Procurement and supplier assurance
Everything a council or housing association normally asks a supplier before it will discuss a contract, gathered in one place — including the questions where the honest answer is currently "not yet".
Who you would be contracting with
| Item | Detail |
|---|---|
| Trading name | DampFix Scotland |
| Legal entity and company number | Sole trader, trading as DampFix Scotland. Not incorporated at present. |
| Registered address | Airdrie, North Lanarkshire. Full business address supplied on request and stated on any contract. |
| VAT registration | Not VAT registered. Invoices are issued without VAT. |
| ICO data protection registration | To be completed before any tenant data is processed. Registration reference supplied before a pilot begins. |
| Principal contact | Founder and sole proprietor — hello@dampfixscotland.co.uk. Named contact and full business address are provided on request and stated on any contract. |
| Country of operation | Scotland. Airdrie, North Lanarkshire. |
DampFix Scotland is an independent supplier. It is not endorsed by, affiliated with, or approved by the Scottish Government, the Scottish Housing Regulator, or any local authority.
Said plainly: this is currently a sole trader
DampFix Scotland trades as a sole trader today. For a short, capped founding pilot that is usually straightforward, and it sits well below any regulated procurement threshold.
If your standing orders require a limited company, a minimum insurance limit, or evidence of financial standing before you can contract at all, say so at the first conversation. Incorporating is a short piece of administration and would be done before signature rather than argued about afterwards. It is better to establish that at the start than after a pilot has been scoped.
Insurance
| Cover | Status |
|---|---|
| Professional indemnity | Being arranged. In place, with the limit agreed with you, before a pilot begins. |
| Public liability | Being arranged. In place before a pilot begins. |
| Cyber liability and data breach | Being arranged. In place before a pilot begins. |
Certificates are provided on request. Where a contract requires a specific limit of indemnity, that is a normal thing to agree before signature rather than after.
Data protection
Roles
Your organisation is the data controller. DampFix Scotland is the data processor, acting only on your documented instructions under a written agreement compliant with Article 28 of the UK GDPR.
Data location
All personal data is held in the United Kingdom. There is no routine international transfer. If that ever needed to change, it would require your prior written instruction.
Special category data
Reports may contain health information and details of vulnerable occupants, including children. This is handled as special category data, and its treatment is set out on the security page and in the triage design.
Sub-processors
The list of sub-processors is kept deliberately short, and you are told before it changes.
| Sub-processor | Purpose | Location |
|---|---|---|
| UK provider, confirmed with you before a pilot | Application and database hosting | United Kingdom |
| UK or EU provider, confirmed with you before a pilot | Transactional email to tenants and staff | United Kingdom / EU |
Documents available
- Data processing agreement, for your legal team to review
- Record of processing activities
- Support for your data protection impact assessment
- Retention and deletion schedule
- Procedure for subject access, rectification and erasure
Service levels
These are the levels offered for a founding pilot. They are deliberately modest and deliberately honest: a single-founder supplier should not promise 24/7 cover it cannot staff.
| Measure | Commitment |
|---|---|
| Service availability target | 99.5% monthly, excluding notified maintenance |
| Planned maintenance | Outside 08:00–18:00 Monday to Friday, with at least 5 working days' notice |
| Support hours | 09:00–17:00, Monday to Friday, excluding Scottish public holidays |
| Priority 1 — service unavailable | Response within 2 working hours |
| Priority 2 — a core function is unusable | Response within 4 working hours |
| Priority 3 — everything else | Response within 2 working days |
| Escalation | Direct to the founder. There is no ticket queue to get lost in. |
| Security incident notification | Without undue delay, and within 24 hours of confirmation, to support your 72-hour ICO obligation |
Say this out loud during procurement
DampFix Scotland is currently a small supplier. For a service that is not itself safety-critical — the legal duty and the repair both sit with you — that is usually acceptable, and the exit terms below exist so that it stays acceptable. If your organisation requires a supplier of a certain size or financial standing, it is better to establish that at the start than after a pilot.
Business continuity and exit
Backups and recovery
- Automated encrypted backups of the database and evidence store
- Recovery point objective: 24 hours
- Recovery time objective: 24 hours
- Restores tested, with the case history integrity chain re-verified after restore
If the supplier fails
This is the question a careful council asks about any small supplier, and it deserves a straight answer.
- Your data is exportable by you, at any time, without asking
- Every case exports as a self-contained document that opens in any browser and prints to PDF — it does not depend on DampFix continuing to exist
- A full structured export of your organisation's data is available on request
- Source code escrow can be arranged where a contract requires it
Exit
- Exit terms agreed before a pilot starts, not negotiated at the end
- Your data returned in open, documented formats
- Secure deletion within an agreed period after handover, confirmed in writing
- No lock-in through proprietary formats, and no charge for leaving
Change control
Material changes to the service, to sub-processors, or to the statutory ruleset used to calculate deadlines are notified in advance. The ruleset is versioned: correcting it never alters the rules a historic case was judged against.
Assurance status at a glance
| Assurance | Status |
|---|---|
| Trading status | Sole trader. Incorporation available if your standing orders require it. |
| ICO data protection registration | Not yet registered. Completed before any tenant data is processed. |
| Professional indemnity, public liability and cyber cover | Being arranged. In place before a pilot begins. |
| UK data residency | Yes |
| Article 28 data processing agreement | Available for review |
| Encryption in transit and at rest | In place |
| Mandatory MFA for staff accounts | In place, enforced by the software |
| Role-based access control | In place |
| Tamper-evident audit trail | In place |
| Cyber Essentials | Not yet held — identified as a milestone |
| Cyber Essentials Plus | Not yet held |
| ISO 27001 | Not held. Not proportionate at this stage; happy to discuss. |
| Independent penetration test | Not yet carried out. Planned before any live tenant data. |
| Independent accessibility audit | Not yet carried out. See the accessibility statement. |
| Live customer deployments | None. Founding pilot places are open. |
A supplier who answers every one of those with an unqualified yes, this early, is worth questioning closely.
How you would actually buy it
Fair Work First
Scottish public bodies are expected to apply Fair Work First criteria in procurement. DampFix Scotland supports those principles, including payment of at least the real Living Wage, and is content to give the standard undertakings.
Modern slavery
Turnover is below the threshold that requires a published statement under the Modern Slavery Act 2015. A statement of practice is available on request.
Route to contract
A founding pilot is small enough that it will normally sit well below the regulated procurement threshold, and can usually be handled as a low-value purchase or a quick quote through your existing process — including via Public Contracts Scotland where you prefer.
What is proposed is a short, limited, fixed-term pilot with a written evaluation and no automatic rollover, precisely so that a longer commitment can be competed properly later if it is justified.