Data Processing Agreement
Review AppDeploy by ScotiTech data-processing commitments, security measures, and sub-processor information for private app distribution workspaces.
This Data Processing Agreement applies automatically to every AppDeploy customer and is incorporated into our Terms of Service by reference (section 17). You do not need to sign or request it for it to apply. If your procurement process requires a countersigned copy, contact info@scotitech.com.
Version: 2026-10-14. Last updated: 14 October 2026.
AppDeploy is operated by ScotiTech Solutions Limited, a company registered in Scotland under company number SC829021, ICO registration reference ZB925464.
1. Parties and roles
This Data Processing Agreement ("DPA") forms part of the Terms of Service or other agreement (the "Agreement") between ScotiTech Solutions Limited, trading as AppDeploy (the "Processor"), and the customer organisation that accepts this DPA (the "Controller").
Where AppDeploy processes personal data on your behalf in connection with the AppDeploy service (the "Service"), AppDeploy acts as a processor and you act as a controller, each as defined in Data Protection Law.
2. Definitions
"Data Protection Law" means the UK GDPR, the EU GDPR, the UK Data Protection Act 2018, and — where it applies to the Controller's use of the Service — India's Digital Personal Data Protection Act, 2023, together with any other data-protection law that applies, in each case as amended. Where the DPDP Act applies, "Controller" includes "Data Fiduciary", "Processor" includes "Data Processor", and "Data Subject" includes "Data Principal".
"Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Supervisory Authority" have the meanings given in the UK GDPR. "Sub-processor" means any third party engaged by the Processor to process Personal Data on the Controller's behalf. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
3. Subject matter, duration, nature and purpose
The subject matter is the Processor's provision of the Service to the Controller. The duration is the term of the Agreement plus any retention period permitted under Section 11.
The nature and purpose is the private distribution of the Controller's iOS and Android applications to its employees and authorised app users, and — where the Controller enables it — mobile device management of the Controller's devices, including device enrolment (link-based and Apple Automated Device Enrollment), managed app deployment, configuration profiles, OS update management, administrator-initiated device actions (such as lock, Lost Mode, passcode clearing, and erase, each executed only on the Controller's instruction), together with identity and entitlement management, install analytics, audit logging, role-based access control, billing, and optional Apple Business directory synchronisation.
The categories of Data Subjects and Personal Data are set out in Annex A.
4. Instructions
The Processor shall process Personal Data only on the Controller's documented instructions, including those given through the configuration and ordinary use of the Service, unless required to do otherwise by law. The Processor shall inform the Controller if, in its opinion, an instruction infringes Data Protection Law.
5. Processor obligations
The Processor shall:
- process Personal Data only on documented instructions;
- ensure that persons authorised to process Personal Data are bound by an appropriate duty of confidentiality;
- implement the technical and organisational measures set out in Annex B;
- respect the conditions for engaging Sub-processors in Section 7;
- assist the Controller, by appropriate measures and insofar as possible, in responding to Data Subject requests;
- assist the Controller in complying with its security, breach-notification, impact-assessment and prior-consultation obligations, taking into account the nature of processing and the information available to the Processor;
- at the Controller's choice, delete or return all Personal Data after the end of the provision of services; and
- make available the information necessary to demonstrate compliance and allow for and contribute to audits.
6. Security
The Processor implements and maintains the technical and organisational measures described in Annex B, designed to ensure a level of security appropriate to the risk, including encryption in transit, encryption at rest for sensitive credentials, access control, tenant isolation, and daily database backups for restoring availability after an incident (their current state is described in Annex B). The Processor tests these measures as part of its release process and may update them provided the updates do not materially reduce the overall level of security.
7. Sub-processors
The Controller provides general written authorisation for the Processor to engage the Sub-processors listed in Annex C and published on the Sub-processors page. The Processor shall give at least 30 days' notice before adding or replacing a Sub-processor, allowing the Controller to object on reasonable data-protection grounds. Where a reasonable objection cannot be resolved, the Controller may terminate the affected part of the Service. The Processor imposes data protection obligations on each Sub-processor no less protective than those in this DPA and remains fully liable for the Sub-processor's performance.
8. Data subject rights
The Processor shall assist the Controller, by appropriate technical and organisational measures and insofar as possible, to respond to requests to exercise Data Subject rights. The Service provides self-service tooling for many of these rights, including CSV export of an organisation's users, app users, install events and audit logs, and deletion of individual app users. If the Processor receives a request directly from a Data Subject, it shall not respond other than to acknowledge receipt and shall promptly forward the request to the Controller, unless legally required to respond.
9. Personal Data Breach
The Processor shall notify the Controller without undue delay and in any event within 72 hours after becoming aware of a Personal Data Breach affecting the Controller's Personal Data. The notification shall describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. The Processor shall cooperate with the Controller to mitigate the breach and prevent recurrence.
10. Audits
The Processor shall make available the information reasonably necessary to demonstrate compliance with this DPA, including security summaries and responses to a reasonable annual security questionnaire. Where that information is insufficient, the Controller, or an independent auditor it appoints under confidentiality, may conduct an audit on reasonable prior notice, during business hours, no more than once in any 12-month period or following a Personal Data Breach.
11. Deletion and return
On termination or expiry of the Agreement, the Controller has a 30-day export window during which the Processor retains the Personal Data in read-only form so the Controller can export it, as described in section 13 of the Terms of Service. At the Controller's choice, the Processor shall then delete or return all Personal Data, and delete existing copies, normally within 30 days of the end of that export window and in any event within 60 days of it, unless retention is required by law. The Processor may retain limited audit-log fingerprints and billing records required to comply with legal obligations, which shall continue to be protected under this DPA.
On written request made within 90 days of termination, the Processor shall provide written confirmation that deletion has been completed.
12. International transfers
Personal Data is hosted on infrastructure the Processor operates in Glasgow, United Kingdom. Daily database backups are kept on the same server in Glasgow; encrypted off-server backups in the European Union (Backblaze B2) are being set up, as described in Annex B and Annex C. Sub-processors process the Personal Data listed against them in the jurisdictions shown in Annex C, and some of them may also process Personal Data outside the United Kingdom and the European Economic Area, including in the United States. Where a transfer to a third country is not covered by an adequacy decision, the parties shall rely on an appropriate transfer mechanism, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Enterprise customers with specific data-residency requirements can discuss deployment options as part of the commercial review.
13. Liability and governing law
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. This DPA is governed by the laws of Scotland, and the parties submit to the exclusive jurisdiction of the Scottish courts, save where Data Protection Law requires otherwise. In the event of a conflict between this DPA and the Agreement on data protection, this DPA prevails.
Annex A — Details of processing
Categories of Data Subjects: the Controller's administrators and team members; the Controller's employees and authorised end users to whom apps are distributed; and, where Apple Business directory sync is enabled, users and groups mirrored from the Controller's Apple Business organisation.
Categories of Personal Data:
- Identity and contact data: name, work email address, phone number.
- Account data: role, permissions, authentication credentials (passwords stored only as bcrypt hashes), email-verification state.
- Entitlement data: Managed Apple ID, group membership, app assignments, VPP invite state.
- Device management data (where MDM is enabled): device identifiers (UDID, serial number, IMEI/MEID where reported), device model and name, OS version and build, supervision state, the installation status of Controller-managed apps and configuration profiles only (never a personal app inventory), device-reported security posture (e.g. passcode presence and compliance), and device management events. The Service does not collect device location, personal apps, photos, messages, or browsing history.
- Usage and audit data: install events, IP address, user agent, audit log entries, timestamps.
- Billing data: organisation billing contact and Stripe customer and subscription identifiers. Card data is tokenised by Stripe and never stored by AppDeploy.
No special category data is required by the Service. The Controller must not upload special category data into free-text fields.
Annex B — Technical and organisational measures
| Control area | Measure |
|---|---|
| Encryption in transit | TLS for all client–server and server–Sub-processor traffic |
| Encryption at rest | AES-256-GCM at the application layer for Apple Business tokens and keys, workspace push certificates, device push and unlock tokens, secrets entered in built-in configuration-profile types, webhook signing secrets, and integration connection credentials; passwords stored as bcrypt hashes; device-bound credentials in completed passcode-clear commands are redacted on completion |
| Access control | Role-based access control with per-permission overrides; least-privilege admin access; authentication on all administrative API routes |
| Tenant isolation | Per-organisation scoping of queries on workspace data, with the workspace taken from the authenticated session; tenancy checks on mutating routes; role and permission checks on protected actions |
| Audit logging | Append-only audit log of security-relevant actions, exportable by the Controller |
| Availability and recovery | Daily database backups, kept on the same server in Glasgow as the Service. Encrypted off-server backups in the European Union (Backblaze B2) are being set up; the Processor will update this Annex and the Sub-processors page when they start |
| Vulnerability management | Dependency updates and security testing as part of the release process |
| Personnel | Confidentiality obligations on all personnel with access to Personal Data |
| Sub-processor governance | Contractual flow-down of obligations; 30-day change notice; quarterly review of the Sub-processor list |
| Retention enforcement | Automated daily enforcement of published retention windows: audit records 2 years, unenrolled-device personal fields anonymised at 180 days, webhook payloads 30/90 days, unconverted access requests 90 days |
Annex C — Authorised Sub-processors
The current list is published on the Sub-processors page. Additions or replacements are notified 30 days in advance.
| Sub-processor | Service | Personal data shared | Jurisdiction |
|---|---|---|---|
| Hostinger | Transactional email (SMTP) | recipient email and name, and the content of the email | EU (Lithuania) |
| Stripe | Billing and payments | name, email, billing address, tokenised card data | UK / EU (Ireland); Stripe may also process data in the United States |
| Apple Distribution International Ltd. | Apple Business API and Apps and Books (optional) | Apple Business org users: email, Managed Apple ID, group membership | Ireland (EU) |
| Apple Inc. | Apple Push Notification service, which tells an enrolled device to check in with the Service, through the Controller's own push certificate | the device's push token and check-in token (no command content) | United States |
| Backblaze B2 (EU) | Encrypted off-server backups. Being set up; no data is sent to it yet | encrypted copies of the database and uploaded files, once in use | EU (Amsterdam) |
Apple Distribution International Ltd. is engaged when the Controller connects Apple Business, and not otherwise. Apple Inc.'s push service is engaged when the Controller enrols devices, and not otherwise.
Hosting is not a Sub-processor: the Service runs on infrastructure that the Processor operates itself in Glasgow, United Kingdom.
Not in use today: PostHog (product analytics, EU cloud), Sentry (error monitoring, EU), Cloudflare Turnstile (bot protection) and WorkOS (single sign-on for Enterprise workspaces, United States). None of them receives Personal Data. Before any of them does, the Processor will add it to the table above and give the notice described in Section 7.