Data processing agreement

Last updated 12 October 2026

1. Who this applies to

This data processing agreement (DPA) forms part of the terms of service between Omnia Systems (UK) Ltd (“Omnia”) and the customer that uses Omnia Manage (the “Customer”). It applies whenever Omnia processes personal data on the Customer’s behalf in providing Omnia Manage.

The Customer is the controller of that personal data, or a processor acting for its own clients, in which case Omnia is its sub-processor. Omnia is the processor. In this DPA, “UK GDPR”, “personal data”, “processing”, “controller”, “processor” and “personal data breach” have the meanings in the UK GDPR and the Data Protection Act 2018. Where the EU GDPR also applies, references to the UK GDPR include it.

2. Details of the processing

• Subject matter and purpose: providing, supporting and securing Omnia Manage, an IT asset and software management service, for the Customer.
• Duration: while the Customer uses Omnia Manage, and until the data is deleted under section 9.
• Nature of the processing: storing, organising, matching and displaying data the Customer enters, uploads or connects; reading data from services the Customer connects (such as Microsoft 365, RMM, MDM, distributor and cloud accounts); sending emails the Customer sets up; and, where the Customer uses them, the AI features.
• Types of personal data: names, work email addresses, phone numbers, job titles and departments; sign-in and activity records; devices and software linked to a person, including the last signed-in user; licence assignments; contents of documents the Customer uploads, such as contracts and invoices; and, where the Customer uses the helpdesk or call logging, ticket and email content, caller numbers, and call transcripts and summaries (transcripts are kept for 7 days).
• Data subjects: the Customer’s staff and users, and the staff, users and contacts of the Customer’s clients.
• Special category data: Omnia Manage is not designed for it, and the Customer should not put it in.

3. Instructions

Omnia processes the personal data only on the Customer’s documented instructions, unless the law requires otherwise (in which case Omnia will tell the Customer first, unless the law forbids that). The Customer’s instructions are the terms, this DPA, and the Customer’s own use and settings of Omnia Manage, including the integrations it connects and turning on Support Access. Omnia will tell the Customer if it believes an instruction breaks data protection law.

4. Confidentiality and access by Omnia staff

Everyone at Omnia who can access the personal data is bound by a duty of confidentiality and has access only where their role needs it.

Support access. Where the Customer turns on Support Access, Omnia may access Customer personal data in the Customer’s workspace solely to provide the support requested. Turning on Support Access is a documented instruction of the Customer for the purposes of Article 28(3)(a) UK GDPR. Access lasts only for the period the Customer chooses and ends when it is turned off. Omnia staff sign in as a separate “Omnia Manage Support” account, Omnia records each access and the member of staff who made it, and that record is available to the Customer’s administrators in Omnia Manage.

Operating the service. A small number of named Omnia staff have administrative access to the systems that host Omnia Manage. They use it only where needed to run, update, secure or repair the service, for example to apply updates or investigate a fault, and not to view the Customer’s data for any other purpose.

5. Security

Omnia keeps appropriate technical and organisational measures in place to protect the personal data, including:

• a separate database for each customer workspace, with access controlled by role and checked by the database itself;
• encryption in transit (HTTPS) and at rest;
• hosting in London, UK, with regular backups;
• sign-in through Microsoft or one-time links, with access removed when a user is deactivated;
• credentials for connected services held on the server, never sent to the browser;
• records of administrative actions taken by Omnia staff.

6. Sub-processors

The Customer authorises Omnia to use the sub-processors below. Omnia has a written contract with each that gives the personal data the same protection as this DPA, and remains responsible for them.

Omnia will update this list and email the Customer’s workspace administrators at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds. If we can’t resolve the objection, the Customer may end its subscription and receive a refund of any fees paid for the period after it ends.

The services the Customer connects to Omnia Manage, such as Microsoft 365 or its RMM, are the Customer’s own suppliers, not Omnia’s sub-processors.

7. International transfers

Customer data is stored in the UK. Some sub-processors may process it outside the UK. Where they do, Omnia makes sure there are appropriate safeguards, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

8. Helping the Customer

• Requests from individuals: Omnia will help the Customer respond to requests to see, correct, delete or move personal data, and will pass on any such request it receives directly.
• Breaches: Omnia will tell the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting the Customer’s data, with the information the Customer needs to meet its own obligations.
• Impact assessments: Omnia will give reasonable help with data protection impact assessments and consultations with the Information Commissioner’s Office that relate to Omnia Manage.

9. When the agreement ends

The Customer can ask for an export of its data within 30 days after the agreement ends. Omnia then deletes the workspace and the personal data in it within a further 30 days, unless the law requires Omnia to keep it. Backups are overwritten in their normal cycle, within 30 days after that.

10. Information and audits

Omnia will give the Customer the information it reasonably needs to show that this DPA is being followed. The Customer, or an auditor it appoints who is bound by confidentiality, may audit Omnia’s compliance once a year on 30 days’ notice, at the Customer’s cost, or at any time after a personal data breach.

11. Liability

Each party’s liability under this DPA is subject to the limits in the terms of service, except where the law does not allow it to be limited.

Contact

Data protection questions: [email protected].