Data Processing Agreement

JobEng · operated by SESYSY LIMITED (company no. 15828843)
Version 1.0, 4 October 2026. Part of the Terms of Service for every business customer; it applies automatically when a business account is created.

Parties: the business customer ("Customer", controller) and SESYSY LIMITED, trading as JobEng ("JobEng", processor). This agreement meets Article 28 of the UK GDPR.

1. Roles and scope

The Customer is the controller of personal data it puts into JobEng or collects through it (Customer Data). JobEng processes Customer Data only to provide the service. Annex 1 describes the processing.

2. Instructions

JobEng processes Customer Data only on the Customer's documented instructions: these terms, the Customer's settings and its use of the service. JobEng tells the Customer if an instruction appears to break data protection law, unless the law forbids it.

3. Confidentiality

People at JobEng who can access Customer Data are bound by confidentiality and access it only when needed to run, support or secure the service.

4. Security

JobEng applies the measures in Annex 2 and keeps them appropriate to the risk.

5. Sub-processors

The Customer gives general authorisation for the sub-processors in Annex 3. JobEng gives at least 30 days' notice of a new sub-processor at jobeng.ai/subprocessors and by e-mail; the Customer may object on reasonable data-protection grounds and, if no solution is found, cancel the affected service with a pro-rata refund. JobEng puts the same data protection obligations on each sub-processor and remains responsible for them.

6. International transfers

JobEng transfers Customer Data outside the UK only to countries with UK adequacy regulations, under the UK–US data bridge, or under the UK International Data Transfer Agreement or Addendum.

7. Helping the Customer

JobEng provides tools to answer data subjects' requests (export, erasure, retention, applicant request inbox) and helps further on reasonable request. JobEng passes on any request it receives directly within 5 working days and does not answer it itself unless authorised. JobEng gives reasonable help with security, breach notifications, impact assessments and consultations with the ICO.

8. Personal data breaches

JobEng tells the Customer without undue delay, and in any case within 48 hours, of becoming aware of a breach affecting Customer Data, with the facts then known, and keeps it updated.

9. End of the service

For 30 days after the account closes the Customer can export its data. JobEng then deletes Customer Data within a further 30 days and from backups within 90 days, unless the law requires it to be kept.

10. Audits

JobEng provides the information needed to show it meets this agreement, including security certificates when held and summaries of tests. Where that is not enough, the Customer may audit once a year with 30 days' notice, at its own cost and under confidentiality.

11. Liability and precedence

The liability terms of the Terms of Service apply. If this agreement conflicts with the Terms of Service on data protection, this agreement prevails.

Annex 1 — Description of processing

Annex 2 — Security measures

• HTTPS (TLS) for all traffic; passwords hashed; sessions checked on every request against the session store, fail closed.
• Each company's data separated by company ID on every query; access limited by role.
• Daily backups, with off-site copies (Backblaze B2) kept 90 days; restores tested.
• Server access by key only; administrator access logged and limited to named staff.
• Rate limits, spam checks and 48-hour e-mail confirmation on public forms.
• AI providers receive only the text a task needs; no budgets, bank details or client names from projects.
• Cyber Essentials certification planned.

Annex 3 — Sub-processors