Data Processing Agreement
Processing purposes
Providing, operating, monitoring and supporting the Ultimate BMS software on your dedicated instance.
Categories of data
Account and user data you provide; business data you enter into the product (stored only on your isolated instance); aggregate operational telemetry (see below).
Sub-processors
See the published sub-processor list, kept current and notified in advance for annual/enterprise contracts.
Telemetry disclosure (verbatim, per §8)
“Aggregates and counts only — never raw records. No work order contents, no customer names, no sensor readings.” Retention: 7 days raw, 90 days hourly rollups, 13 months daily rollups.
Usage reporting
Each instance reports aggregate counts (users, logins in the last 7 days, AI questions, clients, leads, quotations, invoices, storage size), server load and response and page-load timings to ultimate-bms.com on startup, every 12 hours and on any user change. No names, emails, content, URLs or IP addresses are sent.
Retention
Active subscription: for the life of the contract. Cancelled or unpaid: the latest backup is kept 3 months in cold storage, then permanently deleted, with notification emails at day 60, day 76 and on the day of deletion, and a confirmation once deleted.
Breach notification
72 hours to the relevant regulator; without undue delay to affected customers.
Deletion on termination
The COLD_STORAGE → DELETED path, executed early on written request within 30 days, or at once when the customer confirms deletion in the portal.
International transfers
Standard Contractual Clauses apply — our operating entity is South African, processing occurs in the EU (Ireland).