Legal
Data Processing Agreement
Effective date: 26 August 2026
Last updated: 26 August 2026
Tap&Ticket is an early-stage software project operated by the individual identified in the applicable agreement. Tap&Ticket is currently being provided to selected businesses as a free pilot.
1. About this agreement
This Data Processing Agreement forms part of the terms between Tap&Ticket and each business using the service (including the Free Trial Terms during the pilot). It applies whenever Tap&Ticket processes personal data on behalf of a business. It is published here as the template that applies to pilot businesses.
2. Parties and roles
| Role | Who |
|---|---|
| Data controller | The business named in the applicable agreement or Free Trial Terms. The controller decides why and how its customers' personal data is processed. |
| Data processor | Tap&Ticket, a trading name of William Thompson. The processor processes personal data only on the controller's documented instructions. |
3. Subject matter and duration
The processing is the provision of the Tap&Ticket digital ticket service to the business. It continues for the duration of the business's agreement with Tap&Ticket, including the pilot period, unless ended earlier under that agreement.
4. Nature and purposes of processing
| Processing activity | Purpose |
|---|---|
| Creating and storing tickets and job records | So the business can manage customer drop-offs, jobs and collections |
| Storing customer contact details | So the business can identify and contact its customers about their items |
| Updating and displaying job statuses | So customers can follow their job progress on their digital ticket |
| Sending ticket-related emails and Wallet passes | So customers receive their ticket and status updates, where these features are used |
| Hosting, backup and security of the platform | So the service runs reliably and data is protected |
5. Types of personal data
Customer names, phone numbers and email addresses (where the business records them); item descriptions; ticket references and collection codes; job status history; staff user names, email addresses and roles; and technical data such as NFC tap times and device information.
6. Categories of data subjects
The business's customers, and the business's staff who use the platform.
7. Processor obligations
Tap&Ticket will:
- process personal data only on the controller's documented instructions, including this agreement, unless the law requires otherwise
- ensure people authorised to process the data are bound by confidentiality
- use appropriate technical and organisational measures to protect the data
- engage sub-processors only as described in this agreement
- help the controller respond to data subject requests and meet its data protection obligations, taking into account the nature of the processing
- notify the controller without undue delay after becoming aware of a personal data breach affecting its data
- delete or return the controller's data at the end of the agreement, as described below
- provide the information reasonably needed to demonstrate compliance with this agreement
8. Sub-processors
The controller authorises Tap&Ticket to use the sub-processors listed on the Sub-processors and Infrastructure page. We will give reasonable advance notice of any change by email or through the dashboard, and the controller may object within a reasonable period. If an objection cannot be resolved, the controller may end its agreement.
9. International transfers
Where personal data is transferred outside the UK, Tap&Ticket will ensure an approved safeguard is in place, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
10. Security
Tap&Ticket uses appropriate technical and organisational measures to protect personal data, including access controls that limit data to those who need it to run the service.
11. Personal data breaches
If Tap&Ticket becomes aware of a personal data breach affecting the controller's data, we will notify the controller without undue delay and provide the information reasonably needed for the controller to meet its own obligations.
12. Assistance
Taking into account the nature of the processing, Tap&Ticket will assist the controller with data subject requests, data protection impact assessments and regulator consultations, responding without undue delay.
13. Deletion and return
At the end of the agreement, the controller may ask for a copy of its data in a commonly used electronic format. Tap&Ticket will then delete or anonymise the controller's personal data within a reasonable period, unless the law requires us to keep it. Our Data Retention and Deletion Policy explains this in more detail.
14. Audits and information
On reasonable written notice, Tap&Ticket will provide the information the controller reasonably needs to check compliance with this agreement, and will allow audits no more often than is reasonably necessary.
15. Liability
Liability under this agreement is subject to the liability terms of the applicable agreement between Tap&Ticket and the business, including the Free Trial Terms during the pilot.
16. Signatures
Where a signed copy is needed, this agreement can be signed as follows:
| For the business (Controller) | For Tap&Ticket (Processor) |
|---|---|
| Name: ______________________________ | Name: ______________________________ |
| Role: _______________________________ | Signature: __________________________ |
| Signature: __________________________ | Date: _______________________________ |
| Date: _______________________________ |
17. Contact
Questions about this agreement? Email hello@tapandticket.com.
Questions about these terms or your data? Contact hello@tapandticket.com.