Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the business customer ("Controller", "you") and TeZe Ltd (company number 17137231), trading as Batch ("Processor", "we"), and governs our processing of personal data on your behalf when you use the Service. It is incorporated into our Terms of Service.

1. Roles of the parties

For the staff personal data you upload or generate using the Service (such as employee names, contact details, availability, and shift records), you are the Controller and we are the Processor. Each party will comply with its obligations under the UK GDPR and the Data Protection Act 2018.

2. Scope and instructions

We process personal data only on your documented instructions, which include providing the Service, building rotas, sending notifications, and supporting your account. We will tell you if, in our opinion, an instruction infringes data protection law.

3. Nature and purpose of processing

• Subject matter: provision of staff scheduling and management software.
• Duration: for the term of your subscription, plus the retention period below.
• Categories of data subject: your employees, workers, and team members.
• Categories of personal data: names, contact details, job role, availability, schedules, time-off and swap requests.

We do not request special category data. You should not enter special category data (such as health information) into free-text fields.

4. Confidentiality

We ensure that personnel authorised to process personal data are bound by appropriate confidentiality obligations.

5. Security

We implement appropriate technical and organisational measures as described on our Security page, including encryption in transit and at rest, access controls, and isolation of customer data.

6. Subprocessors

You provide general authorisation for us to engage the subprocessors listed on our Subprocessors page. We impose data protection terms on each subprocessor no less protective than this DPA, and remain liable for their performance. We will give notice of material changes so you can object.

7. Data subject rights and assistance

Taking account of the nature of the processing, we will assist you with appropriate technical and organisational measures to respond to data subject requests and to meet your obligations on security, breach notification, and data protection impact assessments.

8. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties to the ICO and affected individuals.

9. International transfers

Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures required.

10. Return and deletion

On termination, we will delete or anonymise customer personal data within 90 days, unless retention is required by law. You may export your data before termination using the in-app tools or by request.

11. Audit

We will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior notice, contribute to audits conducted by you or an auditor you mandate, subject to confidentiality.

12. Requesting a signed copy

Business customers who require a countersigned DPA can request one at hello@batchstaff.com.

TeZe Ltd, trading as Batch

Company number 17137231 (registered in England and Wales)

Registered office: 66 Paul Street, London, EC2A 4NA

ICO registration: ZC134108

VAT registration: GB 517 9808 54

This page is a plain-English summary provided for transparency; it does not replace the signed agreement.