Data processing agreement

This clause sets out the subject matter, duration, nature and purpose of the processing, the type of personal data and the categories of data subject, as Article 28(3) requires.

• Subject matter: enquiries submitted by your prospective customers through the assistant page we operate for you.
• Duration: from the day your assistant goes live until you cancel, plus the retention period in clause 2.
• Nature and purpose: collecting, transmitting, storing and delivering completed enquiries so that you can respond and quote for work. Nothing else.
• Type of personal data: the contact details an enquirer chooses to give (name, email address, and optionally company and telephone number), the answers they give to your questions, and the conversation in which they gave them.
• Categories of data subject: your prospective customers — people making commercial or domestic cleaning enquiries.
• Enquirers sometimes volunteer more than the above, for example an access arrangement or a health-related reason for a request. We store and deliver such content exactly as we do any other enquiry content; what happens to it after delivery is your decision as controller.

Enquiries are received over TLS, stored in the EU-region database named in schedule 2, and delivered to the mailbox you nominate.

They are deleted no later than 30 days after successful delivery, and in no case are they kept longer than 90 days after receipt, whatever their delivery status.

Deletion is automatic. It runs on a daily schedule in our own code rather than depending on anyone remembering, and it is not conditional on your asking for it.

Because of this, the enquiry emails we deliver to you are your record. Beyond the window above we hold no working copy of your enquiries and no archive of them, and you should not rely on us for one; where a copy survives in a backup it is put beyond use and deleted as set out in clause 11. This does not limit our obligations to deliver your enquiries, to help you with the requests in clause 8, or to return or delete personal data under clause 11.

We process personal data only on your documented instructions, including where a transfer to another country is concerned, unless we are required to do otherwise by law that applies to us. If that happens we will tell you before processing, unless the law forbids us from telling you.

Your instructions are this agreement together with the configuration choices you make during setup and by later request — your questions, your service areas, and the address enquiries are delivered to. Instructions given by email are documented instructions.

If we consider that an instruction you give infringes data protection law, we will tell you immediately.

You decide the purpose of the processing and remain responsible for it. You give enquirers the privacy information they are owed, wherever you publish your assistant link. You handle requests from enquirers exercising their rights, with our help under clause 8. You may give us further documented instructions consistent with this agreement.

You confirm that you have a lawful basis for the processing you are instructing, and that the questions you ask through the assistant are lawful and proportionate to quoting for cleaning work.

Everyone we allow to process personal data under this agreement — employees, contractors, temporary and agency staff alike — is bound by a duty of confidence, whether by contract or by statute.

We take the technical and organisational measures Article 32 requires, taking account of the state of the art, the cost of implementation, and the nature and risk of the processing.

The measures in force for this service are described in full on our security page, and currently include: TLS in transit, including between our application and the database; credentials held only in deployment configuration and never in source; administrative access that fails closed when it is not configured; de-duplication of stored records on unique event ids so that a retry cannot corrupt delivery state; rate limits and abuse controls on the public intake; no third-party scripts on assistant pages; and the scheduled deletion in clause 2.

We keep these measures proportionate to the risk, and we will tell you before reducing any of them.

You give us general written authorisation to engage the sub-processors listed in schedule 2, and no others.

We will give you at least 14 days' written notice before adding or replacing a sub-processor, so that you have a real opportunity to object. If you object, we will discuss it with you in good faith; if it cannot be resolved, you may end the affected service without penalty and receive a refund of any fee paid for a period after it ends.

We impose the same data protection obligations on every sub-processor by written contract, offering an equivalent level of protection, and we remain fully liable to you for a sub-processor's failure to meet them.

Taking account of the nature of the processing, we help you respond to requests from individuals exercising their rights of access, rectification, erasure, restriction, objection and portability.

Send the request to the contact in schedule 1, telling us the date you received it. We will respond without undue delay and in any event within 5 working days of receiving it from you. Your own deadline runs from when you received the request, not from when you send it to us, so please send it on promptly; if you are close to your deadline, say so and we will treat it as urgent. Our answer covers the personal data we still hold for you: we cannot reproduce anything already deleted under clause 2.

If someone contacts us directly to exercise their rights over personal data we hold for you, we will forward what they have asked for to you without undue delay and tell them that you are the person responsible for answering. We will not decide or answer the request on your behalf unless you instruct us to, or unless the law requires us to. This paragraph is about your data; where we are the controller in our own right, we answer the request ourselves.

Taking account of the nature of the processing and the information available to us, we help you to: keep personal data secure; notify a personal data breach to your supervisory authority, including the UK Information Commissioner's Office where the UK GDPR applies; notify affected individuals where that is required; carry out a data protection impact assessment; and consult your supervisory authority where an assessment shows a high risk that cannot be mitigated.

We will tell you without undue delay, and in any event within 24 hours of becoming aware of it, about any personal data breach affecting your personal data.

The 24-hour figure is a commitment we impose on ourselves, on top of our duty to tell you without undue delay. The law sets no fixed processor-to-controller deadline. Where a breach is notifiable, you must report it to your supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it — and a breach is not notifiable at all where it is unlikely to result in a risk to people's rights and freedoms. That clock starts when you become aware, which is why we do not let ourselves take two days to reach you.

Our notification will include, as far as we know it at the time: what happened; the categories and approximate number of individuals and records concerned; a contact point; the likely consequences; and the measures taken or proposed, including anything done to limit the harm. Where we do not yet have the full picture we will tell you in stages rather than waiting.

We keep a record of every personal data breach affecting your data, whether or not it is notifiable.

When this agreement ends, we delete or return all personal data processed for you, whichever you choose, and delete our existing copies, unless the law requires us to keep something.

If you choose deletion and say nothing, we delete. Deletion is secure. Where data sits in a backup it is put beyond use immediately and deleted on that backup system's next deletion cycle.

You may ask for a copy of everything held for you at any time, not only at the end, and we will send it within 5 working days.

We make available to you all the information necessary to demonstrate compliance with Article 28, and we allow for and contribute to audits and inspections carried out by you or an auditor you appoint.

At the scale of this service, audits are conducted remotely on reasonable notice, no more than once a year except after a suspected incident. Each party bears its own costs, except that we bear the cost of an audit prompted by a breach attributable to us.

Separately from audits: changes you ask us to make to your configuration — your questions, your delivery address, your service areas — are made within 2 working days and at no charge. That turnaround is for routine configuration changes. It does not apply to an instruction that has to be acted on sooner — for example changing a delivery address you tell us is compromised, or stopping processing — which we act on as quickly as the circumstances require.

We maintain records of the categories of processing carried out for you, as Article 30(2) requires, and make them available to you on request.

We do not transfer your personal data outside the UK or the EEA without a valid transfer mechanism: adequacy regulations, standard data protection clauses such as the EU Standard Contractual Clauses together with the UK Addendum or the IDTA, or a certified framework recognised for UK purposes.

Schedule 2 states, for each sub-processor, where data is processed and which mechanism is relied on, taken from that vendor's published terms.

Each party's total liability to the other under this agreement, for all claims taken together, is limited to the greater of the fees paid or payable under the subscription in the twelve months before the first such claim arose, or £5,000.

That limit does not apply to: liability that cannot lawfully be limited; either party's liability for death or personal injury caused by negligence, or for fraud; our liability under clause 7 for a sub-processor's failure to meet its obligations; or either party's liability for fines or compensation imposed on the other by a supervisory authority or court to the extent they result from that party's own breach of this agreement.

Neither party excludes any right an individual has under data protection law to compensation from either of us directly.

This agreement is governed by the law of Latvia, and the courts of Latvia have jurisdiction. Nothing here removes a mandatory protection available to you under the law of your own country, or the jurisdiction of your own supervisory authority.

This agreement is version 1.1, effective 6 September 2026. The version you accepted at setup is recorded against your account, with the date and time you accepted it.

If we need to change it, we will tell you at least 14 days in advance and publish the new version at this address. Continuing to use the service after a change takes effect means accepting the new version; if you would rather not, you may cancel without penalty.

Processor: Stepe Digital SIA, company number 40203711274, registered at Līča iela 12, Lejasciems, Lejasciema pag., Gulbenes nov., Latvia. Notices, data subject requests and breach correspondence go to adrians@stepedigital.com.

Controller: the business named in the setup submission that accepted this agreement, at the contact details given in it. Tell us if that contact changes.