Data processing agreement for trades

Parties and scope

This agreement is between you (the trade, the controller) and [Company name] (company number [number], registered office [address]) (the processor). It covers the personal data of your customers that you keep in Fixture Pro. It forms part of the trade terms and applies for as long as you use Fixture Pro.

The processing

• Subject matter and purpose: providing Fixture Pro to you — your schedule, customers, visits, payments, expenses, invitations and messages.
• Duration: while you have an account, then until deletion as below.
• Nature: storing, organising, displaying, sending emails you ask us to send, and backing up.
• Data types: customers’ names, addresses, phone numbers, email addresses, access notes, visit history, prices, payments and balances, and photos you take on visits.
• Data subjects: your customers and the people you deal with at their homes.

Our obligations

• We process the data only on your documented instructions (using Fixture Pro is your instruction), unless the law requires otherwise — we’ll tell you first if we can.
• Our staff and contractors who can access it are bound by confidentiality. Support staff see account metadata, not your customers’ details, unless you consent to a time-limited, read-only view.
• We keep it secure: encryption in transit, private storage with access rules enforced in the database, re-encoded photos without location data, two-step sign-in for our staff, logged admin actions, and backups.
• We help you respond to your customers’ rights requests and with security, breach and impact-assessment duties, as far as Fixture Pro allows (you can export and delete records yourself).
• We tell you without undue delay after becoming aware of a personal data breach affecting your data.
• We make available the information you need to show these obligations are met, and allow reasonable audits on notice.

Sub-processors

You authorise these sub-processors. We’ll give you notice before adding or replacing one, and you may object. Each is bound by terms that protect the data at least as well as this agreement.

• Supabase — database, authentication and file storage (hosting region [region — Sean to confirm]).
• Vercel — application hosting.
• Resend — sending email.
• Stripe — payments and billing (and Stripe Identity for ID checks, if used).
• Anthropic — photo recognition, only where AI features are switched on (no customer details are sent).
• [Identity provider, when chosen].

International transfers

Some sub-processors may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

Deletion and return

You can export your data at any time. When you close your account we delete your customer data, except where the law requires us to keep it (for example records of payments).