These Data Processing Terms form part of the Terms of Service between you (the business using BuildX) and BUILDX TOOLS LTD. They meet the requirements of Article 28 of the UK GDPR for personal data we process on your behalf.
1. Roles
1.1 For personal data you put into BuildX about your customers, staff, subcontractors and other people ("customer personal data"), you are the controller and we are your processor.
1.2 Each of us will comply with UK data protection law. You're responsible for having a lawful basis for the customer personal data, and for giving people any information the law requires.
2. Details of the processing
| Subject matter and purpose | Providing the BuildX service: storing, organising, displaying and sending your records, and the features you use, such as quotes, invoices, payments, forms, reminders, calendars, maps and reports. |
|---|---|
| Duration | For as long as you use the service, and afterwards until the data is deleted (see 9). |
| Types of personal data | Names, contact details, addresses and site locations; job, quote, invoice and payment details; signatures, photos and documents; time records and pay or charge rates; enquiry messages; and anything else you choose to add. |
| People concerned | Your customers and their contacts, enquirers, staff and team members, subcontractors, suppliers, and people named in your documents. |
| Special category data | The service isn't designed for it. If you record any, for example injury details in an accident report, you're responsible for having a lawful basis and an appropriate condition for doing so. |
3. Our obligations
We will:
- process customer personal data only on your documented instructions, including these terms and your use of the service's features, unless the law requires otherwise (in which case we'll tell you first, unless the law prevents it);
- make sure anyone we authorise to process it is bound by confidentiality;
- keep it secure with appropriate technical and organisational measures, including encryption in transit, access controls that separate each business's data, hashed passwords, and backups;
- help you, as far as reasonably possible, to respond to requests from people exercising their data protection rights;
- help you meet your obligations on security, breach notification, data protection impact assessments and consulting the ICO, taking into account the nature of the processing and the information available to us; and
- make available the information reasonably needed to show we comply with these terms, and allow for and contribute to reasonable audits, on reasonable notice and at most once a year unless the ICO requires otherwise.
4. Sub-processors
4.1 You authorise us to use the sub-processors below. We'll have a written contract with each one that gives the same level of protection as these terms, and we stay responsible for them.
| Sub-processor | Purpose |
|---|---|
| fasthosts.co.uk (UK) | Hosting the service and its database |
| Cloudflare | Secure delivery and protection of the service |
| Resend | Sending emails to your customers and team |
| Stripe | Payments from your customers, if you turn on online payments |
| Geoapify | Supplier search near job sites (map positions only) |
4.2 We'll give you at least 30 days' notice of any new sub-processor by updating this page and telling you by email or in the app. If you object on reasonable data protection grounds, we'll discuss it with you. If we can't resolve it, you can end your subscription and we'll refund any fees paid in advance for the period after it ends.
5. International transfers
Where a sub-processor processes customer personal data outside the UK, we'll make sure the transfer is covered by UK adequacy regulations or by appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum.
6. Personal data breaches
We'll tell you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting customer personal data. We'll give you the information we have to help you meet your own obligations, and update you as we learn more.
7. People's rights
If someone contacts us directly to exercise their rights over customer personal data, we'll pass their request on to you and won't respond ourselves, unless you ask us to or the law requires it.
8. Your instructions
You'll make sure your instructions comply with data protection law. We'll tell you if we think an instruction breaks the law.
9. When the service ends
You can export your records at any time. After your subscription ends, we keep customer personal data for up to 12 months in case you return, then delete it. If you ask us to delete it sooner, we'll do so within 30 days of your request. Either way, we won't delete data the law requires us to keep. Backups are overwritten on a rolling basis.
10. Liability
The limits on liability in the Terms of Service apply to these terms, except where the law doesn't allow them to.