Console Data Processing Addendum

Last updated: 14 October 2026

1. Scope and parties

This Data Processing Addendum ("DPA") forms part of the Console Terms of Service between Paul Alexander Films Ltd, trading as Console (company number 16949226, registered office Cardigan House Ground Floor, Castle Court, Swansea, Wales, SA7 9LA) ("Console", "we") and the Tenant ("you"). Capitalised terms not defined here have the meaning given in the Terms.

It applies whenever we process personal data on your behalf in providing the Service. For that data you are the controller and we are the processor under the UK GDPR and the Data Protection Act 2018. Where the EU GDPR also applies to you, references to the UK GDPR include it.

If this DPA conflicts with the Terms on a data protection matter, this DPA wins.

2. Details of processing

3. Our obligations as processor

We will:

• process personal data only on your documented instructions, which are the Terms, this DPA, and the settings and actions you take in the Service, unless UK law requires otherwise, in which case we will tell you first where the law allows
• tell you if we think an instruction breaks data protection law
• make sure everyone we authorise to process the data is bound by confidentiality
• put in place the security measures in section 6
• only use sub-processors as set out in section 5
• help you respond to data subject requests and meet your own obligations as set out in sections 7 and 8
• delete or return the data at the end of the Service as set out in section 11
• give you the information needed to show compliance, as set out in section 10

4. Your obligations as controller

You are responsible for the lawfulness of the processing you instruct. In particular you will:

• have a lawful basis for collecting and using the personal data you put into the Service
• give your End Customers and staff the privacy information the UK GDPR requires, including that their data is processed by Console on your behalf
• obtain valid consent, or rely on another lawful basis, before sending marketing emails, SMS, WhatsApp messages or review requests through the Service, and honour opt-outs
• only connect Third-Party Services (Stripe, Square, Meta, Microsoft 365, Google, Xero) that you are entitled to use and have told your data subjects about
• keep your Authorised Users' access appropriate and remove users who leave
• not enter special category data or criminal offence data into the Service
• respond to data subject requests from your own End Customers, using the tools we provide

5. Sub-processors

You give us general authorisation to use the sub-processors below. Each is bound by written terms that give at least the protection in this DPA. We remain responsible to you for their performance.

We will give you at least 30 days' notice by email before adding or replacing a sub-processor. If you have a reasonable data protection objection and we cannot resolve it, you may close your account before the change takes effect and we will refund any Fees paid for the period after closure.

Third-Party Services you choose to connect (Stripe, Square for End Customer payments, Microsoft 365, Google, Xero) are not our sub-processors. They are independent controllers or your own processors under the terms you hold with them.

6. Security measures

We maintain the following measures, which we may update provided the overall level of protection does not fall:

• Tenant isolation. Every table holding Tenant data is protected by row-level security so one Tenant cannot read or write another's data; this is tested as part of our release process
• Encryption. All traffic is encrypted in transit (TLS). Data at rest is encrypted by our hosting providers
• Access control. Role-based access within the Service (owner, manager, staff, customer); administrative access to production systems is limited to Console personnel with multi-factor authentication
• Credentials. Third-party OAuth tokens and API keys are stored with restricted access and never exposed to the browser
• Payment data. Card details are never stored by the Service; they are handled entirely by Stripe or Square
• Backups. Daily database backups with point-in-time recovery, retained on a rolling basis
• Logging. Application and access logs are kept for security monitoring and incident investigation
• Development practice. Code review before deployment, dependency updates, and periodic security review of authentication and data access paths

7. Data subject requests and assistance

If a data subject contacts us directly about data you control, we will not respond on the substance but will pass the request to you within 5 working days.

The Service lets you look up, export and delete a customer's record yourself, which covers most access and erasure requests. Where a request needs something the Service cannot do, we will help at no charge where the effort is reasonable, and otherwise at our standard hourly rate agreed in advance.

We will also give reasonable help with data protection impact assessments and consultations with the ICO, taking into account the nature of the processing and the information we hold.

8. Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any case within 48 hours of confirming it. We will describe what happened, the categories and approximate numbers of data subjects and records affected, the likely consequences, and what we are doing about it, updating you as we learn more.

We will help you meet your own notification duties to the ICO and to data subjects. Notification by us is not an admission of fault.

9. International transfers

Your data is stored in the UK or EU. Some sub-processors in section 5 process data in the United States. For those transfers we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on the UK extension to the EU-US Data Privacy Framework where the provider is certified. We will not transfer your data to a country outside the UK or EU on any other basis without your consent.

10. Audit and records

On written request, no more than once a year unless a breach or a regulator requires it, we will give you the information reasonably needed to show that we meet this DPA, such as our security measures, sub-processor terms and relevant certifications from our hosting providers. If that is not enough, you may carry out an audit at your cost, on at least 30 days' notice, during business hours, limited to the systems that process your data, and subject to confidentiality. We keep a record of the processing we carry out on your behalf as the UK GDPR requires.

11. Return and deletion

You can export your customer, booking and membership data from the Service at any time while your account is open. When your account closes, we keep your data for 30 days so you can recover it or ask for a final export, then delete it from live systems. Copies in backups are overwritten on our rolling backup schedule and are not restored except for disaster recovery. We may keep records that the law requires us to keep, such as billing records, for as long as that law requires.

12. Liability and general

Our liability under this DPA is subject to the limits in section 12 of the Terms. Each party is liable for its own breaches of data protection law and for any regulatory fines imposed on it.

This DPA lasts for as long as we process personal data for you and is governed by the law of England and Wales. We may update it to reflect changes in law or in the Service, and will tell you by email at least 30 days before a material change takes effect.

Contact for data protection matters: hello@getconsole.app