Data Processing Agreement

This DPA is between Oncommerce Limited ("Processor", "we", "us") and the organisation that subscribes to InstaSurv ("Controller", "you").

For account, billing, and platform operations data, we act as an independent controller. For client, property, report, image, and related content you enter into the Service ("Customer Data"), we act as a processor on your documented instructions.

We process Customer Data solely to provide, secure, support, and improve the Service as described in our Terms of Service and this DPA, for the duration of your subscription and any permitted wind-down or backup retention period.

Processing includes hosting, storage, retrieval, transmission, backup, display in the application, email/notification delivery you initiate, PDF generation, client portal access, and related workflow features.

You instruct us to process Customer Data as necessary to operate the Service features you use, and as otherwise documented in writing (including support tickets). We will not process Customer Data for our own marketing.

If an instruction appears to infringe UK GDPR or related law, we will inform you without undue delay where legally permitted.

We implement appropriate technical and organisational measures, including access controls, encrypted transport (HTTPS), tenant isolation in the application layer, logging for security purposes, and staff confidentiality obligations.

You authorise us to engage sub-processors listed on our Subprocessor List page. We will impose data protection terms no less protective than this DPA and remain responsible for their performance.

We will provide notice of material additions or replacements to the subprocessor list via this site or service notices. Continued use after notice constitutes acceptance unless you object on reasonable data-protection grounds within 14 days.

We will assist you, taking into account the nature of processing, with data subject requests, security incidents affecting Customer Data, DPIAs where reasonably required, and audits limited to information reasonably necessary to demonstrate compliance (subject to confidentiality). Contact support@instasurv.co.uk.

On termination of the Service, you may export Customer Data using available export features within a reasonable period. Thereafter we will delete or anonymise Customer Data from live systems, subject to legal retention and backup cycles described in our Data Retention and Data Deletion procedures.

This DPA is governed by the laws of England and Wales. Nothing in this DPA reduces either party's obligations under UK GDPR or the Data Protection Act 2018.