Legal
Data Processing Agreement
Last updated October 2, 2026
This Data Processing Agreement ("DPA") forms part of the agreement between BrainBoxIT Limited (trading as Hovermarks; the "processor"), a company registered in England and Wales (company number 11703272) with registered office at 6 Range Green, Portsmouth, PO2 8RE, United Kingdom, and the customer (the "controller") for the provision of the Hovermarks platform.
It reflects the requirements of the UK GDPR, the EU GDPR (where applicable), and the UK Data Protection Act 2018.
1. Roles
The customer is the data controller for any personal data processed within their tenant. BrainBoxIT Limited (trading as Hovermarks) is the data processor and will only process personal data on the customer's documented instructions.
2. Subject matter and duration
- Subject matter: provision of the Hovermarks inspection, compliance, and maintenance platform.
- Duration: the term of the underlying agreement. After it ends, customer data is returned and deleted as described in section 8.
- Categories of data subjects: customer's employees, contractors, and (where the customer chooses) end-customers, tenants, or visitors interacting with assets.
- Categories of personal data: name, email, role, IP address, location (GPS coordinates recorded when an inspection is submitted, where the device allows it), photographs taken during inspections, and digital signatures.
3. Sub-processors
The customer authorises Hovermarks to engage the sub-processors listed at hovermarks.com/legal/subprocessors (or hovermarks.co.uk/legal/subprocessors for UK customers). That page is the canonical, version-controlled register and is the document referred to throughout this DPA. The summary below is provided as a snapshot at the date of this DPA, the canonical register at the URL above takes precedence in case of any inconsistency.
We provide 30 days' prior notice of any addition or replacement of a sub-processor, by email to the controller's TenantAdmin contacts. The controller may object on reasonable grounds during that window; if we cannot accommodate the objection, the controller may terminate the affected service without penalty.
Snapshot at the date of this DPA:
| Sub-processor | Purpose | Region |
|---|---|---|
| Microsoft Azure | Hosting, storage, identity (Azure Postgres Flexible Server, Blob Storage, Container Apps) | UK |
| Microsoft Entra External ID | Customer authentication / SSO (CIAM) | UK / EU |
| Microsoft Entra ID | Platform-admin authentication / SSO | UK / EU |
| Microsoft Graph | Transactional and notification email via Microsoft 365 | UK / EU |
| Azure AI Vision | Inspection photo quality gate and serial-plate reading (opt-in AI features) | UK |
| Azure AI Document Intelligence | Certificate text extraction (opt-in AI feature) | UK |
| Azure OpenAI Service | Serial-plate reading, certificate text extraction, natural-language asset search, AI report summary and checklist generator (opt-in AI features). Microsoft's standard abuse monitoring applies; prompts and outputs are never used to train models. | Resource in UK South; Global Standard deployment, so processing may take place in other Azure regions |
| Cloudflare, Inc. | DNS, edge proxy, Turnstile bot-protection on the public fault-report form | EU / US |
| Plausible Analytics | Marketing-site analytics ONLY (the in-app dashboard does not run Plausible) | EU |
| Stripe, Inc. | Payment processing (PCI-DSS Level 1). Live for all paying customers. | US / EU |
Customer-controlled outbound integrations
Some platform features let the controller authorise an outbound flow of data to a third-party system the controller has its own contractual relationship with; for example, an accounting integration (such as Xero, coming soon) would let a TenantAdmin push issued invoices to their accounting system. These outbound flows are not Hovermarks sub-processors:
- Hovermarks acts only as a conduit, transmitting data to the third party under tokens held on behalf of the controller.
- The controller's relationship with the third party (Xero in this example) is governed by the controller's separate contract and privacy notice with that third party.
- The controller can disconnect the integration at any time in the Hovermarks dashboard, after which no further outbound calls are made.
4. Security measures
Hovermarks implements appropriate technical and organisational measures, including:
- TLS 1.2+ in transit. Encryption at rest: AES-256 with Azure-managed keys. Customer-managed keys may be configured for bespoke Enterprise engagements.
- Multi-tenant logical isolation enforced at every database query via per-row tenant filtering, audited centrally.
- Microsoft Entra-based identity on every account: MFA is enforced on every sign-in by Conditional Access on the Hovermarks identity tenant. Bring-your-own Microsoft Entra ID SSO via OIDC + PKCE is available on Professional and Enterprise; the customer's own Conditional Access policies layer on top of the always-on Hovermarks MFA.
- Role-based access control and an immutable audit log of all admin and inspector actions.
- Internal multi-agent security review run at least quarterly and after any material architecture change; internal review reports are available to Enterprise customers under NDA. Commissioning an independent external penetration test is on the post-GA roadmap.
- Incident response process with notification to controllers within 72 hours of becoming aware of a breach affecting their data.
5. International transfers
Customer data is hosted in Microsoft Azure (UK) and is not replicated outside the UK without the controller's written consent. If the controller turns on the opt-in AI features, text sent to Azure OpenAI Service may be processed in Azure regions outside the UK (Microsoft's Global Standard deployment type); it is not stored outside the UK. Where corporate functions require transfers (e.g. transactional email), they are governed by the UK International Data Transfer Agreement and/or the EU Standard Contractual Clauses, as applicable.
6. Data subject rights
Hovermarks provides controllers with self-service tools to handle access, rectification, restriction, portability, and erasure requests within their tenant. Where the controller cannot fulfil a request via the platform, Hovermarks will assist on request.
7. Audit
Once per 12 months, on 30 days' notice and at the controller's cost, the controller may audit Hovermarks's compliance with this DPA, subject to confidentiality. Hovermarks will share its trust packet (penetration test summary, architecture diagrams, sub-processor list) under NDA in lieu of an on-site audit where the controller agrees.
8. Return and deletion
On termination, or on the controller's request, the controller's organisation is deleted. Access stops immediately and its data is held for 30 days, during which the controller can ask for it to be restored or for a copy of its data.
At the end of the 30 days, Hovermarks permanently erases the controller's data from production systems, including stored files and user accounts. On request (for example under Article 17) this can be done immediately.
Recoverable copies expire within 30 days of erasure: database point-in-time backups are kept for 7 days (with a geo-redundant copy in Azure UK West), and deleted-file storage for 30 days.
Hovermarks keeps a minimal deletion record (organisation name, reference number, dates and reason) as evidence of the erasure. Hovermarks will provide written confirmation of deletion on request.
Contact
DPO / data protection contact: [email protected].
Postal correspondence: BrainBoxIT Limited, 6 Range Green, Portsmouth, PO2 8RE, United Kingdom (mark for the attention of "Hovermarks Data Protection").
This document was last updated on 2 October 2026.
Changes on 1 October 2026: section 2 (duration and categories of data) and section 8 (return and deletion) updated.
Changes on 2 October 2026: section 3 (Azure AI Speech removed from the snapshot; Azure OpenAI Service region and abuse-monitoring wording corrected; Xero given as a coming-soon example) and section 5 (opt-in AI processing outside the UK) updated.
This document reflects current Hovermarks processing. Final wording is under review by our DPO and external counsel; material changes will be re-published here with a version note.