This data processing agreement (“DPA”) sets out how Pitlamp LTD (“Pitlamp”, “we”) processes personal data on behalf of a customer that uses the Pitlamp application (“you”, the “customer”). It forms part of our customer terms (the “Main Agreement”) and is accepted when you accept them. If the two conflict on data protection, this DPA takes priority. If your organisation needs a signed copy, email hello@pitlamp.com.
Last updated: 23 October 2026.
1. Parties, roles and definitions
1.1 The processor is Pitlamp LTD, company number 17508537, registered office 108a Manor Green Road, Epsom, Surrey, KT19 8LN. The controller is the organisation that accepted the Main Agreement.
1.2 In this DPA:
- Data Protection Law means the UK GDPR, the Data Protection Act 2018 and any law that amends, supplements or replaces them.
- Controller, processor, data subject, personal data, processing and personal data breach have the meanings given in Data Protection Law.
- Customer Personal Data means personal data that your Users put into the Service, or that we create about them while providing it, as described in Schedule 1.
- Sub-processor means a third party we engage to process Customer Personal Data.
- Service and User have the meanings given in the Main Agreement.
1.3 For Customer Personal Data you are the controller and we are your processor. We are a separate controller for the personal data we need to run our own business, such as billing contacts and account administration, and for the security records and diagnostics we use to run, secure and improve the Service, as described in our privacy policy.
2. Our obligations
These follow Article 28(3) of the UK GDPR. We will:
2.1 Instructions. Process Customer Personal Data only on your documented instructions, including on transfers outside the UK, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it). The Main Agreement, this DPA and your Users’ use of the Service’s features are your instructions. We will tell you immediately if we believe an instruction breaks Data Protection Law.
2.2 Confidentiality. Ensure that everyone authorised to process Customer Personal Data is bound by confidentiality.
2.3 Security. Take the measures required by Article 32 of the UK GDPR, including those in Schedule 2, and not reduce the overall level of protection during the Main Agreement.
2.4 Sub-processors. Use only the sub-processors in Schedule 3, which you authorise generally. We will give your Administrators at least 30 days’ notice by email of any new or replacement sub-processor, so you can object on reasonable data protection grounds. If we cannot resolve your objection, you may end the Main Agreement without penalty before the change takes effect. We impose data protection obligations on each sub-processor by contract that are no less protective than this DPA, and we remain liable to you for their performance.
2.5 Data subject requests. Help you, by appropriate technical and organisational measures, to respond to requests from data subjects exercising their rights. Your Administrators can export Customer Personal Data and disable Users themselves. If we receive a request directly, we will pass it to you without undue delay and will not respond to it except to say it has been passed on.
2.6 Other assistance. Help you meet your obligations on security, personal data breach notification, data protection impact assessments and prior consultation with the Information Commissioner, taking into account the nature of the processing and the information available to us.
2.7 Personal data breaches. Notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed, with further details as they become available. Notifying you is not an admission of fault.
2.8 End of the Service. At the end of the Main Agreement (including where it ends under section 4.3 of it), keep Customer Personal Data available for you to download for 30 days, then delete it within a further 60 days, unless the law requires us to keep it. Copies in database backups are overwritten within 7 days and deleted files are purged within 30 days. We will confirm deletion in writing on request.
2.9 Information and audits. Make available all information necessary to demonstrate compliance with Article 28 of the UK GDPR, and allow for and contribute to audits, including inspections, by you or an independent auditor you appoint who is bound by confidentiality. Audits need 30 days’ written notice, take place during working hours no more than once in any 12 months (unless required by a regulator or following a personal data breach), avoid disrupting our operations or other customers’ data, and are at your cost. We may first answer with written information, such as completed security questionnaires and our sub-processors’ certifications (for example Microsoft’s ISO/IEC 27001 and SOC 2 reports), and you agree to consider whether that is enough before asking for an inspection.
3. Your obligations
3.1 You will ensure you have a lawful basis for the Customer Personal Data your Users put into the Service, that the people concerned are given the information the law requires, and that your instructions comply with Data Protection Law.
3.2 You will not ask your Users to store special category data, criminal records data, passwords or other secrets in the Service. The Service warns Users about likely credentials, but you decide what your team stores.
4. International transfers
4.1 Customer Personal Data is stored and processed in Microsoft Azure’s UK South region (London).
4.2 We will not transfer Customer Personal Data outside the UK, or allow a sub-processor to, unless the transfer complies with Data Protection Law: to a country covered by UK adequacy regulations, or under the International Data Transfer Agreement or the International Data Transfer Addendum to the EU standard contractual clauses issued by the Information Commissioner, with a transfer risk assessment where required.
4.3 Microsoft may access data from outside the UK in limited cases, such as to provide support or to keep its services secure. Those transfers are covered by Microsoft’s Products and Services Data Protection Addendum, which relies on the UK Extension to the EU-US Data Privacy Framework and the safeguards in 4.2.
5. Liability, term and law
5.1 Each party’s liability under this DPA is subject to the limits and exclusions in the Main Agreement. Nothing in this DPA limits either party’s liability to data subjects or the Information Commissioner where the law does not allow it to be limited.
5.2 This DPA lasts as long as we process Customer Personal Data for you. Provisions that by their nature should survive, such as deletion, confidentiality and audit of past processing, survive its end.
5.3 We may update this DPA to reflect changes in Data Protection Law, guidance from the Information Commissioner, or our sub-processors (under 2.4), by giving your Administrators at least 30 days’ notice. No update will reduce the protection given to Customer Personal Data. Any other change needs both parties’ written agreement.
5.4 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Schedule 1: Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing Pitlamp, an IT operations workspace: daily checklists, to-dos, projects, Kanban board, knowledge base, contacts, reports, notifications, end-of-life, security update and vendor outage tracking, licence and certificate expiry reminders, and importing tasks from other tools |
| Duration | The term of the Main Agreement, plus the download and deletion periods in 2.8 |
| Nature of processing | Hosting, storage, retrieval and display in the Service; sending account and notification emails; scheduled reports; backup and restore; security logging; deletion |
| Purpose | To provide the Service to your team, keep it secure, and support you |
| Data subjects | Your Users (your staff and contractors); other people your Users record in content, such as colleagues, suppliers’ staff kept as contacts, and people named in task lists imported from other tools |
| Account data | Name, work email address, role, time zone, theme and notification preferences, password hash, encrypted authenticator key, recovery codes, sign-in and lockout state |
| Content | Whatever Users enter: checklist results, comments and evidence, cards, comments, to-dos, projects, knowledge articles, reports, file attachments, contacts (names, companies, roles, phone numbers, email addresses and other details you choose), expiry records, and files uploaded to import tasks from other tools. This may include names, contact details and system details such as hostnames |
| Security records | Audit log of sign-ins, failed sign-ins, multi-factor changes, invitations, role changes, exports, deletions and other changes, with the User, time and IP address. Application diagnostics (errors and request timings) |
| Special category data | None intended. You must not ask your Users to store it |
| Retention in the Service | Content until you delete it or the Main Agreement ends (then as in 2.8). Audit log for the period an Administrator sets (90 days to 10 years; 365 days by default). Diagnostics 30 days. Backups 7 days. An uploaded import file’s contents until the import runs or is discarded, and never more than 7 days |
Schedule 2: Security measures
| Area | Measures |
|---|---|
| Sign-in | Multi-factor authentication with an authenticator app is mandatory for every User, enrolled at first sign-in, with no way to skip it. Passwords of at least 12 characters, checked against common and easily guessed passwords. Account lockout after repeated failures. Rate limits on sign-in, multi-factor, password reset and invitation requests. Accounts are created only by invitation, or by self-serve sign-up for a new organisation after the email address is confirmed |
| Sessions | Secure, HttpOnly cookies. Sessions end after 12 hours of inactivity and 7 days at most. Password resets and disabled accounts end other sessions within minutes. Sensitive actions (exports, user and role changes, audit settings) need the password or an authenticator code again within 5 minutes |
| Separation between customers | Every customer-owned record carries the customer’s identifier, set by the server from the signed-in User. The application filters every query by it, and SQL row-level security enforces the same rule in the database as a second, independent control. Automated tests try to read, list, change and delete another customer’s data before every release |
| Encryption | HTTPS only, with HSTS and TLS 1.2 or later. Database and file storage encrypted at rest by Microsoft Azure |
| Infrastructure | Azure UK South. The database has no public network access and accepts Microsoft Entra ID sign-in only, with no SQL passwords. File storage accepts Entra ID only, with shared keys disabled. Application secrets are held in Azure Key Vault and reached by managed identity |
| Least privilege | The application’s database identity can read and write data but not change the schema, and can delete audit entries only through a procedure that keeps at least 90 days. Schema changes run from the deployment pipeline under a separate identity |
| Application security | Parameterised database queries only. All user content is encoded on output. Anti-forgery tokens on every change. Security headers including a content security policy. Uploaded files are checked by type and opened in the browser only when they are images or PDFs |
| Audit and monitoring | Append-only audit log per customer, visible to the customer’s managers and Administrators. Health checks, availability tests and alerts on the production service |
| Resilience | Point-in-time database restore for 7 days. Deleted files recoverable for 30 days. New versions are health-checked before they receive traffic, and can be rolled back |
| Development | Code changes go through pull requests and an automated test run before deployment. Dependency and container updates are reviewed weekly. Our administrator accounts use multi-factor authentication |
| People | Access to production systems is limited to the people who need it, currently our director, and is protected by multi-factor authentication. Anyone given access is bound by confidentiality and given the minimum access needed |
Schedule 3: Sub-processors
| Sub-processor | Service | What it processes | Location |
|---|---|---|---|
| Microsoft Ireland Operations Ltd (Microsoft Azure) | Container Apps, Azure SQL Database, Blob Storage, Key Vault | All Customer Personal Data: hosting, database, attachments, backups | UK South (London) |
| Microsoft Ireland Operations Ltd (Azure Communication Services) | Sending email from mail.pitlamp.com | Recipient names and addresses, and email content: invitations, password resets, notifications, reminders | UK |
| Microsoft Ireland Operations Ltd (Azure Monitor and Application Insights) | Diagnostics and alerts | Error details and request telemetry, which can include User and customer identifiers and IP addresses; kept 30 days | UK South (London) |
Microsoft’s terms are the Microsoft Products and Services Data Protection Addendum.
Our website host and email provider, and our source code host, are not sub-processors: they hold no data from the Service. If you email personal data to our support address, we handle it under our privacy policy.