Legal

# Data processing

How Cube Systems Limited handles the data your organisation puts into our products, and where each product sets out the detail.

- Updated 30/09/2026
- 5 min read
- For customers

## The short version

- You are the controller

When your organisation uses one of our products, you decide what goes into it and why. We process that data only on your documented instructions.

- Hosted in the UK on AWS

Our products are hosted in the UK on Amazon Web Services (AWS). Servers, databases, file storage and backups are in the UK.

- Named sub-processors

The providers we use are named on our sub-processors page, and each product lists any it uses for its own features.

- Each product sets out the detail

Security controls, notice periods and deletion timetables differ between products, so each one publishes its own data processing terms.

A summary for convenience. The full text below is what applies.

## 1. Who is responsible for what

Cube Systems Limited publishes CubeERP, CubeCRM, CubeHR, CubeMSP, Kept, Trophy and Signed. When your organisation uses one of them, you decide what data goes into it and what it is used for. You are the controller of that data, and Cube Systems Limited is your processor.

If you hold some of that data as a processor yourself, for example on behalf of one of your own customers, we act as your sub-processor for it, and the commitments on this page cover it in the same way.

Separately, we are a controller for the data we need to run our own business, such as the details of your account contacts and our billing records. That is covered by our [privacy policy](/legal/privacy-policy).

## 2. Our data processing agreement

Our data processing agreement covers every customer, on every plan. It forms part of our terms, together with this page and our [sub-processors](/legal/sub-processors) page, and meets Article 28 of UK GDPR. Under it, we:

- process your data only on your documented instructions, which include using the product as designed with the configuration you choose, and tell you if we believe an instruction breaks the law;
- make sure everyone with access to it is bound by confidentiality;
- maintain appropriate technical and organisational measures to protect it;
- use sub-processors only under written contracts with equivalent obligations, and give you notice before any change;
- help you answer requests from people exercising their rights, and with data protection impact assessments and any consultation with the ICO;
- notify you of a personal data breach affecting your data without undue delay;
- delete or return your data when the contract ends; and
- make available the information you need to demonstrate compliance, and allow for audits, including inspections, by you or an auditor you appoint.

To review the agreement before you sign, email [hello@cubesystems.co.uk](mailto:hello@cubesystems.co.uk) and we will send you a copy.

## 3. Where it is held

Our products are hosted in the UK on Amazon Web Services (AWS). Our servers, databases, file storage and backups are in the UK.

Some products use providers that may process limited data outside the UK for particular features, such as the AI features in CubeMSP. Where that happens the transfer is protected by UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or equivalent safeguards, and the product names the provider on its own sub-processors list.

Services you connect to a product yourself, such as an accounting package or Microsoft 365, are your own suppliers and hold data under their own terms.

## 4. How it is protected

Data travels over encrypted connections, and access by our staff is limited to the people who need it to run and support the service.

Each product’s own legal pages describe its controls in detail, from sign-in options to backups.

## 5. Sub-processors

We use a small number of sub-processors, each named on our [sub-processors](/legal/sub-processors) page with what it does, what it processes and where. Each product also lists any provider it uses for its own features. We tell customers before adding or replacing one, with the notice period set out in the product’s terms, and you can object during that period.

## 6. Requests from individuals

When someone asks you to exercise their data protection rights, we will help you find, correct, export or delete the records relating to them. If a request about your data comes to us directly, we will pass it to you without undue delay and will not answer it ourselves unless you ask us to.

## 7. Security incidents

If we become aware of a personal data breach affecting your data, we will notify your nominated contact without undue delay, so that you can meet the 72-hour deadline for reporting to the ICO. We will tell you what happened, the data and people likely to be affected, the likely consequences and what we are doing about it, and keep you updated as we learn more. Each product’s terms give the exact notice period.

## 8. When a contract ends

When a contract ends you have time to export your data. We then delete it from live systems, and copies in backups expire on their normal rotation. Each product’s terms set out the timetable. We keep only what the law requires of us, such as invoices, which our privacy policy covers.

## 9. Each product’s own terms

Each product publishes the detail for its own data: what it holds, how it is protected, its sub-processors, and its notice and deletion periods.

| Product | What it does | Its terms |
| --- | --- | --- |
| CubeERP | ERP for distributors and wholesalers | [cubeerp.co.uk/legal/data-processing](https://cubeerp.co.uk/legal/data-processing) |
| CubeCRM | CRM for sales and service teams | [cubecrm.co.uk/legal/data-processing](https://cubecrm.co.uk/legal/data-processing) |
| CubeHR | HR, absence and rotas | [cube-hr.co.uk/legal/data-processing](https://cube-hr.co.uk/legal/data-processing) |
| CubeMSP | Software for managed service providers | [cubemsp.co.uk/legal/data-processing](https://cubemsp.co.uk/legal/data-processing) |
| Kept | Landlord compliance | [usekept.co.uk/legal](https://usekept.co.uk/legal) |
| Trophy | Tournament software | [trophyapp.co.uk/legal](https://trophyapp.co.uk/legal) |
| Signed | Email signature management | [usesigned.co.uk/legal/data-processing](https://usesigned.co.uk/legal/data-processing) |

Where a product’s own terms go into more detail than this page, or differ from it, the product’s terms apply.

Contact

## Questions about this document

Email us and a person will reply. For anything about data a business holds in one of our products, please contact that business first, as it decides how the data is used.

[Email us](mailto:hello@cubesystems.co.uk)
- **Company:** Cube Systems Limited, part of Crushed Ice Group

- **Company number:** [17220899](https://find-and-update.company-information.service.gov.uk/company/17220899), registered in England and Wales

- **Registered office:** Unit 11, Olney Business Park, Osier Way, Olney, Buckinghamshire, MK46 5FP

- **Email:** [hello@cubesystems.co.uk](mailto:hello@cubesystems.co.uk)

- **Telephone:** [01234 672 617](tel:+441234672617)

- **ICO registration:** [ZC216972](https://ico.org.uk/ESDWebPages/Entry/ZC216972)

---

**URL:** https://cubesystems.co.uk/legal/data-processing