Data processing

Cube Systems Limited publishes CubeERP, CubeCRM, CubeHR, CubeMSP, Kept, Trophy and Signed. When your organisation uses one of them, you decide what data goes into it and what it is used for. You are the controller of that data, and Cube Systems Limited is your processor.

If you hold some of that data as a processor yourself, for example on behalf of one of your own customers, we act as your sub-processor for it, and the commitments on this page cover it in the same way.

Separately, we are a controller for the data we need to run our own business, such as the details of your account contacts and our billing records. That is covered by our privacy policy.

Our data processing agreement covers every customer, on every plan. It forms part of our terms, together with this page and our sub-processors page, and meets Article 28 of UK GDPR. Under it, we:

• process your data only on your documented instructions, which include using the product as designed with the configuration you choose, and tell you if we believe an instruction breaks the law;
• make sure everyone with access to it is bound by confidentiality;
• maintain appropriate technical and organisational measures to protect it;
• use sub-processors only under written contracts with equivalent obligations, and give you notice before any change;
• help you answer requests from people exercising their rights, and with data protection impact assessments and any consultation with the ICO;
• notify you of a personal data breach affecting your data without undue delay;
• delete or return your data when the contract ends; and
• make available the information you need to demonstrate compliance, and allow for audits, including inspections, by you or an auditor you appoint.

To review the agreement before you sign, email hello@cubesystems.co.uk and we will send you a copy.

Our products are hosted in the UK on Amazon Web Services (AWS). Our servers, databases, file storage and backups are in the UK.

Some products use providers that may process limited data outside the UK for particular features, such as the AI features in CubeMSP. Where that happens the transfer is protected by UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or equivalent safeguards, and the product names the provider on its own sub-processors list.

Services you connect to a product yourself, such as an accounting package or Microsoft 365, are your own suppliers and hold data under their own terms.

Data travels over encrypted connections, and access by our staff is limited to the people who need it to run and support the service.

Each product’s own legal pages describe its controls in detail, from sign-in options to backups.

We use a small number of sub-processors, each named on our sub-processors page with what it does, what it processes and where. Each product also lists any provider it uses for its own features. We tell customers before adding or replacing one, with the notice period set out in the product’s terms, and you can object during that period.

When someone asks you to exercise their data protection rights, we will help you find, correct, export or delete the records relating to them. If a request about your data comes to us directly, we will pass it to you without undue delay and will not answer it ourselves unless you ask us to.

If we become aware of a personal data breach affecting your data, we will notify your nominated contact without undue delay, so that you can meet the 72-hour deadline for reporting to the ICO. We will tell you what happened, the data and people likely to be affected, the likely consequences and what we are doing about it, and keep you updated as we learn more. Each product’s terms give the exact notice period.

When a contract ends you have time to export your data. We then delete it from live systems, and copies in backups expire on their normal rotation. Each product’s terms set out the timetable. We keep only what the law requires of us, such as invoices, which our privacy policy covers.

Each product publishes the detail for its own data: what it holds, how it is protected, its sub-processors, and its notice and deletion periods.