Data Processing Addendum
Last updated 9 October 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service between I-Cost Ltd ("processor", "we") and the customer ("controller", "you"). It applies when we process personal data in customer data on your behalf, and meets the requirements of Article 28 of the UK GDPR and the Data Protection Act 2018.
1. Details of the processing
| Subject matter | Providing the iCost platform to the customer |
|---|---|
| Duration | The term of the subscription, plus the deletion period in section 8 |
| Nature and purpose | Hosting, storing, organising, displaying, transmitting and deleting customer data so the customer can estimate, purchase, record time, report and assess carbon on construction projects; support |
| Types of personal data | Names, job titles, business email addresses and phone numbers, company and site addresses, user accounts and roles, timesheet hours and labour rates, details in uploaded documents and photos, help-desk messages |
| Data subjects | The customer's staff and users, its clients, suppliers and subcontractors, and other people named in project records |
2. Instructions
We process customer personal data only on your documented instructions, which are these terms, the DPA and your use of iCost's features, unless the law requires otherwise (in which case we will tell you first, unless the law prevents it). We will tell you if we believe an instruction breaks data protection law.
3. Confidentiality
Everyone we authorise to process customer personal data is bound by confidentiality.
4. Security
We keep appropriate technical and organisational measures in place to protect customer personal data, including: hosting in the UK; HTTPS for all connections; separation of each customer's data; private storage of uploaded files; hashed passwords and protection against repeated sign-in attempts; restricted staff access; rolling backups; and prompt patching of vulnerabilities. See also our Security page.
5. Subprocessors
You authorise us to use the subprocessors listed on our Subprocessors page. We will give at least 30 days' notice on that page (and by email to customers who ask to be notified) before adding or replacing one. You may object on reasonable data protection grounds; if we cannot address the objection, you may end the affected service and receive a refund of prepaid fees for the unused period. Each subprocessor is bound by data protection terms no less protective than this DPA, and we remain responsible for them.
6. International transfers
Customer data is hosted in the UK. Where a subprocessor processes it outside the UK, we make sure a lawful transfer mechanism is in place, such as UK adequacy regulations, the UK International Data Transfer Addendum, or the UK Extension to the EU-US Data Privacy Framework.
7. Helping you
- Data subject requests: iCost lets you view, correct, export and delete data. If we receive a request about customer data we will pass it to you and help you respond.
- Personal data breaches: we will notify you without undue delay, and in any case within 48 hours of becoming aware of a breach affecting customer personal data, with the information you need to meet your own obligations.
- Assessments: we will provide reasonable help with data protection impact assessments and consultations with the ICO.
8. Deletion or return
During the subscription and after it ends, the company administrator can export all customer data from My Account. We delete customer data 90 days after the subscription ends (or sooner on your written request), and it leaves our rolling backups within a further 30 days, unless the law requires us to keep it.
9. Audits and information
We will make available the information reasonably needed to show compliance with this DPA, and allow audits by you or an auditor you appoint, on reasonable notice, at most once a year (unless required after a breach or by a regulator), subject to confidentiality and without access to other customers' data.
10. Your responsibilities
You are responsible for having a lawful basis for the personal data you put into iCost, for giving people the information the law requires, and for the accuracy of that data.
11. Precedence
If this DPA conflicts with the Terms of Service about personal data, this DPA applies. Questions: info@i-cost.co.uk.