Data Processing Agreement — Bloom Dock

This agreement takes effect for a business when both the business and Bloom Dock have recorded their acceptance of it. Publication of these terms alone does not establish acceptance.

1. Parties and role

Bloom Dock (operator: Kimberly Scarlett, sole trader; hello@bloomdock.co.uk) is the processor and the subscribing business identified in the account or signing record is the controller for its customer order/form data. Bloom Dock remains a separate controller for its own accounts, billing and security data.

2. Subject matter, duration and purpose

During the customer's use of Bloom Dock and any agreed lawful wind-down, the processor hosts and manages forms, customer orders, tasks, attachments and operational communications solely to provide and secure the platform under the controller's documented instructions.

3. Data and data subjects

Customer names, contact information, order and delivery details, form responses, notes, optional uploads, messages and payment status/reference information. Data subjects may include the business's customers, contacts and authorised staff. The controller must not intentionally collect unnecessary sensitive data without an appropriate lawful basis and agreed safeguards.

4. Controller instructions

Process personal data only on documented instructions, including instructions given through authorised workspace use, except where UK law requires otherwise; inform the controller of a legal requirement where permitted. Promptly notify the controller if an instruction appears to infringe applicable data protection law.

5. Confidentiality and security

Ensure persons authorised to process data are bound by confidentiality; maintain appropriate access controls, authentication, segregation between business workspaces, encryption and recovery controls proportionate to risk. Technical and organisational security measures are maintained by Bloom Dock and are available for review on reasonable request, subject to protecting system security and other customers.

6. Subprocessors and transfers

Use subprocessors only with appropriate authorisation and equivalent contractual protection. Initial known providers include Supabase, Vercel, Stripe (where applicable) and Resend, subject to confirmation of roles and enabled services. Maintain an up-to-date subprocessor list, give notice of changes and an opportunity to object where general authorisation is used. Restricted transfers outside the UK require a valid transfer mechanism and any required assessment.

7. Assistance

Taking account of the processing, assist with data subject rights requests, security incidents, data protection impact assessments, consultations with regulators and information needed for compliance. Notify the controller without undue delay after becoming aware of a personal data breach affecting controller data; agree operational contacts and escalation methods.

8. End of service

At the controller's choice, return or securely delete personal data at the end of services unless law requires continued storage. Deletion and export requests are handled in accordance with documented operational procedures and applicable law; backups and independently held provider records may follow separate retention periods. Document any retained statutory data.

9. Compliance evidence and audits

Make reasonable compliance information available and permit or contribute to appropriate audits and inspections, with reasonable safeguards for other tenants' confidentiality and service security.

10. Order of precedence and acceptance

This agreement governs controller-to-processor handling of customer data. In a conflict about this processing it prevails over general service terms, subject to applicable law. It takes effect only when authorised representatives confirm acceptance and the approved schedules are incorporated.

Schedule to complete before signature

Controller's legal name/contact; subject matter and instructions; actual enabled subprocessors, transfer countries and legal mechanisms; technical security controls; incident contact and response procedure; retention/export/delete timelines and backup handling; agreed support and audit arrangements; effective date and acceptance record.