. Reasonable confidentiality, security and scheduling arrangements may protect other customers and avoid unnecessary disruption, but must not prevent legally required access or urgent investigation.
Contract administration
Priority and liability
This DPA prevails over conflicting service-contract provisions about processing customer personal data. Applicable mandatory transfer terms take priority where required. Nothing reduces individuals’ statutory rights or a supervisory authority’s powers. Any contractual liability limitation must be expressly agreed and consistent with applicable law.
DPA contact
Effective date
25 October 2026