FixSnags Data Processing Addendum (DPA)

Last updated: 15 July 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between VISONTRA LTD trading as FixSnags (“Processor”) and the customer identified in the applicable order form or service agreement (“Customer” or “Controller”) to the extent FixSnags processes Customer Personal Data on behalf of the Customer.

1. Purpose and scope

This DPA applies where FixSnags processes personal data on behalf of a Customer in connection with the FixSnags Service.

This DPA does not apply where FixSnags acts as a controller for its own purposes, including for:

  • account administration;
  • subscription billing;
  • fraud prevention;
  • internal service analytics;
  • legal compliance;
  • support administration; or
  • general business operations.

2. Roles of the parties

  • Customer is the controller of Customer Personal Data uploaded to or processed through the Service on behalf of the Customer, including workspace/user content such as projects, reports, inspection data, uploaded photos, and related workflow records.
  • FixSnags is the processor of that Customer Personal Data.
  • For account, billing, support, fraud prevention, controller-side analytics, and similar business purposes, FixSnags acts as an independent controller.

3. Subject matter and duration

3.1 Subject matter

The subject matter of the processing is the provision of the FixSnags Service, including hosting, storing, organising, securing, syncing, exporting, and supporting Customer Personal Data.

3.2 Duration

Processing continues for as long as FixSnags provides the Service to the Customer and for any limited post-termination period necessary for deletion, return, backup expiry, legal compliance, fraud prevention, security, or dispute handling.

4. Nature and purpose of processing

FixSnags may process Customer Personal Data to:

  • provide the Service;
  • host, store, and back up data;
  • enable syncing, exports, and sharing;
  • support users and troubleshoot issues;
  • maintain security, logging, and resilience;
  • comply with documented instructions from the Customer;
  • comply with law.

5. Categories of data subjects

Depending on Customer use of the Service, data subjects may include:

  • Customer personnel and account users;
  • contractors, consultants, inspectors, and other team members;
  • site contacts;
  • individuals whose information is incidentally captured in reports, notes, or photographs;
  • end customers or client representatives where included by the Customer.

6. Types of personal data

Customer Personal Data may include:

  • names;
  • email addresses;
  • phone numbers;
  • company or workspace identifiers;
  • project, inspection, and report data;
  • uploaded photos and attachments;
  • location or GPS data;
  • support-related records associated with Customer content;
  • any other personal data the Customer uploads or instructs FixSnags to process.

FixSnags does not intentionally require special category data, but such data may be incidentally uploaded by the Customer. The Customer remains responsible for its own compliance decisions about such uploads.

7. Customer instructions

FixSnags will process Customer Personal Data only:

  • on documented instructions from the Customer;
  • as necessary to provide the Service;
  • or where required by applicable law.

The Agreement, Customer configuration, and normal use of the Service form the Customer’s documented instructions unless and until additional written instructions are agreed.

If FixSnags believes an instruction infringes applicable data protection law, FixSnags may inform the Customer and suspend the relevant processing until clarified.

8. Confidentiality

FixSnags will ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.

9. Security measures

FixSnags will implement reasonable and appropriate technical and organisational measures designed to protect Customer Personal Data, including measures relating to:

  • encryption in transit;
  • encryption at rest where supported by providers and infrastructure;
  • access controls and least-privilege principles;
  • logging and monitoring;
  • backups;
  • incident response;
  • periodic security reviews;
  • vendor due diligence.

FixSnags may update its security measures from time to time, provided the overall level of protection is not materially reduced.

10. Subprocessors

10.1 Authorised subprocessors

The Customer authorises FixSnags to use subprocessors to provide the Service.

As at the last updated date above, our core subprocessors are:

  • DigitalOcean (hosting, compute, database, storage, backups)
  • Stripe (billing/subscription processing)
  • Brevo (transactional email delivery)
  • Firebase Crashlytics (mobile crash reporting)
  • other providers notified to the Customer from time to time

PostHog analytics are treated as controller-side service analytics, not processor-side customer analytics, unless expressly agreed otherwise.

10.2 Subprocessor obligations

FixSnags will impose data protection obligations on subprocessors that are appropriate to the nature of the processing.

10.3 Subprocessor changes

FixSnags may update its subprocessors from time to time. Where appropriate for contracted business customers, FixSnags may provide notice of material subprocessor changes.

11. International transfers

Where Customer Personal Data is transferred outside the UK or EEA, FixSnags will use an appropriate transfer mechanism under applicable law, such as:

  • adequacy regulations;
  • standard contractual clauses;
  • the UK addendum; or
  • another approved mechanism.

12. Assistance with data subject rights

Taking into account the nature of the processing, FixSnags will provide reasonable assistance to the Customer to enable the Customer to respond to requests from data subjects exercising their rights under applicable data protection law.

13. Assistance with security, DPIAs, and regulator requests

FixSnags will provide reasonable assistance, taking into account the nature of the processing and the information available to FixSnags, with:

  • security obligations;
  • personal data breach obligations;
  • data protection impact assessments;
  • prior consultation with regulators where legally required.

14. Personal data breaches

FixSnags will notify the Customer without undue delay after becoming aware of a confirmed personal data breach affecting Customer Personal Data.

To the extent available, the notification will include:

  • the nature of the breach;
  • affected data or systems;
  • likely consequences;
  • measures taken or proposed.

FixSnags may provide information in phases as it becomes available.

15. Deletion and return on exit

On termination or expiry of the Service, the Customer may use available export features before closure. Thereafter, FixSnags will delete or return Customer Personal Data in accordance with the Agreement and its retention practices, except to the extent FixSnags is required or permitted to retain data for:

  • legal compliance;
  • billing and financial records;
  • fraud prevention;
  • security;
  • dispute handling;
  • backup expiry cycles.

Live customer content may be deleted promptly following account deletion or termination, while residual backup data may persist temporarily until backup overwrite/expiry in the normal course. Deleted-content tombstones may also persist briefly where technically necessary for sync integrity.

16. Audits and information rights

Upon reasonable written request, FixSnags will make available information reasonably necessary to demonstrate compliance with this DPA.

Audit rights are limited as follows:

  • document and information review first;
  • no more than one audit request per year unless required by law or in response to a confirmed serious incident;
  • audits must be on reasonable notice, during normal business hours, and in a manner that does not unreasonably interfere with operations;
  • the Customer bears its own audit costs;
  • FixSnags may use summaries, certifications, and written responses instead of on-site access where reasonable;
  • any audit must protect the confidentiality, security, and rights of other customers and providers.

On-site audits, if any, are by separate agreement.

17. Liability

The liability provisions in the main agreement apply to this DPA unless a separate written contract states otherwise.

18. Order of precedence

If there is a conflict between this DPA and the main agreement as to data protection matters, this DPA prevails to the extent of that conflict.

19. Contact

Privacy contact: [email protected]
General/support: [email protected]