Data processing agreement

Version 1.0 · Published [?] October 2026

This agreement covers how Tradeworthy handles your callers’ details on your behalf. The law (UK GDPR, Article 28) says a business that uses a service like ours must have this in writing. It is part of our Terms, and you accept it by ticking the box when you sign up.

1. Who this agreement is between

1.1 “You” means the business that signs up for Tradeworthy. You are the controller of your callers’ details: you decide why and how they are used.

1.2 “We” or “us” means Tradeworthy Ltd, registered in England and Wales, company number 17376267, registered office 66 Paul Street, London EC2A 4NA. We are your processor: we handle your callers’ details on your behalf and only to provide our service to you.

1.3 In this agreement, “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in UK data protection law. “UK data protection law” means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended from time to time. “Your personal data” means the personal data described in annex 1 that we process for you.

2. What we process, and for how long

2.1 Annex 1 sets out the subject matter, nature and purpose of the processing, the types of personal data, the people it is about, and how long each kind is kept.

2.2 This agreement lasts as long as we provide the service to you, and after that for as long as we still hold any of your personal data.

3. Your instructions

3.1 We process your personal data only on your documented instructions. Your instructions are:

• our Terms and this agreement
• the plan you choose and the choices you make when you sign up and when you tell us how you work, including your services, your opening hours, what we do with calls outside those hours, the numbers we answer, your reach number and, on the Cover plan, what happens to callers who aren’t a new job
• the retention periods in annex 1, which are our standard settings and which you adopt by signing up. You can ask us in writing to keep your personal data for less time. We will confirm what we can set and record it on your account. Shorter periods mean we may not have a transcript if you later need one to settle a dispute
• any other instruction you give us in writing (email is fine) that we agree is part of the service

3.2 We also follow your instructions on transfers of your personal data outside the UK (clause 8).

3.3 We may process your personal data other than on your instructions only where UK law requires us to. If so, we will tell you first, unless the law stops us.

3.4 If we think an instruction breaks UK data protection law, we will tell you straight away. We do not have to follow that instruction until it is resolved.

3.5 We never sell your personal data, pass it to another trade or business, or use it to market anything of our own.

4. Our people

4.1 We give access to your personal data only to people who need it to provide the service. Each of them is bound by a duty of confidentiality, under their contract or by law.

5. Security

5.1 We take appropriate technical and organisational measures to protect your personal data, as required by Article 32 of the UK GDPR. They are described in annex 2. We review them regularly and may improve them, but we will not reduce the overall level of protection.

6. Sub-processors

6.1 You give us general authorisation to use other companies to process your personal data (sub-processors). The ones we use now are listed in annex 3.

6.2 Before we add or replace a sub-processor, we will email you at least 14 days in advance. If one of our sub-processors gives us less notice of a change to its own sub-processors, we will tell you as soon as we are told. You may object on reasonable data protection grounds within that time. If you object and we can’t resolve it with you, you can end the affected service without the 14-day cancellation cut-off in our Terms applying, and without paying any exit fee.

6.3 Each sub-processor is bound by a written contract with data protection obligations that give at least the same protection as this agreement.

6.4 We remain responsible to you for the work of our sub-processors.

6.5 The sub-processors listed in annex 3 may keep copies of your personal data for longer than the periods in annex 1, under their own terms.

7. How the service handles your callers’ details

7.1 Calls are recorded. You don’t have access to recordings. You get call notes made from each recording, and we can give you a full transcript, if we still hold it, if you need one to settle a dispute about a call. We never give you recordings.

7.2 Our assistant asks callers what the job is, not why they need it. If a caller mentions something sensitive, such as their health, it stays in the recording and transcript and is deleted with them. It is not copied into the job details.

7.3 We do not allow our sub-processors to use your personal data to train their AI models. Some may use data that has first been anonymised and combined, so it can’t identify anyone, to improve their services.

7.4 We keep an eye on our sub-processors’ terms. If one makes a change that significantly affects how your personal data is handled, we will tell you.

8. Transfers outside the UK

8.1 Some sub-processors process personal data outside the UK. Annex 3 shows where, and the safeguard used for each.

8.2 We transfer your personal data outside the UK only where UK data protection law allows it: to a country or scheme covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), or under the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

9. Helping you with requests from callers

9.1 Callers have rights over their personal data, including to see it, correct it, delete it and object to its use. You are responsible for answering their requests.

9.2 If a caller sends a request to us, we will pass it to you within 2 working days. We will not answer it ourselves, other than to tell the caller we have passed it on.

9.3 We will help you answer requests, as far as we reasonably can, by finding, copying, correcting or deleting the caller’s details in our systems.

9.4 If you take over a call from our assistant and the caller asks not to have their details kept, tell us by WhatsApp or email. We will delete what our assistant took down on that call.

10. Personal data breaches

10.1 If we become aware of a personal data breach affecting your personal data, we will tell you without undue delay, and in any case within 48 hours of becoming aware of it.

10.2 We will tell you what we know: what happened, the kinds and rough numbers of people and records affected, the likely consequences, and what we are doing about it. Where we don’t yet know everything, we will tell you what we have and follow up as we learn more.

10.3 We will help you meet your own duties to report the breach to the ICO and, where needed, to tell the people affected.

11. Helping you meet your other duties

11.1 Taking into account what we do and the information we have, we will help you with:

• keeping your personal data secure
• data protection impact assessments for your use of our service
• consulting the ICO, if an assessment shows you need to

12. When the service ends

12.1 While you are a customer, we delete your personal data no later than the periods in annex 1. These are the longest periods we keep it, not a promise to keep it for that long, and we may delete it sooner.

12.2 On the Capture and Cover plans, we will delete all your personal data within 30 days of your contract ending. You keep the job messages we have already sent to your devices. On the Convert plan, you can export your personal data for 30 days after your contract ends, and then we will delete it.

12.3 We will keep a copy only where UK law requires us to, and only for as long as it requires. Our deletion periods apply to live systems we and our sub-processors use in normal running. Backups that are not live or accessible in normal use are excluded: they are overwritten on the supplier’s own cycle and never restored for use.

13. Information and audits

13.1 We will give you the information you reasonably need to show that we meet this agreement and Article 28 of the UK GDPR.

13.2 We will allow, and help with, audits and inspections by you or an auditor you appoint, who must agree to keep what they see confidential. You must give us at least 30 days’ notice, and audits are limited to once a year unless there has been a personal data breach or the ICO requires one. You pay your own costs. We may first offer documents that answer your questions, and agree an audit only if they don’t.

14. Our own use of data

14.1 You instruct us to create anonymised, combined statistics from the service, such as how many calls are answered or how long they last, to improve the service. Nothing in them can identify a caller or you. Once data is anonymised, it is no longer personal data.

14.2 Your own details as our customer (such as your name, contact details and billing) are not covered by this agreement. We handle them as a controller, as explained in our Privacy notice.

15. Your responsibilities

15.1 You must:

• have a lawful reason under UK data protection law for us to handle your callers’ details as described in annex 1
• tell your callers how their details are used, for example by linking your website’s privacy notice to our page How we handle callers’ details
• only give us instructions that comply with the law
• not ask us to collect sensitive information, such as health details, about callers
• tell us without delay about any request or complaint from a caller that we need to act on

16. Liability and precedence

16.1 Each of us is liable for our own breaches of this agreement and of UK data protection law. The limits of liability in our Terms (clause 16) apply to this agreement, except where the law does not allow it. Our total liability under the Terms and this agreement together is limited to the total fees you paid us in the 12 months before the claim.

16.2 If this agreement and our Terms say different things about personal data, this agreement wins.

16.3 This agreement is governed by the law of England and Wales, as our Terms are.

Annex 1: Details of the processing

How long we keep it

These are the longest periods we keep each kind of data. We may delete it sooner.

Annex 2: Security measures

[?]

Measures already in place or required by our own rules:

• every account is created from a Tradeworthy admin address, with named admin users and no shared passwords
• two-step sign-in on our accounts, including the one we use for your Google account
• access to your personal data limited to the people who look after your account
• you have no access to recordings, and job messages link to call notes, never to recordings
• recordings and other data deleted on the schedule in annex 1
• we never ask for, accept or use your Google password
• sub-processors chosen only if they have a data processing agreement, a UK transfer safeguard and retention we can limit

Annex 3: Sub-processors

For every plan

Only if you buy Present (coming soon)

Stripe handles your card payments as an independent controller, not as our sub-processor, so it isn’t listed here. Google is a separate controller for its own Local Services Ads and Business Profile services.