Legal
Data Processing Agreement
Effective from the start of your client engagement. Governing law: Ireland.
1. Parties
This Data Processing Agreement ("DPA") is between Compliance Hub Ltd (the "Processor") and the customer organisation receiving Compliance Hub services (the "Controller").
2. Subject matter
The Processor processes Controller-provided personal data and compliance evidence solely to administer and deliver the agreed consultancy, training or certification-support engagement.
3. Categories of data
- Client contacts' names, work emails and engagement roles.
- IP addresses associated with security-relevant actions (purged after 12 months).
- Compliance records: checklist status, evidence references and engagement records.
The Controller retains ownership of all information and evidence supplied during the engagement.
4. Processor obligations
- Process data only on documented instructions from the Controller (this DPA + use of the agreed engagement).
- Ensure access is limited to authorised personnel bound by confidentiality.
- Implement appropriate technical and organisational measures (row-level security, encrypted transit and verifiable audit logging).
- Assist the Controller with data subject requests and breach notifications without undue delay.
5. Sub-processors
The Processor uses Lovable Cloud (Supabase) for database, auth, and storage hosting in EU regions. Updates to sub-processors will be communicated to the Controller in advance.
6. Retention & deletion
On termination, engagement data will be deleted within 30 days unless legal retention applies. IP addresses in audit logs are automatically nulled after 12 months.
7. Contact
Data Protection contact: maire@compliancehub.ie
This DPA is a plain-language summary. A countersigned version is available on request for enterprise customers.