Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between CLEANER PAL LTD (company number NI721429) (“Processor”) and the cleaning firm that uses CleanerPal (“Controller”).

1. Purpose

The Controller uses CleanerPal to run its cleaning business. The Processor hosts and processes personal data that the Controller enters or collects through the service, solely to provide that service.

2. Roles

• The Controller decides the purposes of processing its customers, staff, jobs, invoices, notes, documents, and related records.
• The Processor processes that data only on documented instructions from the Controller, including use of the product as configured by the Controller’s admins.
• CLEANER PAL LTD remains controller of software-account and software-billing data, as set out in the Privacy Notice.

3. Nature of processing

Hosting, storage, retrieval, display, backup, and transmission of:

• householder and booker contact and address details;
• staff names, contact details, diaries, and pay rates the firm stores;
• job dates, notes, photo paths, signatures the firm captures;
• invoices and quotes the firm issues;
• message content the firm sends through tools we provide.

Subject matter: operation of a United Kingdom cleaning firm’s office, booking, and field tools. Duration: the term of the Controller’s account plus any export window. Data subjects: the Controller’s customers, staff, and other people the Controller records anywhere in the United Kingdom.

4. Instructions

The Controller instructs the Processor to process the data in order to provide CleanerPal, including named-database storage per firm, backups, and security monitoring.

The Processor will not process firm data for its own marketing and will not combine one firm’s operational database with another firm’s.

5. Confidentiality and security

The Processor will take appropriate technical and organisational measures, including:

• separate firm databases (firm-{companyId}) for operational records;
• access control and authentication;
• encryption in transit;
• restriction of staff access to a need-to-know basis.

The Processor will ensure persons authorised to process the data are under confidentiality obligations.

6. Sub-processors

The Controller authorises the Processor to use:

• Google Cloud / Firebase (hosting, authentication, datastore);
• Stripe (software billing; Connect when the Controller enables householder card pay);
• transactional email and SMS providers the Controller enables in settings.

The Processor will remain responsible for those sub-processors and will impose data-protection terms no less protective than this DPA.

7. International transfers

Where a sub-processor processes data outside the UK, the Processor will ensure a lawful transfer mechanism is in place.

8. Assistance

Taking into account the nature of processing, the Processor will assist the Controller with data-subject requests, security incidents, and UK GDPR assessments where the information is available to the Processor.

9. Incidents

The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting Controller data, with facts then known.

10. Deletion and export

During the account the Controller may export customers, jobs, invoices, and staff records using the tools in the product.

After the account ends, the Processor will delete or return Controller data within the period stated in the product documentation, except where UK law requires retention.

11. Audits

The Processor will make available information reasonably necessary to demonstrate compliance with this DPA. On-site audit, if required, is limited to once per year unless a regulator requires more, and is at the Controller’s cost except where the audit finds a material breach of this DPA.

12. Liability

Liability under this DPA follows the limitation of liability in the Terms of Service, including the same 12-month fees cap. Data-protection claims sit inside that cap so far as the law allows. Claims under this DPA may be brought only against CLEANER PAL LTD, not against any director, shareholder, employee, or officer.

13. Law

This DPA is governed by the same law as the Terms of Service. Claims against the Processor may be brought only in the courts of England and Wales.

CLEANER PAL LTD Company number NI721429 ICO ZC088491