DRAFT — not executed. Proposed processor obligations require acceptance, a completed schedule and qualified legal review; current implementation is not proof of all contractual obligations.
Parties, scope and schedule
MirrorHQ is the trading name of ELPI CONSULTING LIMITED, company number 11850883, registered office 166 Nuns Way, Cambridge, England, CB4 2NS. Website: https://mirrorhq.co.uk. General enquiries: hello@mirrorhq.co.uk. Privacy enquiries: privacy@mirrorhq.co.uk. Mailbox operation requires owner verification.
Controller: [Customer legal name, address and authorised contact — TO COMPLETE]. Processor: ELPI CONSULTING LIMITED trading as MirrorHQ. Subject matter: customer workforce location/availability planning, visitor/contractor hosting and occupancy. Duration: the agreed service relationship and approved return/deletion phase, subject to documented exceptions. Nature: recording, storing, organising, displaying, updating, exporting and reviewed deletion. Purposes: customer-directed workplace planning and hosting.
Data subjects: employees/workers, managers/admins, visitors and contractor contacts. Data categories: names/work contact details, role/department/team/reporting relationships, locations/patterns/neutral attendance, visit/assignment times and operational notes, request/event metadata. Special-category information is outside intended scope; users must not enter health information. The customer must assess inference/misuse risks and provide lawful instructions.
Documented instructions and confidentiality
Proposed clause for review: Processor processes customer personal data only on documented instructions, including transfers, unless legally required otherwise; it informs Controller of a legal requirement where permitted, and promptly flags instructions it considers infringing applicable data-protection law. Persons authorised to process data must be bound by confidentiality. Controller remains responsible for lawful collection, instructions, notices and access decisions. Final instruction/support and authorised-person processes must be agreed.
Security and incidents
Implemented measures include HTTPS, company-scoped database access, separated role assignments, caller-checked administrator exports/closure requests, protected subscription fields, deactivation and cached-view clearing, no normal confidential-table access and formula-neutralised CSV. Audit events cover export/closure/retention requests only, not all activity. Security measures and provider dependencies should be reviewed periodically.
Proposed clause for review: Processor takes appropriate Article 32 measures, assists Controller with breach/security duties, and notifies Controller without undue delay after becoming aware of a personal-data breach. Incident contacts, escalation evidence, notification content and operating procedure require approval. No invented hour deadline or guaranteed recovery time applies.
Subprocessors and international processing
Verified: Lovable Cloud supplies the managed database and authentication service; Lovable serves the application, with Cloudflare evidenced by published delivery headers. Configured Google and Microsoft sign-in use external identity providers when selected. The backend connection metadata indicates eu-west-1 (Ireland), but this does not establish every copy, log, support-access location or contractual residency guarantee. Auth emails originate through Cloud Auth; the underlying delivery provider and current sender configuration require confirmation. Application visit/schedule emails are not enabled. Platform-injected traffic/event scripts were observed; their data flows, recipients, retention and controls require assessment. The final subprocessor schedule and international transfer safeguards are NOT verified. Do not assume UK-only or EEA-only access.
Proposed clause for review: engage subprocessors only under the agreed prior specific/general written authorisation, notify intended changes and allow the agreed objection process, impose equivalent data-protection obligations and remain responsible as required by Article 28. TO COMPLETE: legal entity names, services, locations, authorisation process, change notice/objection period and approved transfer mechanism. No SCC, UK Addendum, IDTA or adequacy basis is asserted as in force.
Assistance, rights and assessments
Proposed clause for review: taking account of processing nature and information available, Processor assists Controller with rights requests, security, breach duties, DPIAs and supervisory-authority consultation. Requests received directly are directed to the Controller unless law requires otherwise. Identity verification, response ownership, secure delivery and any agreed service/cost arrangements require completion.
Return, deletion, holds and backups
Proposed clause for review: at the end of services, at Controller's choice, return or delete personal data and copies unless applicable law requires retention. Company-admin CSV excludes operational notes and auth data, so it is not a complete contractual return mechanism; any fuller authorised return must be handled by the operator. The current app records closure requests but does not execute deletion. TO COMPLETE: legal exceptions, approved timeframe, auth-account procedure, provider instructions, deletion evidence and handling of restored backups.
Proposed defaults, subject to legal review: active employee directory for the employment/workspace relationship with controlled review after removal; workforce attendance 12 months; visitors 90 days after the visit; contractors 12 months after assignment end; unused expired invitations 30 days after expiry; application-controlled event records 90 days. Company administrators can save proposed periods. These are NOT active deletion deadlines: automatic deletion is disabled, no deletion schedule is enabled, and existing data is not purged. Actual information remains until an authorised, reviewed process is completed. Legal holds and necessary exceptions must be documented before activation.
Lovable documents daily database snapshots, retained for up to roughly 14 days, covering database schema and data, not storage files. Point-in-time recovery is not offered: restore uses daily snapshots and reverts the same database in place. Project backup timestamps and restore effectiveness have not been verified. The application cannot selectively erase provider backups or provider-controlled logs. Restoring an earlier snapshot can reintroduce removed records and old access policies; reviewed migrations and any deletion register must be reapplied before service resumes.
Information, audits and execution
Proposed clause for review: Processor makes information necessary to demonstrate compliance available and allows/contributes to audits and inspections by Controller or its authorised auditor, subject to a legally appropriate process. TO COMPLETE: audit process, contacts, security schedule, applicable law/jurisdiction and authorised signatures/dates. This DPA must not be described as effective until approved and executed.