The Office Management Operating System by The Office Management Group
DATA PROCESSING AGREEMENT
Version 1.0 · 3 September 2026
This Data Processing Agreement (DPA) forms part of, and is incorporated by reference into, the OMOS Terms and Conditions between The Office Management Group Limited (company number 10284254, registered office Victoria House, 50 Alexandra Street, Southend-on-Sea, Essex, SS1 1BN) (we, us, the Processor) and the customer subscribing to OMOS (you, the Controller).
This DPA applies only where and to the extent that we process Customer Personal Data on your behalf in connection with the OMOS platform. It is intended to satisfy the requirements of Article 28 of the UK GDPR.
Our processing of personal data for our own account administration, billing, security, support, legal compliance, public enquiries, onboarding-readiness submissions, customer relationship management and marketing purposes is carried out by us as an independent Controller and is governed by the OMOS Privacy Policy rather than this DPA.
1. Definitions
Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing and Supervisory Authority have the meanings given to them in the UK GDPR.
UK GDPR means the United Kingdom General Data Protection Regulation as it forms part of UK law, together with the Data Protection Act 2018.
Customer Personal Data means Personal Data that we process on your documented instructions in order to provide the Platform, including personal data relating to your staff, authorised users, visitors, contractors and other individuals whose information you enter into an OMOS workspace. It does not include personal data for which The Office Management Group Limited determines the purposes and means of processing as an independent Controller.
Data Protection Legislation means the UK GDPR, the Data Protection Act 2018 and other applicable data-protection law, as amended or replaced from time to time.
Sub-processor means a third party appointed by us to process Customer Personal Data on our behalf in order to provide the Platform.
2. Roles of the Parties
2.1 In respect of Customer Personal Data, you are the Controller and The Office Management Group Limited is the Processor.
2.2 We will process Customer Personal Data only to provide, secure, maintain and support the Platform in accordance with your documented instructions, this DPA and the Terms and Conditions, unless applicable law requires otherwise.
2.3 You are responsible for ensuring that you have an appropriate lawful basis for the Customer Personal Data you instruct us to process, for providing required privacy information to Data Subjects, and for ensuring that your use of OMOS complies with applicable Data Protection Legislation.
2.4 The Office Management Group Limited acts as an independent Controller for its own account and business-contact administration, billing and subscription records, security and abuse-prevention records, support communications, legal and compliance records, prospective-customer and onboarding-readiness submissions, CRM records and its own marketing activities. Those activities are described in the OMOS Privacy Policy and are outside the processor obligations in this DPA.
2.5 The details of processing carried out under this DPA are set out in Annex 1.
3. Our Obligations as Processor
3.1 We shall process Customer Personal Data only on your documented instructions, including instructions contained in the Terms and Conditions and this DPA, unless required to do otherwise by applicable law. Where permitted by law, we will inform you before carrying out processing required by law.
3.2 If, in our reasonable opinion, an instruction from you infringes applicable Data Protection Legislation, we will inform you without undue delay and may suspend the affected processing until the instruction is clarified or amended.
3.3 We shall ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.
3.4 We shall implement appropriate technical and organisational measures designed to provide a level of security appropriate to the risk, taking account of the nature of the processing and the information available to us.
3.5 We shall not appoint a new Sub-processor to process Customer Personal Data without general authorisation under this DPA and prior notice of a material new appointment. We will provide such notice through an appropriate customer communication channel, which may include email to the account administrator or an in-platform notice, normally at least 30 days before the change takes effect where reasonably practicable.
3.6 You may object to a new Sub-processor on reasonable data-protection grounds during the notice period. We will consider the objection in good faith. If we cannot reasonably provide the affected service without that Sub-processor, either party may terminate the affected service in accordance with the Terms and Conditions.
3.7 Where we engage a Sub-processor, we shall impose data-protection obligations appropriate to the processing and remain responsible for the Sub-processor's performance to the extent required by applicable law.
3.8 Taking into account the nature of the processing, we shall provide reasonable assistance to enable you to respond to Data Subject rights requests, including through available account-management, export and deletion functionality.
3.9 Taking into account the nature of processing and information available to us, we shall provide reasonable assistance with your obligations relating to security, breach notification, data-protection impact assessments and prior consultation with a Supervisory Authority.
3.10 At your reasonable written request, normally no more than once in any 12-month period unless a security incident or legal requirement justifies additional review, we shall make available information reasonably necessary to demonstrate compliance with this DPA and allow for reasonable audits subject to confidentiality, security, prior-notice and non-disruption requirements.
4. Personal Data Breach Notification
4.1 We shall notify you without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and will aim to provide initial notification within 48 hours where reasonably practicable.
4.2 The notification will, to the extent known at the time, describe the nature of the breach, the categories of affected data and Data Subjects, likely consequences, and measures taken or proposed. Where information is not yet available, it may be provided in phases without undue delay.
4.3 We shall document Personal Data Breaches as required by applicable law and provide relevant information reasonably required by you to meet your own legal obligations.
5. Security and Access
5.1 Customer data is logically separated by organisation. OMOS uses organisation identifiers, authenticated access controls and role-based permissions designed to prevent one customer from accessing another customer's data.
5.2 Customer administrators are responsible for managing access permissions within their organisation. Access by our personnel to Customer Personal Data is restricted to authorised purposes such as support, security, maintenance and legal compliance and should be limited to what is necessary.
5.3 Data transmitted to and from OMOS is protected using HTTPS/TLS. Our infrastructure providers apply security controls to stored data in accordance with their service configurations.
5.4 We will keep our security arrangements under review as the Platform develops.
6. Data Return, Export and Deletion
6.1 Cancelling a subscription stops renewal at the end of the current billing period but does not, by itself, immediately delete the workspace.
6.2 Before deletion, the customer may use the workspace export functionality made available by OMOS. The available export is intended to provide defined workspace records and should not be understood as a copy of every record held by every infrastructure or service provider.
6.3 When an authorised administrator closes a workspace, normal workspace access is revoked. OMOS provides a 30-day export-only/safety period before primary workspace data is scheduled for deletion.
6.4 Following that period, primary Customer Personal Data in the workspace is scheduled for deletion from active systems. Limited information may be retained where reasonably necessary for legal, accounting, security, fraud-prevention, audit or dispute-resolution purposes, or while encrypted backups expire through the relevant provider's normal backup-rotation process.
6.5 We will not use retained Customer Personal Data for a new purpose inconsistent with the reason for its retention.
6.6 Where a deletion cannot be completed as expected because of a technical or provider issue, we will take reasonable steps to complete or remediate the deletion rather than treating the unresolved data as intentionally retained workspace content.
7. International Transfers
7.1 Some Sub-processors may process Customer Personal Data outside the UK or EEA.
7.2 Where a restricted transfer of Customer Personal Data occurs, we shall use an applicable lawful transfer mechanism or safeguard as required by UK Data Protection Legislation. Depending on the provider and destination, this may include UK adequacy regulations, the UK Extension to an applicable data privacy framework, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or another lawful mechanism.
7.3 Processing locations and transfer arrangements may depend on the relevant provider, service configuration and infrastructure region. We will maintain appropriate information about material Sub-processors and their transfer arrangements and will update our documentation as the Platform evolves.
8. Special-Category and Sensitive Data
8.1 OMOS includes workplace, health and safety, visitor, staff and incident-management functionality. Depending on how a customer uses the Platform, Customer Personal Data could include limited health, disability, accessibility, accident or other information that may constitute special-category personal data.
8.2 You must only enter special-category personal data where it is necessary for a legitimate workplace purpose and where you have identified both an appropriate Article 6 lawful basis and, where required, an Article 9 condition under UK GDPR. You are responsible for any additional assessments, notices or safeguards required for your processing.
8.3 OMOS is not intended to be used as a medical-record system or as a repository for unnecessary detailed health information. Customers should apply data minimisation and avoid entering special-category data unless genuinely required.
8.4 Customers must not use OMOS to store criminal-offence data unless they have first established that their use is lawful and have confirmed with us that the Platform and contractual arrangements are appropriate for that processing.
8.5 Users must not enter special-category or unnecessary personal data into optional AI-assisted fields or prompts.
9. Optional AI-Assisted Processing
9.1 Where a customer chooses to use the optional AI project-breakdown feature, the project title and selected operational area may be processed through Replit's AI integration and Anthropic to generate suggested project actions.
9.2 The feature is intended to assist users and does not replace human judgement. Customers remain responsible for reviewing AI-generated output before using it.
9.3 Customers should not include special-category, highly confidential or unnecessary personal data in project titles or other information submitted to AI-assisted functionality.
9.4 AI providers will be treated as Sub-processors under this DPA only to the extent that they process Customer Personal Data on our behalf in providing an active OMOS feature. Applicable provider terms, retention arrangements and international-transfer safeguards will apply to that processing.
10. Retention
10.1 Customer Personal Data is retained for the duration necessary to provide the active service and through the applicable workspace closure/export/deletion process described in clause 6.
10.2 Retention of information processed by The Office Management Group Limited as an independent Controller - including billing, public intake, prospective-customer, CRM, support, security and legal records - is governed by the OMOS Privacy Policy rather than this DPA.
10.3 Sub-processor backups, logs and service records may be retained according to their applicable service configurations and legal obligations, subject to the protections described in this DPA and our Privacy Policy.
11. Liability
11.1 Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the OMOS Terms and Conditions, to the extent permitted by law.
12. Term
12.1 This DPA takes effect when the customer accepts the OMOS Terms and Conditions or otherwise enters into an agreement for OMOS that incorporates this DPA, and continues for as long as we process Customer Personal Data on the customer's behalf.
13. General
13.1 This DPA is governed by the laws of England and Wales, consistently with the governing-law provisions of the OMOS Terms and Conditions.
13.2 If there is a conflict between this DPA and the Terms and Conditions in relation to our obligations as a Processor of Customer Personal Data, this DPA will prevail to the extent of that conflict.
13.3 Questions about this DPA or requests relating to Customer Personal Data can be sent to hello@useomos.com.
Annex 1: Details of Processing
Annex 2: Authorised Sub-processors
The following providers are relevant to processing Customer Personal Data within active OMOS workspace functionality. Providers used solely for The Office Management Group Limited's own Controller activities are described in the Privacy Policy and are not automatically Sub-processors under this DPA.
Depending on product configuration, additional providers may become Sub-processors if they begin processing Customer Personal Data on our behalf within customer workspace functionality. We will update this Annex and provide notice of material new Sub-processors in accordance with clause 3.5.
For clarity, Stripe, GoHighLevel/LeadConnector, Resend and Cloudflare Turnstile are currently used principally for OMOS's own billing, customer-management, public-form, security or communications activities. They are described in the Privacy Policy. If any of those services is subsequently used to process Customer Personal Data on a customer's instructions as part of the Platform, it will be treated as a Sub-processor for that processing and this Annex will be updated.
Google Fonts and jsDelivr may receive ordinary browser request metadata when external resources are loaded. They are not listed here as Article 28 Sub-processors for Customer Personal Data.
Annex 3: Systems Not Currently Active for Customer Personal Data
The following systems may be referenced in product plans, dormant code or interface text but are not currently treated as active Sub-processors for Customer Personal Data:
· Mailgun - legacy interface references only; Resend is the active email provider.
· Google Calendar integration - not currently active.
· Microsoft 365 / Outlook integration - not currently active.
· Umami Analytics - not active; dormant hooks exist but no active runtime configuration is installed.
· OpenAI, Google Gemini or other AI providers - not currently used by OMOS for the active AI project-breakdown feature.
· Persistent customer file/object storage - not currently connected.
This DPA should be read together with the current OMOS Terms and Conditions and Privacy Policy.