Data Processing Agreement

Version 2026-10-06 · Hospitality Ops Pro is operated by 9495 Creative Ltd, London, United Kingdom.

This agreement forms part of the Terms of service and meets Article 28 of the UK GDPR. "Customer" is the business holding the account and is the controller. "Provider" is 9495 Creative Ltd and is the processor.

1. Subject matter and duration

Provider processes personal data in the course of providing Hospitality Ops Pro, for as long as the Customer has an account and for the 90-day export period after it ends.

2. Nature, purpose and categories

Storing, displaying, calculating and transmitting personal data to run rotas, timekeeping, pay estimates, holiday, staff documents, takings, suppliers and bookings. Data subjects: Customer's staff, managers, accountants and, for deposits, Customer's own customers. Categories: identity and contact details, employment details, pay, working time, right-to-work and training evidence, and limited booking details. Special category data is not required; Customer should not upload it.

3. Provider's obligations

• Process data only on Customer's documented instructions, which include the use of the service as designed.
• Ensure people with access are bound by confidentiality.
• Apply the security measures in the Privacy policy: encryption in transit, encrypted sensitive fields, hashed passwords, audit logging, nightly encrypted backups, least-privilege access.
• Use only the sub-processors listed in the Privacy policy and give 30 days' notice of changes; Customer may object, in which case either side may end the agreement.
• Help Customer respond to data subject requests with the export and anonymise tools in the service, and help with any impact assessment on request.
• Tell Customer without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach, with the facts, likely effects and measures taken.
• Delete or return all personal data at the end of the service, unless UK law requires retention.
• Make available the information needed to show compliance and allow audits by Customer or an auditor it appoints, once a year on reasonable notice, at Customer's cost.

4. International transfers

Data is hosted in the United Kingdom. Where a sub-processor is outside the UK (email delivery, invoice reading), transfers rely on the UK International Data Transfer Agreement or UK adequacy regulations.

5. Customer's obligations

Customer warrants it has a lawful basis for the data it enters, has told its staff by showing them the staff notice, and gives lawful instructions.