Data processing agreement

This agreement forms part of our terms of service and applies when we process personal data for you under UK GDPR, the Data Protection Act 2018 and, where relevant, EU GDPR. You accept it when you create an account.

Roles

You are the controller of the enquiries your estimators collect. We are your processor.

What we process

• Subject matter and purpose: hosting your estimators, receiving and storing enquiries, sending the alerts, emails and texts you set up, and the integrations you turn on.
• Duration: for as long as you use the service, then until deletion as described below.
• People: homeowners and other members of the public who use your estimators; your team members.
• Data: names, contact details, postcodes, answers, photos, notes, booking times, and technical data such as hashed IP addresses.
• Special category data: not intended. Please don’t ask for it in your questions.

Our commitments

We will:

1. process the data only on your documented instructions, which are these terms and how you set up your account, unless the law requires otherwise (we’ll tell you if so);
2. make sure our staff are bound by confidentiality;
3. keep appropriate technical and organisational security measures, including encryption in transit, encrypted secrets, access controls, audit logs and backups;
4. use only the sub-processors on our sub-processors page, with equivalent written terms, and give you at least 30 days’ notice of new ones so you can object;
5. help you respond to people exercising their rights, and with security and impact assessments;
6. tell you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data;
7. at the end of the service, delete your data within 30 days, unless the law requires us to keep it;
8. give you the information you need to show compliance, and allow reasonable audits on 30 days’ notice, at most once a year.

International transfers

Data is stored in the UK and EEA. Any transfer outside them uses an adequacy decision or approved safeguards.

Your commitments

You’ll have a lawful basis for the data you collect, give homeowners the information required by law (including a link to your own privacy policy), and only ask for data you need.

Contact: [privacy email].