Data processing agreement

Last updated 4 November 2026

This agreement forms part of the terms of service between DruOps Garage Consulting Ltd ("we", the processor) and the business using Business Desk ("you", the controller). It covers the personal information you keep in Business Desk about your customers, clients and anyone else, and meets Article 28 of the UK GDPR. If it conflicts with the terms of service, this agreement wins for personal information.

1. What we process and why

• Purpose: to provide Business Desk to you: storing and showing your records, your online booking page, and sending the confirmations, reminders, invoices, quotes and other messages you set up.
• Duration: while you have an account, and until deletion as set out in section 9.
• People: your customers and clients, people who book with you online, and your team members.
• Information: names, contact details (email, phone, address), booking and job details, payments and amounts owed, notes you write, and any other details you choose to record, such as consent forms or allergy and patch-test notes where your trade needs them. Only record health or other special category information where you have a lawful reason to.

2. Your instructions

We only process this information on your documented instructions, which are these terms and the way you use and set up Business Desk. If we believe an instruction breaks data protection law we will tell you. We won't use the information for our own purposes, sell it or use it for marketing.

3. Confidentiality

Everyone at DruOps Garage Consulting Ltd who can access your records is bound by confidentiality, and access is limited to what is needed to run and support the service.

4. Security

We keep appropriate technical and organisational measures in place, including: encryption in transit (HTTPS) and at rest; each business's records kept apart from every other business by database access rules; a separate sign-in for every team member, with owners controlling who has access; limits and spam protection on public booking pages; payment card details never held by us; and regular backups by our database provider.

5. Sub-processors

You give general permission for us to use these sub-processors, each under a written agreement with data protection terms at least as protective as this one:

• Supabase: database and sign-in, hosted in London.
• Vercel: hosting the app.
• Resend: sending emails.
• Stripe: your subscription to Business Desk (your own account details only, not your customers').
• Twilio: text messages, only if text messages are switched on for your business.

We will tell you at least 30 days before adding or replacing a sub-processor, by email or in the app, so you can object. If you object on reasonable data protection grounds and we can't resolve it, you can end your subscription and we'll refund any period paid in advance and not used.

6. Transfers outside the UK

Where a sub-processor handles information outside the UK, we make sure UK-approved safeguards are in place, such as the UK International Data Transfer Addendum or an adequacy decision.

7. Helping you

Taking into account what we process, we will help you respond to people using their rights (for example finding, correcting, exporting or deleting a customer's records, most of which you can do yourself in Business Desk), and with security, breach notification, impact assessments and consultations with the ICO where they relate to Business Desk. If someone contacts us directly about records you hold, we will pass the request to you.

8. Personal data breaches

We will tell you without undue delay, and within 48 hours, after becoming aware of a breach affecting your records, with what we know about what happened, what is affected and what we are doing about it, and keep you updated.

9. When your account ends

You can download all your records at any time from Settings. When your business is deleted (by you, or 30 days after a trial or subscription ends), we delete its records from the live service straight away. Copies in our providers' backups are removed as those backups expire, normally within 30 days. We keep billing records about you as the law requires.

10. Checking we comply

We will give you the information you reasonably need to show we meet this agreement, and answer reasonable questions about our security. Where that isn't enough, we will allow a reasonable audit by you or an auditor you appoint, at your cost, with reasonable notice, no more than once a year, and under confidentiality.

11. Contact

For anything about this agreement or data protection: businessdesksupport@druops.net. DruOps Garage Consulting Ltd is registered with the Information Commissioner's Office (registration ZC171535).