Data processing agreement

1. Parties and scope

This agreement applies when incorporated into your Jobsworth service agreement.

The parties are your business, as identified in that service agreement, and SEGMENT8 LTD, trading as Jobsworth, company number 16351175, with its registered office at 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE. In this agreement, "you" means your business and "we" means Jobsworth.

This data processing agreement, or DPA, covers personal information we process on your behalf through Jobsworth. You normally act as the controller of information about your Customers, team and work. We act as your processor.

If you process information for another controller, you may appoint us as your subprocessor only within the authority that controller has given you. Your instructions to us must reflect its lawful instructions and authorisation.

Applicable data protection law includes the UK GDPR and Data Protection Act 2018, as amended, and the EU GDPR where it applies to the processing. Terms such as controller, processor and personal data breach have the meanings given in that law.

Our separate use of information as a controller for our own account administration, billing, security and communications is described in the Privacy notice. This DPA governs processing on your behalf and takes priority over conflicting service terms for that processing.

2. Processing details

Subject matter and purpose

Providing Jobsworth so your business can manage Leads, Customers, Estimates, Quotes, Projects, Visits, team records, Variations, handovers, Invoices and payments, together with the related files and communications you choose to record.

Nature of the processing

Receiving, recording, organising, storing, retrieving, updating and displaying information; sending documents and communications as instructed; and returning or deleting information. Connected services and AI-assisted processing are included only for the features you use and the instructions you give.

Duration

For the period we provide the relevant services, followed by the processing needed to return or delete information under section 10. These obligations continue while we hold personal information on your behalf, including after your subscription ends.

People whose information is processed

Your Customers and prospective Customers, their contacts, Site owners or occupants, team members, contractors, supplier contacts, signatories and other people identified in the records you provide.

Types of information

Names, contact details, addresses and Site information; work descriptions and correspondence; schedules, assignments and Timesheets; prices, charges, Invoice and payment records; notes, signatures, certificates, documents, photos, recordings and their associated identifiers. The information depends on what your business records and which features it uses.

Information requiring extra protection

Site access notes, documents, photos or recordings may contain health information or other sensitive information. You must identify any applicable special-category or criminal-offence data requirements, establish the required lawful basis and safeguards, and give us the instructions needed to handle that information lawfully.

3. Your responsibilities and instructions

You decide why your business collects personal information, what information it needs and who should have access. You are responsible for the applicable lawful basis, privacy information, accuracy and instructions, and for managing your users' permissions and credentials. You retain the right to give lawful instructions and check our compliance under this DPA.

We must process personal information only on your documented instructions, including instructions about transfers. These can be recorded in your service agreement, this DPA, actions by your authorised users in Jobsworth, or written requests to support@getjobsworth.com.

For processing subject to the UK GDPR, an exception applies where UK law requires it. For processing subject to the EU GDPR, the exception applies where EU or Member State law requires it. We must inform you of that legal requirement before processing unless the law prohibits us from doing so on important public-interest grounds.

We must tell you immediately if we consider an instruction to infringe applicable data protection law. We must not carry out an unlawful instruction and must work with you to resolve it.

4. Confidentiality and security

We must ensure that anyone we authorise to process your personal information is committed to confidentiality or is subject to an appropriate statutory duty of confidentiality.

We must implement and maintain technical and organisational measures appropriate to the risk, as required by Article 32. This assessment must take account of the nature, scope, context and purpose of processing, the state of the art, implementation costs and the risks to people's rights and freedoms.

The measures must address confidentiality, integrity, availability and resilience; restoring access after an incident; and regular testing and assessment of their effectiveness. Encryption and pseudonymisation must be considered where appropriate to the risk.

Application security measures

Access to business records

The application uses verified Business membership, roles and record permissions to restrict access.

Google connection credentials

Stored Google Calendar connection credentials use AES-256-GCM encryption.

Web sign-in cookies

The web application sets the Secure flag on authentication cookies when served over HTTPS and uses the SameSite Lax setting.

These application measures form part of the security arrangements. Our obligation to maintain measures appropriate to the processing risk applies to the service as a whole.

5. Subprocessors

A subprocessor is another organisation we appoint to process personal information on your behalf. We may appoint one only with your prior specific or general written authorisation. Before seeking that authorisation, we must provide its identity, processing role, locations and the information needed to assess its safeguards. We must keep this information current, including relevant onward subprocessors.

Where you give general written authorisation, we must notify you in writing of intended additions or replacements before they process your information. The notice must give you enough information and time to raise a data protection objection. You can send an objection to support@getjobsworth.com.

We must discuss an objection with you and seek an arrangement that resolves it. If no lawful arrangement resolves the objection, we must not use the proposed subprocessor for the affected processing.

We must assess whether each subprocessor provides sufficient guarantees and put a written contract in place imposing the same applicable data protection obligations, including appropriate security. We remain responsible to you for the subprocessor's performance of those obligations.

6. Requests and assessments

Taking account of the nature of the processing, we must help you respond to requests from individuals exercising their data protection rights through appropriate technical and organisational measures, insofar as this is possible. If a request reaches us about information you control, we must pass it to you promptly and act on your instructions unless the law requires another response.

Taking account of the nature of the processing and the information available to us, we must help you meet your obligations under Articles 32 to 36. This includes security, breach notifications, data protection impact assessments and any required prior consultation with a supervisory authority.

7. Personal data breaches

We must notify you without undue delay after becoming aware of a personal data breach affecting information processed on your behalf. A breach includes accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, that information.

We must provide the information available to us about what happened, the affected information and people, likely consequences, measures taken or proposed, and a contact for further information. We must provide updates as further details become available and assist with investigation, mitigation and your notification obligations. You determine any notifications you must make to individuals or regulators, without limiting obligations that apply directly to us.

8. International transfers

We must follow your documented transfer instructions and meet the applicable requirements of Chapter V of the UK GDPR or EU GDPR before making a restricted international transfer, including through a subprocessor. We must provide the relevant destinations, recipients and safeguards so you can assess the arrangements.

Where a transfer needs contractual safeguards, the appropriate transfer agreement and its completed schedules must be put in place, together with any required assessment and supplementary measures. This DPA does not itself execute EU standard contractual clauses, a UK Addendum or a UK International Data Transfer Agreement.

9. Connected services and AI-assisted features

When you choose to use a connected service, you instruct us to send the information needed for that connection. The provider's role depends on the service and the arrangements with you and Jobsworth. A provider you choose is not automatically our subprocessor.

Google Calendar is an optional connection governed by Google's own provider terms. Visit events can contain Customer and Site details, dates and times, the Business name and links to Jobsworth records. The Google Calendar section of our Privacy notice explains the permissions, data use and disconnection process. Its Google Limited Use commitments continue to apply.

Where you use an AI-assisted feature, processing may include transcribing recordings, extracting document information or generating suggestions using the information needed for that task. It remains subject to your documented instructions and the applicable subprocessor and transfer requirements. Using such a feature does not authorise reuse of Google user data beyond the permitted calendar purpose.

10. Returning or deleting information

When the services involving processing end, we must, at your choice, return or delete the personal information processed on your behalf and delete existing copies. An exception applies where UK law requires storage for processing subject to the UK GDPR, or EU or Member State law requires storage for processing subject to the EU GDPR. Send your choice to support@getjobsworth.com so the method and timing can be documented and your instructions carried out.

Information retained because the law requires it must remain protected and used only for that legal purpose. This DPA continues to apply until the relevant information has been returned or deleted, including any copies that still require deletion.

The 90-day historical viewing window in the Terms of service is separate from your return or deletion instructions. It does not set a deletion period for records or backups.

11. Information, audits and inspections

We must make available the information needed to demonstrate compliance with Article 28 and allow and contribute to audits and inspections by you or an auditor you appoint.

We must cooperate on practical arrangements that protect other people's information and the security of the service. Those arrangements must not prevent you from exercising your statutory audit rights or obstruct a supervisory authority.

12. Changes and contact

The date above identifies this version. Changes to agreed processing terms must follow the applicable service agreement and data protection law. Updating this page alone does not record your agreement to a change or provide subprocessor authorisation.

Send processing instructions, requests and questions to support@getjobsworth.com. We must send notices required by this DPA to your designated data protection contact, or your service contact if you have not designated one. Keep those contact details current.