Data Processing Addendum
Last updated 4 July 2026
Roles
You are the data controller for the personal data you upload into your FloorOS workspace. FloorOS Ltd. acts as your data processor for that data.
Scope
This DPA applies to any personal data processed by FloorOS on your behalf as part of the service. It forms part of the Terms of Service.
Processing instructions
We process your data only to provide the service, to comply with law, and per your documented instructions in the product.
Security
Encryption in transit and at rest, least-privilege access controls, audit logging on privileged actions, and regular backups.
Subprocessors
Hosting: Cloudflare (UK/EU regions). Database & auth: Supabase. Transactional email: Lovable Email. We'll notify you 30 days before adding a new subprocessor.
International transfers
Personal data is stored in the UK/EU. If a subprocessor is outside these regions, transfers are covered by the UK IDTA / EU SCCs.
Data subject requests
You can fulfil access, correction and deletion requests using in-product tools; we'll help where a request requires our assistance.
Breach notification
We'll notify you without undue delay, and within 72 hours of confirmation, of any personal data breach affecting your workspace.
Return & deletion
On termination you have 30 days to export data. After that, personal data is deleted from live systems within 30 days and backups within 90 days.