Täbiau - Data Processing Agreement

Version: 1.0 (draft)
Proposed effective date: 28th October 2026 Processor: Graham Crichton trading as Täbiau, Northern Ireland, United Kingdom
Processor's business address: Office 2104, 92 Castle Street, Belfast BT1 1HE, Northern Ireland Processor contact: support@tabiau.com

1. Parties and purpose

1.1. This Data Processing Agreement ('DPA') forms part of the Täbiau Terms and Conditions (the 'Terms') between Graham Crichton trading as Täbiau ('Täbiau', 'Processor') and the business or organisation accepting the Terms ('Customer', 'Controller') where Täbiau processes personal data on the Customer's behalf.

1.2. The Customer is normally the Controller of personal data that it or its authorised users enter or manage through their Täbiau workspace ('Customer Personal Data'). Täbiau acts as Processor only for the processing described in Schedule 1. If the Customer itself acts as a processor for another controller, the Customer shall ensure it is entitled to appoint Täbiau as a subprocessor and references to Controller instructions shall be read accordingly.

1.3. This DPA is intended to provide the mandatory contractual protections required by Article 28 of the UK GDPR and, where applicable, Article 28 of the EU GDPR. It is binding when the Customer accepts the Terms, including electronically.

1.4. In a conflict concerning processing of Customer Personal Data, this DPA prevails over the Terms. Neither document limits statutory data protection rights or responsibilities that cannot lawfully be limited. Matters concerning Täbiau's processing of its own account, billing, website or security administration data as an independent controller are addressed in the Täbiau Privacy Notice.

2. Definitions and applicable law

2.1. 'Applicable Data Protection Law' means the UK GDPR, the Data Protection Act 2018 (as amended), the EU GDPR to the extent applicable, and other binding data protection laws applicable to the relevant processing. Expressions including 'personal data', 'processing', 'data subject', 'controller', 'processor', 'personal data breach' and 'supervisory authority' have the meanings assigned under the applicable law.

2.2. 'Documented Instructions' includes this DPA, the Terms, the Customer's configuration and authorised use of Täbiau, and any other lawful written instruction agreed by the parties. 'Subprocessor' means an additional processor engaged by Täbiau to process Customer Personal Data on its behalf.

2.3. The subject matter, duration, nature, purposes, categories of individuals and types of personal data are set out in Schedule 1. Required security measures appear in Schedule 2. Approved providers and processing locations must be completed in Schedule 3 before live use.

3. Customer instructions and responsibilities

3.1. The Customer determines the purposes and essential means of processing Customer Personal Data and is responsible for a valid legal basis, required notices, any consent or special-category condition, data minimisation, retention instructions, and the accuracy and lawfulness of information it uploads.

3.2. The Customer shall ensure that authorised staff access is appropriately controlled and that its use of features, messages, automations, AI tools and external integrations complies with Applicable Data Protection Law.

3.3. The Customer shall not direct Täbiau to undertake unlawful processing or submit information to a feature where the Customer lacks authority to do so. Where the Customer processes sensitive health, financial or other high-risk personal information, it shall assess the relevant legal conditions and necessary safeguards before using Täbiau for that information.

3.4. The Customer is responsible for answering requests from its data subjects, notifying relevant authorities and individuals where required, and conducting any necessary risk assessments, subject to Täbiau's assistance duties in this DPA.

4. Processor instructions and purpose limitation

4.1. Täbiau shall process Customer Personal Data only on the Customer's Documented Instructions, including instructions about international transfers, unless required to process otherwise by applicable law. Where legally permitted, Täbiau shall inform the Customer before acting on such a legal requirement.

4.2. Täbiau shall promptly inform the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, unless prohibited from doing so by law. Täbiau may suspend the affected instruction pending clarification where reasonably necessary to prevent unlawful processing.

4.3. Täbiau shall not sell Customer Personal Data, use it for independent advertising profiles, or use it to train Täbiau's own general-purpose AI models. Any proposed new independent use requires a separate lawful basis and necessary authorisation or agreement, and must not be treated as an implied instruction under this DPA.

4.4. Processing may include hosting, organising, retrieving, storing, backing up, displaying, transmitting and deleting information and, where chosen by the Customer, running bookings, automated messages, AI/OCR features and external connections described in Schedule 1.

5. Confidentiality and personnel

5.1. Täbiau shall ensure that persons authorised to process Customer Personal Data are subject to an enforceable duty of confidentiality or an appropriate statutory obligation, and receive suitable guidance on secure and lawful handling.

5.2. Access shall be restricted to persons who reasonably need it to provide, support or secure the Service, subject to appropriate access controls and periodic review. These duties continue after a person's access or employment ends.

6. Security measures

6.1. Täbiau shall implement and maintain appropriate technical and organisational measures under Article 32 of Applicable Data Protection Law, taking account of available technology, implementation costs, the nature and risks of the processing and the rights of individuals.

6.2. The minimum contractual security objectives are described in Schedule 2. These must be checked against the real operating environment before this DPA is offered to customers. Täbiau may replace a measure with one offering equivalent or stronger protection, provided it does not materially reduce overall security.

6.3. Täbiau shall take reasonable steps to identify, investigate, contain and remedy security vulnerabilities or incidents affecting Customer Personal Data and to restore availability where reasonably possible.

6.4. The Customer remains responsible for its own user devices, login hygiene, staff permissions, settings and any exports or independent copies of Customer Personal Data that it controls.

7. Subprocessors

7.1. Before appointing or replacing a Subprocessor, Täbiau shall provide at least 30 days advance notice where practicable, identifying the proposed change and allowing the Customer to raise a reasoned data protection objection. Necessary emergency changes to protect security or availability may be notified as soon as reasonably possible.

7.2. The Customer may object on documented, reasonable data protection grounds within 14 days after notice. The parties shall seek an appropriate mitigation. If no reasonable resolution is possible, the Customer may discontinue the affected feature or terminate the affected Service in accordance with an agreed mechanism, without prejudice to mandatory legal rights.

7.3. Täbiau shall impose data protection obligations on each Subprocessor that provide protection equivalent in substance to those imposed on Täbiau by this DPA, as required by Applicable Data Protection Law. Täbiau remains responsible to the Customer for the performance of its Subprocessors' data protection obligations.

7.4. A provider independently chosen and connected by the Customer may act as a separate controller or processor under its own agreement. Täbiau will identify whether a provider is its Subprocessor or a Customer-selected independent recipient before that feature is enabled. The Customer is responsible for assessing the independent provider's terms and legal basis where applicable.

8. International transfers and locations

8.1. Täbiau shall not make a restricted international transfer of Customer Personal Data except on the Customer's documented instructions or as permitted under this DPA and Applicable Data Protection Law. Hosting, backups, AI processing, support access and Subprocessor access must be reflected in the approved locations in Schedule 3.

8.2. Transfers that require safeguards shall be supported by a valid adequacy decision or legally recognised transfer mechanism as applicable, including relevant UK or EU standard contractual arrangements and any required transfer assessment or supplementary measures. A transfer of personal data from the EEA to the UK may rely on a current EU adequacy decision for the UK while valid.

8.3. Täbiau shall inform the Customer where a proposed processing location or remote access arrangement materially changes. No promise that all data stays in the UK or EEA shall be published until the actual supplier arrangements and remote access paths are confirmed.

8.4. Where additional transfer clauses or annexes are legally necessary, the parties shall complete or incorporate the relevant approved documents before carrying out the affected transfer. This DPA alone is not a substitute for the UK IDTA, UK Addendum or EU Standard Contractual Clauses where one is required.

9. Data subject requests

9.1. Taking into account the nature of the processing, Täbiau shall provide appropriate technical and organisational assistance to enable the Customer to respond to valid requests for access, correction, deletion, restriction, portability, objection or other rights under Applicable Data Protection Law.

9.2. Where Täbiau receives a request clearly relating to Customer Personal Data, it shall, where reasonably possible and legally permitted, notify or refer the request to the Customer and shall not respond substantively on the Customer's behalf without authorisation, except where legally required.

9.3. Assistance may be provided through built-in export, search, edit or deletion tools and reasonable additional cooperation. Any exceptional assistance charges must be agreed in advance and shall not apply where the need arises from Täbiau's own breach of this DPA.

10. Personal data breaches

10.1. Täbiau shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, using the relevant account/security contact or another agreed communication method.

10.2. Täbiau shall provide information reasonably available to it, including the nature of the incident, data and individuals potentially affected, likely consequences, containment steps and recommended precautions. Further information may be supplied in stages as the investigation progresses.

10.3. Täbiau shall take reasonable steps to investigate, contain, mitigate and document the breach, preserve appropriate evidence, and assist the Customer in meeting any reporting or notification duties.

10.4. The Customer remains responsible for assessing whether it must notify a supervisory authority or affected individuals. Under the UK GDPR, notifiable breaches generally must be reported to the ICO without undue delay and, where feasible, within 72 hours of the Controller becoming aware. This is not a 72-hour allowance for Täbiau to delay notifying the Customer.

11. Assistance, impact assessments and compliance

11.1. Taking into account the nature of the processing and the information available to it, Täbiau shall provide reasonable assistance with the Customer's data security obligations, breach response, data protection impact assessments and prior consultation with supervisory authorities where required by law.

11.2. Täbiau shall make available information reasonably necessary to demonstrate compliance with Article 28 obligations and this DPA, subject to appropriate confidentiality and security safeguards.

12. Audits and inspections

12.1. Täbiau shall allow and contribute to audits and inspections conducted by the Customer or an independent auditor mandated by the Customer, as required by Applicable Data Protection Law.

12.2. To minimise risk to other customers, the parties will ordinarily first use relevant written information, security documentation and independent assurance reports where sufficient. Where an on-site or deeper inspection is reasonably necessary, the parties shall agree reasonable scope, timing, confidentiality conditions and arrangements that protect unrelated customer information and system security.

12.3. Täbiau shall not use an administrative audit process to prevent the Customer from exercising a mandatory audit right. Each party bears its own ordinary costs unless otherwise agreed or the audit reveals a material breach by Täbiau justifying reasonable remediation costs under applicable law.

13. Return, export and deletion at termination

13.1. On termination of the relevant Service, Täbiau shall, at the Customer's choice, return or delete Customer Personal Data and delete remaining copies, unless applicable law requires storage. The practical export and deletion process shall be provided in the service closure instructions and retention schedule.

13.2. The normal period for self-service export or assisted return after service termination will be 30 days. Following that period, active copies will be deleted within 30 days. Backup copies will expire on their documented rolling retention cycle of 30 days, subject to security isolation and any legally required preservation.

13.3. Where a legal obligation requires continued storage, Täbiau shall restrict subsequent processing to that obligation and protect the retained information until deletion becomes lawful. Täbiau will provide confirmation of deletion or the relevant deletion process on reasonable request.

13.4. The Customer should not treat Täbiau as its only copy of essential records and should arrange any lawful records it must retain independently before closure. This responsibility does not remove Täbiau's obligations to provide the return and deletion measures required by this DPA.

14. Liability, statutory rights and governing law

14.1. As between the parties, commercial allocation of liability is governed by the Terms to the extent lawful. Nothing in those Terms or this DPA excludes or limits liability that cannot be lawfully excluded, any direct statutory obligations of a controller or processor, or the rights of affected individuals or supervisory authorities under Applicable Data Protection Law.

14.2. The parties acknowledge that their respective statutory responsibilities cannot be transferred away merely by contract. Each party shall cooperate reasonably to address data protection issues arising from the processing.

14.3. This DPA and contractual disputes between the parties arising under it shall be governed by the laws of Northern Ireland, and the courts of Northern Ireland shall have exclusive jurisdiction to the extent legally permitted. This does not displace any mandatory rights of individuals, regulatory powers or other non-excludable legal requirements.

14.4. This DPA remains in effect for as long as Täbiau processes Customer Personal Data on behalf of the Customer, including any limited post-termination period required to return or delete it.

Schedule 1 - Description of processing

• Subject matter: processing Customer Personal Data within the Täbiau business management service and customer-selected features.
• Duration: the contracted Service term and applicable post-termination return, deletion and lawful retention periods.
• Nature and purpose: collection, organisation, storage, retrieval, display, editing, backups, communication, transmission, export and deletion; customer-selected bookings, scheduling, invoicing, reporting, automation, AI/OCR and integrations.
• Types of individuals: Customer's clients, prospects, employees, contractors, suppliers, business contacts and other people lawfully recorded by the Customer.
• Ordinary personal data: names, contact details, appointments, service notes, transactions, correspondence, documents, account references, images and other information chosen by the Customer.
• Special-category or high-risk data: only where the Customer is legally permitted to process it and the relevant Täbiau feature and safeguards are suitable;
• Controller instructions: the Terms, this DPA, the Customer's configured features and settings and other agreed written instructions.
• Intended locations: United Kingdom and European Union.

Schedule 2 - Technical and organisational security commitments

Täbiau shall maintain appropriate measures proportionate to the risk, including the following objectives. Confirm that the operational implementation supports each commitment before adoption:

1. Access: individual accounts, controlled staff/admin privileges, least-privilege access, timely revocation and appropriate strong authentication for sensitive administrative access.
2. Transmission and storage: appropriate encryption in transit, encryption or comparable protection for stored personal data where warranted, and secure management of encryption keys and secrets.
3. Infrastructure: supported software, security patching, vulnerability assessment, secure configuration and reasonable protection against common web application attacks.
4. Separation: logical restrictions designed to prevent one customer's authorised users from accessing another customer's workspace information.
5. Logging and response: relevant security and operational logs, incident reporting channels and defined investigation/containment procedures.
6. Resilience: appropriate backup, restoration and business continuity processes, with periodic review or testing as warranted by risk.
7. People and suppliers: confidentiality duties, appropriate training, supplier due diligence and legally required processor agreements.
8. Lifecycle: secure deletion, access revocation and records of material security incidents, proportionate to the sensitivity of the data.

Schedule 3 - Customer account and security contacts

Customer/controller: The business or organisation identified in its Täbiau account and accepted order.
Customer privacy/security notices: The primary account contact or a separately designated privacy/security email in account settings.
Processor: Graham Crichton trading as Täbiau.
Processor privacy/security contact: support@tabiau.com
Acceptance: By the Customer's authorised acceptance of the Täbiau Terms incorporating this DPA.
Effective date: The date of that acceptance or another agreed effective date.

---

End of Data Processing Agreement