Procurement-ready processor terms
Where the customer acts as controller and GateCode acts as processor, this framework is intended to form the data-processing schedule to the customer's GateCode agreement. A signed order, enterprise agreement or customer-specific DPA may incorporate or supplement these terms.
1. Scope and processing
Subject matter: operation of temporary authorisation, collection, handover, verification, school, organisation, enterprise, reporting and related support functions.
Duration: for the term of the customer's use of GateCode and any limited post-termination period required for secure deletion, backup rotation, legal obligations or agreed export.
Data subjects: account users, staff, pupils/children where the school module is used, guardians, collectors/delegates, customers, visitors and other people referenced in authorised workflows.
Data types: contact/account information, role and organisation data, temporary collector/subject details, school relationships, authorisation data, verification events, audit/security data and support information.
2. Documented instructions
GateCode processes customer-controlled personal data on the customer's documented instructions, including the instructions expressed through authorised use of the product, configuration, support requests and applicable service agreement, unless UK law requires otherwise.
3. Confidentiality and security
GateCode applies appropriate technical and organisational measures designed to protect personal data. These include authenticated organisation scoping, secure session controls, cryptographic token generation and hashing, live verification, audit events, security headers, rate limiting and controlled administrative access.
4. Sub-processors
GateCode may engage infrastructure, communications, payment, support and other specialist suppliers to operate the service. Sub-processors are required to protect personal data under contractual terms appropriate to the processing. Enterprise customers may request the current sub-processor schedule through support@gatecode.co.uk.
5. Individual rights
Taking account of the nature of the processing, GateCode will provide reasonable assistance to help the controller respond to valid data-subject requests relating to data processed through the service.
6. Security incidents
GateCode will notify an affected controller without undue delay after becoming aware of a personal-data breach affecting that controller's data and will provide available information reasonably needed for the controller's assessment and regulatory obligations.
7. DPIAs and regulatory cooperation
GateCode will provide reasonable product and security information to assist customers with data-protection impact assessments, procurement reviews and regulator consultations where the processing warrants them.
8. Return and deletion
At the end of service, GateCode will return or delete customer-controlled personal data in accordance with the agreed contract, the retention schedule and applicable law. Aggregate or irreversibly anonymised information may be retained where it no longer identifies an individual.
9. Audits and assurance
GateCode will make available information reasonably necessary to demonstrate compliance with these processor commitments. The parties can agree proportionate audit arrangements that protect other customers, security controls and confidential information.
10. International transfers
Where customer personal data is transferred outside the UK, GateCode will use an appropriate UK transfer mechanism and supplementary safeguards where required.