Space Bookings Data Processing Agreement
Title of Agreement – Space Bookings
Purpose – To facilitate the processing of staff and external meeting attendees information between the client organisation and InVentry Ltd for the purpose of providing room booking facilities.
Partners – Purchasing establishment (herein known as the data controller).
InVentry Ltd (herein known as the data processor).
Date of agreement – Upon commencement of licence purchased for the room booking service.
Date of agreement review – In line with expiry of licence purchased.
Agreement drawn up by – InVentry Ltd.
Extent of agreement – Organisations undertaking InVentry Central Services and subject to the Data Protection Act 2018 including UKGDPR and The Data Use and Access Act 2025 (DUAA).
1. Introduction
1.1 This data processing agreement has been drawn up by InVentry Ltd, which sets out the core information processing principles which have been agreed by its signatory organisations.
1.2 The objective of this data processing agreement is to provide data for use in the following services:
- Room Booking Facilities
- Technical Support
- Communication of update and functionality information
1.3 In order to meet this objective it is necessary for partners to share selected information.
2. Definitions
- “Data” is defined in Section 6 of this document.
- “Data Subject” shall have the same meaning as set out in Article 4 (1) of the UKGDPR and means an identified or identifiable natural person
- “Data Protection Act 2018” is defined as the UK Act of Parliament to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner’s functions under certain regulations relating to information; to make provision for a direct marketing code of practice; and for connected purposes.
- The Data Use and Access Act 2025 (DUAA) is defined as the UK Act of Parliament to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner’s functions under certain regulations relating to information; to make provision for a direct marketing code of practice; and for connected purposes.
- “EEA” means the European Economic Area – the 27 Member states of the European Union plus Iceland, Lichtenstein and Norway
- UK GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations
- “Incident” has the same meaning as a personal data breach in Article 4 (12) of the GDPR and means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to data, transmitted, stored or otherwise processed under the terms of this agreement.
- “Processing” shall mean any operation or set of operations which is/are performed upon Data, (whether or not by automatic means) including collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction. Such processing may be wholly or partly by automatic means or processing otherwise than by automatic means of Data which form part of a filing system or one intended to form part of a filing system. A filing system shall mean any structured set of Data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographic basis.
3. Policy Statements and Purpose
3.1 The purpose of this agreement is to:
- Enable the booking of room facilities by the above parties to be recorded for the purpose of the following:
- Fulfil the requirements of the installation of the room booking system
- Fulfil requirements of system annual licence
- Provide up to date information on the system and improve functionality (InVentry Maintenance licence)
4. Partners
4.1 This agreement is between partners listed from the following organisations
- Client organisation (data controller)
- InVentry Ltd (data processor as appropriate)
5. Basis for processing
5.1 This agreement fulfils the following requirements:
- The UK General Data Protection Regulations (Principles)
- The UK General Data Protection Regulations (Rights of the Data Subject)
- The Freedom of Information Act 2000 (where applicable)
- The Data Use and Access Act 2025 (DUAA)
5.2 Any information shared and the processes used to share such information will be compliant with the relevant human rights legislation.
6. Process
6.2 Where the processing undertaken by InVentry Ltd, as defined in Section 6 of the data processing agreement where appropriate, written direction is obtained from the controller.
6.3 Information to be shared is from the following as agreed with the client:
| For the purposes of implementing a Space Booking System | |||
| Personal data type: | Source (where InVentry Ltd obtained the personal data from) | Lawful Grounds | |
| Staff | |||
| First name* | Provided by the Organisation via AD integration or CSV file | Article 6(1b) Contractual agreement | |
| Surname* | |||
| Email address* | |||
| Job Title (Only if held within AD) | |||
| Phone Number (Only if held within AD) | |||
| Department (Only if held within AD) | |||
| Internal/External Attendee | |||
| First name* | Provided by the Visitor | Article 6(1b) Contractual agreement | |
| Surname* | |||
| Email3 | |||
| Phone Number3 | |||
| Car Registration Number2 | |||
| Support and Fault resolution (User account creation) | |||
| First name* | Provided by the Organisation | Article 6(1b) Contractual agreement | |
| Surname* | |||
| Email address* | |||
| Financial Information | |||
| First name* | Provided by the Organisation to facilitate accurate records of financial transactions. | Article 6(1b) Contractual agreement | |
| Surname* | |||
| Email* | |||
Notes
1 Above fields marked with * are required for feature/service functionality.
2 Where the customer integrates with an InVentry Visitor Management system to facilitate the parking space reservation feature this information will be shared between both systems.
3The system requires either one of the following complete enrolment. The choice is up to the data controller:
- Mobile phone
7. How will the data be secured and transferred
7.1 The InVentry Ltd data processing agreement provides details of the overall security standards Based on the requirements of applicable data protection laws, InVentry Ltd will implement appropriate security measures to protect against accidental loss or unlawful destruction, loss, alteration, disclosure or access to data. These measures will ensure a level of security appropriate to the risks presented by the processing and the nature of the data protected having regard to the state of the art and their cost of implementation.
7.2 The InVentry Ltd data processing agreement provides details of the overall security standards required of participating organisations to manage the information they receive from other parties under this agreement. These must be respected by all signatories.
7.3 All data processed by InVentry Ltd or any sub-processor is done so in compliance with the requirements laid in UKGDPR/Data Protection Act 2018 and The Data Use and Access Act 2025 (DUAA).
7.4 The security of the on-premises device e.g. antivirus, firewall, password policy is the responsibility of the data controller.
7.5 Any data transferred to the processor is done using SSL/HTTPS and TLS 1.2
7.6 All data is encrypted at rest using industry standard AES-256 encryption.
7.7 Where data may be processed beyond the EEA, it will be done so in line with Articles 44 – 46 of UK GDPR and takes such measures as are necessary to ensure such transfer is in compliance with current Data Protection Law. If any processing should be outside these articles, written consent will be sought. For more information on processing, see Appendix 1
If a client legitimately objects to the addition of a sub-processor and InVentry Ltd cannot reasonably accommodate the client’s objection, InVentry Ltd will notify the client. The client may then, if they so wish, terminate the affected service by providing InVentry Ltd with a written notice, within one month of InVentry’s notice.
7.9 Should InVentry Ltd choose to change a 3rd party service, we will complete appropriate impact assessments, alter our privacy statement where appropriate and notify you of this change. Where an additional service is being provided, consent will be sought
7.10 InVentry Ltd shall, upon confirmation of a data breach notify the data controller of it within 24 hours and will work together with Data Controller to investigate the data breach where this is within its control.
7.11 InVentry Ltd will inform the Data Controller if, in its opinion, an instruction received from the Data Controller may put the Data Controller at risk of breaching data protection regulations.
7.12 InVentry Ltd shall indemnify the Data Controller against all liability, loss, damage and expense of whatsoever nature incurred or suffered by the Data Controller due to any failure by InVentry Ltd or its employees, agents or Sub-processors to comply with any of its obligations under this agreement and/or under Data Protection Legislation. Similarly, The Data Controller shall indemnify against all liability, loss, damage and expense of whatsoever nature incurred or suffered by InVentry Ltd due to any failure by the Data Controller or its employees or agents to comply with any of its obligations under this agreement and/or Data Protection Legislation.
For more information, please contact InVentry Ltd.
8. Ensuring Data Quality
8.2 Before processing data, checks will be undertaken to ensure that the information being shared is accurate and up to date to the best of all parties’ knowledge. If special category personal data is being shared which could harm the data subject if it was inaccurate, then particular care must be taken.
8.3 If a complaint is received about the accuracy of personal data which affects datasets shared with partners in this agreement, an updated replacement dataset will be communicated to the partners. The partners will replace the out-of-date data with the revised data.
9. Information use, review, backup, retention and deletion
9.1 Partners to this agreement undertake that information shared under the agreement will only be used for the specific purpose for which it was shared, in line with this agreement. It must not be shared for any other purpose outside of this agreement.
9.2 The client remains the data controller in all cases of the data processing.
9.3 The retention period for data within the system is as follows:
9.3.1 Room booking Services data retention
- User records retention period is under the control of the data controller
- Meeting records are deleted on request to InVentry Ltd by the data controller/customer.
- System backup
The cloud hosted data is backed up by InVentry Ltd for the following timescales
- Weekly incremental back up of system taken by InVentry Ltd at Saturday at 6.30 am GMT
The data processed in the Space Booking service will be deleted 30 days following the receipt of written confirmation by the customer of the termination of the contract.
9.3.3 Support desk
- Until no longer required under Article 6(f) – Legitimate Interest of the organisation for completeness of the record.
- 7 years under Article 6(f) – Legitimate Interest of the organisation for completeness of the record.
9.4 InVentry Ltd will not release the information to any third party unless the request is subject to legal obligation without obtaining the express written authority of the partner who provided the information.
9.7 The following destruction process will be used when the information is no longer required:
- Data in printout form to be kept minimal & be shredded using secure offsite destruction disposed in accordance with the InVentry Ltd Information Security Policy.
- Data in digital format will be deleted and devices will be disposed in accordance with the InVentry Ltd Information Security Policy.
10. Party agreement
10.1 All involved parties accept responsibility for its execution and agree to ensure that staff are trained so that requests for information and the process of processing itself are sufficient to meet the purpose of this agreement.
10.2 InVentry Ltd will support the Data Controller in demonstrating compliance with the regulations covering the UK. Where required and reasonable, the processor will work with the data controller to;
- Cooperate with the relevant data protection authorities in the event of an enquiry
- Assist the data controller, where necessary, in the completion of data protection impact assessments, and prior consultations with data privacy authorities
- Report data breaches to the controller without delay
- Help the controller to comply with data subject rights
- Assist the data controller in managing the consequences of data breaches
- Inform the controller if the processing instructions infringe Data Protection Act 2018/UKGDPR/DUAA 2025.
10.3 At the written request of the data controller, InVentry will make available information reasonably necessary to demonstrate compliance with this data processing agreement. Any audit of InVentry’s data processing facilities and processing activities covered by this data processing agreement shall be subject to at least 30 days’ prior written notice, be limited to once in any twelve-month period unless required by a supervisory authority or following a confirmed material breach of this data processing agreement by InVentry, be limited to the relevant processing activities only, be conducted during normal business hours, and be subject to appropriate confidentiality, security and operational restrictions.
10.4 InVentry may satisfy audit requests by providing relevant certifications, policies, summaries, penetration test summaries or third-party audit reports where appropriate. The data controller shall bear its own audit costs and reimburse InVentry’s reasonable costs incurred in supporting any audit, unless the audit identifies a material breach of this data processing agreement by InVentry. No audit shall require access to data, systems or information relating to other customers, commercially sensitive information, source code, security testing details, or information that would compromise the security of InVentry’s systems or services.
All requests for additional assistance beyond the scope specified above or mandated by applicable laws will be subject to the agreement of the Directors.
Signed on behalf of InVentry Ltd
Name: Phil Brooke
Role: Director
Date: As below
We ask that this document is signed by the data controller or authorised member of staff within your organisation.
Signed on behalf of client
Name:
Role:
Email:
Organisation:
Address:
Postcode:
Date
Appendix 1 – InVentry Processing
The following InVentry data hosting and processing locations are utilised for the purposes described below:
| Service | System | Processing provider | Purpose/Justification | Location | Article 44 compliance (where required) |
| Room Booking service | Space Bookings | AWS | Facilitate room booking system | UK | Legally binding agreement in place. |
| Support desk services | ZenDesk | ZenDesk | Recording details of support calls | US / EEA or other non-UK location as applicable | Transfer subject to a valid mechanism under UK data protection laws, including UK adequacy regulations where available or, where required, appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or UK Binding Corporate Rules, together with any transfer risk assessment or equivalent assessment required by law. |
| CRM | Dynamics | Microsoft | Customer management | EEA | Legally binding contract in place subject to Article 46 – Transfers subject to appropriate safeguards (parts c and d) – Standard data protection clauses. |
Version 2 – 6th November 2026