This Data Processing Agreement (DPA) forms part of the Terms of Service between the customer (the Customer) and Crazy Cat Software Limited, trading as One Big Team (One Big Team), a company registered in England and Wales under company number 15029972, whose registered office is at 2nd Floor, Market House, Market Square, Aylesbury, Buckinghamshire HP20 1TN.
This DPA applies where One Big Team processes personal data on the Customer's behalf in connection with the One Big Team service. It becomes binding when the Customer accepts the Terms of Service or otherwise enters into an agreement that incorporates it.
1. Roles and instructions
The Customer is the controller and One Big Team is the processor of Customer personal data, except where applicable law requires otherwise. One Big Team will process Customer personal data only:
- on the Customer's documented instructions, including instructions given through authorised use and configuration of the service;
- as necessary to provide, secure, maintain and support the service; or
- where required by applicable law, in which case One Big Team will notify the Customer before processing unless the law prohibits that notification.
One Big Team will promptly inform the Customer if, in its reasonable opinion, an instruction infringes applicable data protection law.
2. Customer responsibilities
The Customer is responsible for ensuring that its instructions and use of the service comply with applicable law. This includes providing required privacy information, establishing a lawful basis for processing, obtaining personal data lawfully, responding to data subjects and restricting access to authorised users.
Where the Customer processes special-category personal data, it is responsible for identifying an applicable Article 9 condition and meeting any additional legal requirements. Equal-opportunities information should be collected and used only for lawful monitoring and reporting purposes and should be voluntary where required by law.
3. Confidentiality
One Big Team will ensure that people authorised to process Customer personal data are subject to appropriate confidentiality obligations and receive access only where necessary for their role.
4. Security
One Big Team will maintain appropriate technical and organisational measures designed to protect Customer personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The measures are described in Schedule 2 and may be updated as technology and risk change, provided the overall level of protection is not materially reduced.
5. Personal data breaches
One Big Team will notify the affected Customer without undue delay after becoming aware of a personal data breach involving Customer personal data and, where practicable, within 48 hours. The notification will include available information about the nature of the breach, its likely consequences, measures taken or proposed, and a contact for further information. Where all details are not immediately available, information may be provided in stages.
One Big Team will take reasonable steps to contain, investigate and mitigate the breach and will provide reasonable cooperation. The Customer remains responsible for deciding whether the Information Commissioner's Office, another regulator or affected individuals must be notified.
6. Data-subject requests
Taking into account the nature of the processing, One Big Team will provide reasonable assistance to the Customer in responding to requests from data subjects exercising their rights under applicable data protection law.
If One Big Team receives a request directly relating to Customer personal data, it will promptly forward the request to the relevant Customer and will not respond substantively unless instructed by the Customer or required by law.
7. Compliance assistance
Taking into account the nature of the processing and information available to it, One Big Team will provide reasonable assistance with the Customer's obligations concerning security, breach notifications, data protection impact assessments and prior consultation with a supervisory authority.
8. Subprocessors
The Customer gives One Big Team general written authorisation to appoint subprocessors to help provide the service. One Big Team will:
- maintain a current list on the Subprocessors page;
- impose written data-protection obligations on each subprocessor that are no less protective than the relevant obligations in this DPA; and
- remain responsible for the subprocessor's performance of those obligations to the extent required by applicable law.
One Big Team will provide at least 30 days' notice before appointing or replacing a subprocessor, normally by email and publication on the Subprocessors page. The Customer may raise a reasonable objection on data-protection grounds during that period. The parties will work in good faith to resolve the objection. Where advance notice is not reasonably possible because of an urgent security, legal or operational requirement, One Big Team will provide notice as soon as practicable.
9. International transfers
One Big Team will not transfer Customer personal data outside the United Kingdom unless the transfer complies with applicable data protection law.
Where Customer personal data is transferred to a country covered by UK adequacy regulations, One Big Team may rely on those regulations. Where no applicable adequacy regulations exist, One Big Team will ensure that an appropriate safeguard is in place. This may include the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or another legally recognised transfer mechanism.
Where required, One Big Team will complete an appropriate transfer risk assessment and implement additional technical, contractual or organisational safeguards. One Big Team will require its subprocessors to apply equivalent protections to international transfers they undertake.
10. Return, export and deletion
At the Customer's choice, One Big Team will make available the self-service exports supported by the service and will provide reasonable assistance to return other Customer personal data in an available standard format before account closure. Export requests should be made before the 30-day account recovery period following cancellation ends. Subject to applicable law, One Big Team will disable ordinary access at the end of that period and complete deletion of the Customer's active database records and stored files through its controlled deletion process.
Residual copies may remain in encrypted, access-restricted provider backups until the applicable backup retention cycle expires. Backup data is isolated from ordinary use and will be restored only where reasonably required for disaster recovery. If a backup is restored, deletion instructions that remain applicable will be reapplied. One Big Team will provide the applicable maximum backup retention period on request and will not extend it for the purpose of retaining deleted Customer personal data.
One Big Team may retain limited information where necessary to comply with legal obligations or establish, exercise or defend legal claims, including applicable billing and tax records.
11. Audit and compliance information
One Big Team will make available information reasonably necessary to demonstrate compliance with its obligations under this DPA. Where that information is insufficient, the Customer may conduct an audit on reasonable notice, subject to appropriate confidentiality requirements, minimal disruption and reasonable limits on frequency and scope.
The Customer will bear its audit costs unless the audit identifies a material breach of this DPA by One Big Team. Audits must not compromise the security, confidentiality or rights of other customers or individuals.
12. General terms
If this DPA conflicts with the Terms of Service on the processing of Customer personal data, this DPA takes precedence. Liability arising under this DPA is subject to the exclusions and limitations in the Terms of Service, except where applicable law does not permit such limitation.
This DPA is governed by the law and jurisdiction specified in the Terms of Service.
Questions about this DPA can be sent to privacy@onebigteam.co.uk.
Schedule 1: Details of processing
Subject matter and purpose
One Big Team processes personal data as necessary to provide, secure, maintain and support the One Big Team HR software service in accordance with the Customer's documented instructions.
Duration
Processing continues for the term of the Customer's agreement, during the agreed 30-day account recovery period and for the limited period required to complete controlled deletion. Personal data may remain in encrypted, access-restricted provider backups until the applicable backup retention cycle expires, unless retention is required by law.
Data subjects
Customer personal data may relate to:
- Customer administrators and authorised users;
- current and former employees, workers and contractors;
- job applicants and candidates;
- emergency contacts;
- managers, interviewers and other people identified in Customer-created records; and
- other individuals whose information the Customer lawfully enters into the service.
Categories of personal data
Depending on how the Customer uses the service, personal data may include:
- names, contact details, addresses and account identifiers;
- dates of birth, nationality and gender information;
- employment details, employee numbers, roles, departments, locations and reporting relationships;
- working patterns, attendance, leave and absence records;
- compensation, salary and employment-history information;
- recruitment records, applications, interview information and CVs;
- onboarding, probation, promotion and offboarding records;
- emergency-contact information;
- equal-opportunities monitoring information;
- tasks, notes, correspondence and Customer-created records;
- uploaded documents and profile photographs;
- authentication, security and audit information; and
- technical information required to operate and secure the service.
Equal-opportunities monitoring data
Where enabled by the Customer and voluntarily supplied by the data subject, the service may process:
- gender;
- self-described gender;
- married or civil-partnership status;
- ethnicity;
- self-described ethnicity;
- disability or health-condition status;
- disability impact or comments;
- sexual orientation;
- self-described sexual orientation;
- religion or belief; and
- self-described religion or belief.
Some of this information is special-category personal data, including information concerning health or disability, racial or ethnic origin, sexual orientation, and religious or philosophical beliefs. Self-described fields will be treated with the same level of protection as their related sensitive category.
Other special-category and sensitive data
The service may process health and sickness information, fit notes, and other special-category or sensitive personal data that the Customer chooses to enter or upload. This may include information contained in free-text notes, recruitment records and employee documents.
Processing activities
Processing may include collecting, recording, organising, storing, retrieving, viewing, updating, reporting, transmitting, backing up, restricting, exporting and deleting personal data as necessary to provide the service.
Schedule 2: Technical and organisational measures
The measures below describe the controls required for the production service. Any control that depends on production infrastructure, including independent file backups and additional protection for equal-opportunities data, must be implemented and tested before live Customer personal data is processed.
Access control and authentication
- Users must authenticate before accessing the service.
- Authentication is provided through Supabase Auth; One Big Team does not store user passwords.
- Role, permission, scope, hierarchy and resource-ownership checks restrict access according to business need.
- Sensitive operations require elevated permissions, and administrative access is restricted to authorised personnel.
- Access can be revoked when no longer required.
Tenant and data isolation
- Each user is associated with a Customer organisation after authentication.
- The server resolves and validates the organisation context and does not rely solely on Customer-supplied identifiers.
- Authorisation controls prevent users from accessing another Customer's records.
- Company-isolation and authorisation behaviours are covered by automated tests.
Encryption and transmission
- Personal data is encrypted in transit using HTTPS.
- Production database and storage services encrypt data at rest.
- Private file storage and time-limited signed access links are used for Customer documents.
- Additional protection is applied to particularly sensitive information where appropriate to the risk, including equal-opportunities data.
- Encryption keys and service credentials are kept separately from application source code and access is restricted.
Logging and auditability
- Major business and security-relevant actions are recorded in audit history.
- Audit records are designed to be immutable, searchable and available for authorised review.
- Logs use identifiers needed for investigation while sensitive values must be excluded or redacted.
- Application, authentication and background-processing failures are monitored.
Availability, backup and recovery
- Production database backups are maintained through the database hosting provider once configured and verified for the live environment.
- Any independent Customer-file backup service must be implemented, contractually approved and restoration-tested before it is described as an active production control.
- Backup retention is configured according to the documented production recovery and deletion schedule.
- Backup access is restricted and backups are used only for disaster recovery.
- Recovery procedures are documented and restoration is tested periodically.
- Health checks and monitoring are used to identify service and dependency failures.
Secure operation and development
- Production, staging, test and development environments use separate configuration and credentials.
- Secrets are stored outside source control using environment-appropriate secret storage.
- Automated unit, integration, end-to-end and architecture tests cover business-critical and security-sensitive behaviour.
- Software dependencies and known vulnerabilities are reviewed and addressed according to risk.
- Changes are subject to automated build and test checks before deployment.
Incident management and resilience
- Security incidents are investigated, contained and mitigated through an incident-response process.
- Structured logging, health checks and operational monitoring support detection and diagnosis.
- Systems are designed to fail safely, avoid data corruption and preserve audit history.