1. Definitions and roles
1.1 Terms defined in the Fixory Subscription Terms have the same meaning here. In addition:
- UK GDPR, personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meanings given in the UK GDPR.
- Customer Personal Data: personal data in Your Data that we process on your behalf in providing Fixory, as described in Annex A.
- Sub-processor: a third party we engage to process Customer Personal Data.
- Restricted Transfer: a transfer of Customer Personal Data to a country outside the United Kingdom that is subject to the international-transfer rules in Chapter V of the UK GDPR.
1.2 Roles. For Customer Personal Data, you are the controller and we are your processor.
1.3 Details of processing. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex A.
2. Our obligations as processor
2.1 Instructions. We will process Customer Personal Data only on your documented instructions, including with regard to Restricted Transfers, unless the law of the United Kingdom requires otherwise; in that case we will tell you of that legal requirement before processing, unless the law prohibits this. Your instructions are: these Terms and this Schedule; your configuration and use of Fixory (including which features and Add-ons you switch on); and any further reasonable written instructions consistent with them.
2.1A Who may instruct us (Fixory Business). Where you subscribe to Fixory Business for several shops under Schedule 2 of the Terms, we will process Customer Personal Data strictly on your documented instructions. Such instructions may be communicated by your designated Owners or, within their assigned permissions, by authorised shop administrators.
2.2 Unlawful instructions. We will tell you immediately if, in our opinion, an instruction infringes Data Protection Law. We are not required to carry out such an instruction.
2.3 Our own use. We will not process Customer Personal Data for our own purposes. In particular we will not use it to train artificial intelligence or machine-learning models, share it with any other Fixory customer, sell it or use it for marketing. Any feature that pools data across Fixory customers will apply to you only if you opt in under separate written terms.
2.4 Confidentiality of personnel. We will ensure that anyone we authorise to process Customer Personal Data is under a duty of confidentiality (contractual or statutory) and processes it only as needed to provide Fixory, support you or meet our legal obligations.
2.5 Security. We will implement appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing and the risks to individuals, as required by Article 32 UK GDPR. The measures in place at the date of this Schedule are described in Annex B.
3. Sub-processors
3.1 General authorisation. You give us general written authorisation to engage Sub-processors. The Sub-processors in use at the date you subscribe are listed in Annex C.
3.2 Notice of changes. We will give you at least 30 days’ notice before adding or replacing a Sub-processor that we engage directly, by email to your account’s main administrator. Where one of our Sub-processors adds or replaces its own sub-processor, we will tell you as soon as reasonably practicable after we are notified, and in any event before we send that sub-processor any further Customer Personal Data where we are able to stop doing so. We keep the current list of Sub-processors (and links to their own sub-processor lists) published at fixory.co.uk/subprocessors.
3.3 Objection. You may object to a new or replacement Sub-processor on reasonable data-protection grounds by writing to us within the notice period. We do not change Sub-processors for an individual customer. If you object, you may terminate the affected Add-on or your whole subscription by written notice, without penalty, with effect before the change takes effect, and we will refund any Fees you have paid in advance for the period after termination.
3.4 Sub-processor terms. We will impose on each Sub-processor, by written contract, data-protection obligations that provide at least the same level of protection for Customer Personal Data as this Schedule, in particular sufficient guarantees to implement appropriate technical and organisational measures. We remain liable to you for each Sub-processor’s performance of those obligations.
3.5 Services you connect. Where you connect Fixory to a service you hold with another provider, such as Stripe or Xero, using your own account and credentials (Terms clause 3.7), that provider is your supplier, not our Sub-processor, and this clause 3 does not apply to it. We send Customer Personal Data to it only on your instruction, given by connecting it and using the connection.
4. Where Customer Personal Data is processed
4.1 UK only. We will store and process Customer Personal Data in the United Kingdom, and will not make a Restricted Transfer, except as set out in clause 4.2.
4.2 Fixory AI. If you switch Fixory AI on, you instruct us to transfer to our AI Sub-processor, outside the United Kingdom, the Customer Personal Data needed to provide Fixory AI, and only that data. We make that Restricted Transfer under the safeguard set out in clause 4.3. If you switch Fixory AI off, no further data is sent to the AI Sub-processor.
4.3 Where Fixory AI data goes, the safeguard, and how long it is kept.
- (a) Fixory AI processing and storage by the AI Sub-processor take place in the United States. The Restricted Transfer is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (the UK Addendum), as the transfer mechanism under Chapter V UK GDPR. We will provide it on request.
- (b) Standard model inputs and outputs are deleted by the AI Sub-processor within 30 days by default. We do not use features of the AI Sub-processor that store your data for longer.
- (c) The AI Sub-processor may retain inputs and outputs for up to 2 years, strictly to investigate violations of its safety and misuse policies. That retention is an operational constraint of the AI Sub-processor: it is beyond our power to delete such data before that safety retention period ends, including at your request or ours.
4.4 Safety scores and diagnostic logs. Automated safety evaluation scores and non-content diagnostic logs generated during processing may be retained by the AI Sub-processor for up to 7 years, solely for system security, auditing and abuse-prevention purposes.
5. Helping you meet your obligations
5.1 Data subjects’ rights. Taking into account the nature of the processing, we will help you, by appropriate technical and organisational measures, insofar as possible, to respond to requests from individuals exercising their rights under Data Protection Law. Fixory provides functions you can use to find, export, correct and delete personal data. Where those functions are not enough, we will help by email within a reasonable time. If we receive a request directly from one of your customers or staff, we will pass it to you promptly and will not respond to it ourselves except on your instructions. Our help with an access request supports the reasonable and proportionate search for personal data that Data Protection Law requires of you, and we will tell you promptly if we need information from you before we can help, so you can take account of it in your response time.
5.1A Complaints. We will give you reasonable help with complaints about the processing of Customer Personal Data that individuals make to you under Data Protection Law, including the information about Fixory you need to look into and answer them. If we receive such a complaint directly, we will pass it to you promptly.
5.2 Security, breaches, DPIAs and consultation. Taking into account the nature of processing and the information available to us, we will help you meet your obligations under Articles 32 to 36 UK GDPR (security, breach notification, data protection impact assessments and prior consultation with the ICO), including by providing information about Fixory reasonably needed for your DPIAs.
5.3 Costs. Our assistance under this clause 5 is free for reasonable requests. We may charge our reasonable costs for requests that are unusually large, complex or repeated, and will tell you the likely cost before doing the work.
6. Personal data breaches
6.1 We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
6.2 The notice will include, as far as then known: the nature of the breach, including the categories and approximate numbers of individuals and records concerned; the likely consequences; the measures taken or proposed to address it and mitigate its effects; and a contact for more information. Where information is not yet available, we will provide it in phases without undue further delay.
6.3 We will take reasonable steps to contain and investigate the breach and to mitigate its effects, and will cooperate with you in your notifications to the ICO and to affected individuals. We will not notify the ICO or your customers of a breach affecting Customer Personal Data on your behalf unless you instruct us or the law requires it.
6.4 Notifying you of a breach is not an admission of fault or liability.
7. Information and audits
7.1 Information. We will make available to you, on written request, the information reasonably necessary to demonstrate our compliance with this Schedule and Article 28 UK GDPR, including our security and privacy documentation and written answers to reasonable questionnaires.
7.2 Audits. If the information under clause 7.1 is not reasonably sufficient to demonstrate our compliance, or where the ICO requires it, you (or an independent auditor you appoint who is bound by confidentiality) may carry out an audit, including an inspection. Any audit must be limited to what is necessary, on at least 30 days’ written notice, during business hours, no more than once in any 12 months (except after a personal data breach affecting Customer Personal Data or at the ICO’s request), at your cost, and without access to other customers’ data or our confidential information unrelated to the processing.
8. When your subscription ends
8.1 Export. For 30 days after your subscription ends, you may export Customer Personal Data using Fixory’s export functions.
8.2 Deletion. Within 30 days after the export window ends, we will delete Customer Personal Data from our live systems, unless the law of the United Kingdom requires us to keep it. Deletion is permanent and complete; we do not keep an anonymised copy. Backup copies are deleted as the backups expire, within 30 days; until then they are kept secure and not used except to restore systems, and if a backup is restored we delete the data from it again.
8.3 Confirmation. On your written request, we will confirm in writing that deletion has been completed.
8.4 Deletion at your choice. You may ask us to delete Customer Personal Data before the export window ends; we will do so within 30 days of your request.
9. Liability
9.1 All claims under this Schedule are subject to the aggregate financial liability cap in clause 11 of the Terms, and count towards it. There is no separate or higher cap for data protection.
9.2 The general exclusion of liability for loss or corruption of data in clause 11.3(d) of the Terms does not operate to exclude, exempt or nullify our obligations under this Schedule and Article 28 UK GDPR, including our security, breach-notification, sub-processor, assistance and deletion obligations, or our liability for failing to meet them. That liability remains subject to the cap referred to in clause 9.1.
10. Your obligations
10.1 You confirm that you have, and will keep, a lawful basis for the processing you instruct, that you give individuals the privacy information Data Protection Law requires, and that your instructions comply with Data Protection Law.
11. Order of precedence and changes in law
11.1 If this Schedule conflicts with the rest of the Terms on the processing of Customer Personal Data, this Schedule prevails.
11.2 If Data Protection Law changes in a way that requires changes to this Schedule, we may amend it to the extent necessary, on at least 30 days’ notice (or less where the law requires the change sooner).
Annex A — Details of processing
This annex describes the personal data Fixory is able to hold; what each shop actually enters varies.
| Item | Detail |
|---|---|
| Subject matter | Provision of the Fixory hosted EPOS service (and any Add-ons the shop switches on) to the shop. |
| Duration | The subscription, plus the 30-day export window and the deletion period in clause 8; backups until they expire (Microsoft Azure’s automatic database backups, retention 30 days (checked in the Azure portal, 2026-10-23); never more than 30 days, Terms clause 6). |
| Nature | Hosting, storage, retrieval, display, organisation, calculation, transmission (including emails and customer status/approval links), backup, export and deletion. For Fixory AI: sending the minimum necessary data to the AI Sub-processor to generate suggestions, and storing the results. |
| Purpose | To provide Fixory to the shop under the Terms. |
Categories of data subjects and types of personal data
| Data subjects | Types of personal data |
|---|---|
| Shop’s customers | Name, phone, email, postal address, postcode, notes; repair records (reported fault, diagnosis, notes, quotes, payments, status history); sales, payments and refunds; warranties and warranty claims; devices (make, model, IMEI/serial and similar identifiers); repair, appraisal and warranty-claim photos (which may incidentally show personal content). |
| Shop’s business customers and their contacts (Fixory Pro, if the shop has it) | Contacts’ name, role, email and phone; the business customer’s legal and trading name, company number, website, addresses, credit terms and notes (a sole trader’s or partner’s name may be the business name); trade invoices, credit notes, payments, statements, and the customer’s details frozen on each invoice (removed after six years); records of statement and payment-reminder emails (masked address). When the trade portal is released: whether a contact may sign in, hashed sign-in links and sessions, and sign-ins in the audit log with IP address and browser. |
| People selling or part-exchanging devices to the shop | As above, plus: type of ID document checked (passport, driving licence, national ID, other) and a short partial reference (the code keeps only the last few characters, never the whole number); device-check result (clear, blacklisted, lost/stolen, finance owed); seller declaration and signature image. |
| Shop staff (Authorised Users) | Name, email, role and permissions; sign-in credentials (password stored as a bcrypt hash); activity in the system (sales, refunds, repairs, cash sessions) and audit-log entries including IP address and browser user agent; clock-in/out times, breaks, worked minutes and attendance corrections. Where the customer is an organisation with several shops, staff details (name, work email, role at each shop) are available across the organisation’s shops so a person can work at more than one. |
| Sponsored workers (shop staff employed under an immigration sponsor licence, where the shop uses this feature) | Sponsor reference, visa type, home address, next-of-kin name, relationship and phone, notes; document records (type, reference, issue and expiry dates) and uploaded document files. |
| Fixory AI (if switched on) | Appraisal sessions and photos, findings, device checks, price evidence from the shop’s own sales, pricing recommendations, repair triage, assistant conversations and messages, proposed actions and feedback, warranty assessments. Customer email and phone are masked in the assistant’s tool output unless the tool’s purpose is contact (AI-ARCHITECTURE). |
Special categories and criminal-offence data. Fixory is not designed to collect special categories of personal data (Article 9 UK GDPR) or criminal-offence data (Article 10 UK GDPR) in general. However:
- Sponsor-worker records process passports and visa documentation, which may incidentally reveal racial or ethnic origin (special category data under Article 9 UK GDPR). They also show nationality, which is not itself a category listed in Article 9(1) UK GDPR and is not treated as special category data here.
- Trade-ins and device acquisition process lost/stolen device-check flags, which may touch upon criminal-offence data under Article 10 UK GDPR.
You, as controller, remain responsible for having an appropriate lawful basis and condition, and for maintaining an appropriate policy document, under Articles 9 and 10 UK GDPR for this processing. Free-text notes and photos anywhere in Fixory may also contain such data.
Annex B — Security measures
| Measure | What we do |
|---|---|
| Access control | Every request from staff is checked on our server against the person’s sign-in, role and permissions. Each shop’s data is kept separate: every request for a shop’s records is limited to that shop. |
| Passwords and sign-in | Passwords are stored only as bcrypt hashes (cost 12). Links to set a password can be used once and are stored only as SHA-256 hashes. Passwords must be at least 12 characters, and new passwords found in known data breaches are refused (checked by sending only the first 5 characters of a hash, never the password). An account is locked after 10 failed sign-ins in 15 minutes, and the person is emailed. |
| Our own access | Ezone’s administrators sign in with a password and an authenticator app code. Looking at a shop’s data needs a time-limited support session, which is recorded in that shop’s audit log. Only Ezone’s owner has access to the live systems, with two-factor sign-in on Microsoft Azure and GitHub. |
| Audit log | Staff and administrator actions are recorded. Entries are kept 12 months, except entries about money, stock value and VAT, and our support access to a shop, which are kept 6 years. Personal data is removed from the record of what changed. |
| Encryption | All connections to Fixory use HTTPS (TLS 1.2 or later), and browsers are told to use HTTPS only. The database, uploaded files and backups are encrypted at rest by Microsoft Azure. |
| Security headers | Fixory sets security headers on every response and accepts requests only from its own web address. |
| Backups | Microsoft Azure backs up the database automatically, in the UK South region, restorable to a point in time; backups are kept 30 days. Uploaded files are backed up daily in the UK South region and kept 30 days. Our targets are to lose at most 5 minutes of database data and 24 hours of files, and to be working again within 4 hours. Restoring the database is tested. |
| Changes and monitoring | Every change to Fixory is tested automatically before release, and releases are made by hand. Third-party components are pinned to exact versions and their updates are proposed automatically. A health check and email alerts tell us when the service is down, answering with errors, or a scheduled job or backup fails. |
| Personal data breaches | We assess any suspected breach and email the affected shops within 48 hours of becoming aware of it (clause 6.1). |
Annex C — Sub-processors
| Sub-processor | Service | Data | Location |
|---|---|---|---|
| Microsoft (Azure) | Hosting: the application, database, uploaded files and backups | All Customer Personal Data | United Kingdom (UK South) |
| Microsoft (Azure Communication Services) | Sending emails (set-password links and the shop’s customer emails) | Recipients’ names and email addresses, and the message content | United Kingdom |
| Anthropic | Fixory AI, only if you switch it on (clause 4.2) | The Customer Personal Data needed for each Fixory AI request | United States |
Cloudflare serves Fixory’s screens and website (the program code, not Customer Personal Data); requests carrying your data go straight to our servers in the United Kingdom. Fees for Fixory are paid by bank transfer, so no payment provider handles them.