Data processing agreement
Effective date: 12 November 2026
This agreement is between your company (the controller) and KLO Technical Services Limited, trading as KLO Development Services, company number 16105032, 23 Brook Road, Bomere Heath, Shrewsbury, Shropshire, SY4 3PU (the processor, "KLO"). It forms part of the BR Info Schedule terms of use, and applies while KLO keeps personal data in your company's account. KLO is registered with the Information Commissioner's Office, reference ZC299134.
1. What KLO processes
| Subject matter | Keeping your company's BR Info Schedule library on KLO's server, so the people in your company's account can use it |
| Duration | While your company has a trial or licence, and for up to 12 months after it ends (or until your company deletes its data, if sooner) |
| Nature and purpose | Storing, sharing between your company's people and devices, and deleting; nothing else |
| Personal data | Names, email addresses and roles of your company's people; names, contact names and email addresses of the parties on your company's projects; anything your company types into notes; the project history (who changed what, and when); and competence profiles your people choose to fill in (qualifications, memberships, project experience, training and examples) |
| Data subjects | Your company's staff, and staff of the companies on its projects |
2. KLO's commitments
KLO will:
- Process the data only on your company's instructions, which are these terms and what your company does in the app, unless UK law requires otherwise (KLO will tell you first, if allowed).
- Keep it confidential. Only KLO's own staff can reach the server, and only to run and support it.
- Keep it secure:
- every request is checked against the person's sign-in, through Microsoft or through KLO's own email sign-in;
- each company's data is kept apart, and every read and write is limited to the person's own account;
- data travels encrypted (HTTPS), and Cloudflare encrypts it at rest.
- Use only the sub-processors listed below, and tell your company before adding or changing one, so it can object.
- Help your company answer people's requests about their data. The app's own tools (Download my data, Leave this account, Delete this company's data) cover most of them.
- Tell your company without undue delay after becoming aware of a personal data breach affecting its data, with what KLO knows.
- Delete the data when the service ends, as the privacy notice describes. Your company can take a copy first (Settings › Backups › Export a backup file).
- Give your company what it reasonably needs to show this agreement is kept to, and answer its reasonable questions.
3. Sub-processors
| Who | What for | Where |
|---|---|---|
| Cloudflare, Inc. (Workers, D1, Pages) | Runs KLO's server and database, and hosts the web page | Database in Western Europe; requests served from Cloudflare's nearest location |
Microsoft isn't KLO's sub-processor: it provides your company's own Microsoft 365, under your company's own agreement with Microsoft. The app uses it to sign people in, to send schedules from their own mailboxes and, with Document Control, to make evidence sites and folders in your company's SharePoint and invite parties' contacts there as guests.
4. International transfers
Cloudflare, Inc. is a US company. Transfers to it are covered by the UK's adequacy regulations for the EU–US Data Privacy Framework (UK extension) or the UK International Data Transfer Addendum, as Cloudflare offers.
5. Your company's commitments
Your company makes sure it may lawfully put the personal data into BR Info Schedule, and that the parties it emails expect to hear from it.
Contact
KLO Development Services, 23 Brook Road, Bomere Heath, Shrewsbury, Shropshire, SY4 3PU. Email: [email protected].