Data processing agreement

Version 2026-10-30 · Published 30 October 2026

Parties, application and priority

The Project Hero Limited (also referred to as The Project Hero Ltd), company number 11911600, trading as ShiftForest. Company address: 2 Lingwood Gardens, Bradford, England, BD8 9NY, United Kingdom. Contact: hello@theprojecthero.co.uk. This DPA forms part of a customer agreement when incorporated into an accepted order or other recorded agreement. It covers personal data processed on the customer’s behalf in ShiftForest. The customer is the controller and we are the processor, or, where the customer acts as a processor, we are its authorised subprocessor and the customer must hold the necessary controller authorisation. Controller and processor have the meanings in applicable data protection law. This DPA prevails over conflicting commercial terms for covered processing; it does not govern our separate controller activities described in the privacy notice.

Processing schedule: scope and duration

The subject matter is provision and support of workforce scheduling, attendance, leave, document and integration services. Processing includes collection, recording, storage, organisation, retrieval, calculation, display, authorised disclosure/export and instructed return or deletion. Its purpose is operating the customer’s selected workspace features. It continues for the agreement and any limited return, deletion or legally required retention period. The customer decides which features and data are necessary and may issue additional lawful written instructions.

Processing schedule: people and data

Data subjects are the customer’s workers, contractors, managers, administrators and business contacts. Covered data includes identity/contact details, account and workplace identifiers, role/access records, schedules and availability, leave/absence and attendance records, payroll-preparation fields, approvals, uploaded workforce documents, integration references and related audit evidence. Location/device evidence is included only where the customer enables an applicable attendance workflow. Health-related absence or qualification information may be included only on documented instructions supported by an appropriate legal basis and any required special-category condition. Patient/resident care records, biometric identification templates and unrelated sensitive records are not authorised by this schedule.

Instructions and customer responsibilities

We process covered data only on documented customer instructions, including authorised application actions, agreed configuration, this DPA and written support requests, unless applicable law requires otherwise. Where lawful, we notify the customer before processing required by law. We inform the customer if an instruction appears to infringe applicable data protection law and may pause the affected action while it is resolved. The customer remains responsible for lawful collection, notices, instructions, data accuracy, proportionate monitoring and user authorisation. We do not use covered data for our own advertising or unrelated purposes.

Confidentiality and access

We restrict access to authorised people with a service-related need and confidentiality obligations. Privileged access is limited and reviewed as part of operations. The customer is responsible for its own account permissions, devices and integration credentials. Neither party should send passwords, secret keys or unnecessary workforce records in ordinary support messages.

Security measures

We maintain measures appropriate to the nature and risks of processing. The security schedule includes encrypted HTTPS transport; authenticated access and workspace/role checks; restricted service credentials; controls for privileged operations; audit and operational records; validation and rate limits at relevant endpoints; private document access and scanning workflows; and backup and restoration procedures. We review vulnerabilities and investigate incidents. Customer-controlled MFA, roles and device protections are part of shared responsibility. These measures are not a promise of uninterrupted service, a particular recovery objective, independent certification or geographically separate backups unless separately agreed. See security information for current implementation limits.

Subprocessors and changes

The customer gives general written authorisation for the subprocessors identified in the provider schedule for the services it uses. We must bind appointed subprocessors to data-protection obligations appropriate to their work and remain responsible for their performance of those obligations. We will notify the designated customer contact at least 30 days before adding or replacing a subprocessor, except where an urgent legal or security requirement makes that impracticable, when we give notice as soon as practicable. The customer may object on reasonable data-protection grounds within 15 days of notice. We will work to resolve the objection; if no reasonable alternative is available, either party may end the affected service before the change, with a refund of unused prepaid affected fees. A list update alone does not replace required direct notice.

Processing locations and restricted transfers

The order or deployment record must identify applicable hosting regions and authorised provider arrangements. We do not transfer covered data in breach of applicable transfer restrictions. Where needed, the relevant adequacy mechanism or approved contractual safeguards must be documented before that restricted transfer. Publication of this DPA does not itself execute standard contractual clauses or certify a completed transfer assessment. The customer may request the relevant arrangements and safeguards. Customer-directed exports to its own recipients remain the customer’s responsibility.

Individual rights and regulatory assistance

Taking account of the processing and information available to us, we provide reasonable assistance with access, correction, deletion, restriction and portability requests, security duties, impact assessments and regulator consultations. If we receive a request concerning covered data, we notify or direct it to the customer unless prohibited by law and do not respond substantively without instruction, except as legally required. Any charge for exceptional assistance must be reasonable and agreed in advance; it does not excuse a legal obligation or our own failure.

Personal data breaches

We notify the customer without undue delay after becoming aware of a personal data breach affecting covered data. As information becomes available, we describe the nature and affected information, likely consequences, mitigation and a contact for follow-up. We cooperate in investigation and reasonable mitigation, preserve relevant evidence and provide updates. The customer decides on notifications to individuals and regulators unless law requires us to act independently. An unsuccessful attack without compromise is not itself a confirmed personal data breach.

Return, deletion and retained copies

At the end of the relevant service, the customer may choose return or deletion of covered data, subject to applicable law. We will agree the practical export/deletion instructions, act on them and delete remaining copies unless retention is legally required. Lawfully retained data remains protected and used only for that purpose. Backup copies are isolated from ordinary use and removed through the applicable rotation/deletion process; restoration must respect recorded deletion instructions. We provide information about completion, retained categories and any lawful restriction on request. Customer-specific employment retention rules are instructions to be documented, not a reason for indefinite provider retention.

Evidence, audits and term

We make information reasonably necessary to demonstrate compliance with this DPA available and allow customer or mandated independent audits, including inspections where required by applicable law. Routine audits should use reasonable notice, protect other customers’ data and avoid unnecessary disruption; urgent incidents or regulatory requirements are not subject to a restriction that prevents a lawful audit. The parties agree practical scope and confidentiality arrangements. This DPA remains effective while we hold covered data. Liability follows the customer agreement only to the extent permitted by law and does not restrict individuals’ statutory rights or regulator powers.