Data Processing Agreement

Last updated: 1 November 2026

Parties

Glebefish Limited, a company registered in England and Wales (company number 14038854), registered office 1 Johns Road, Woolston, Southampton, SO19 9BW, which operates Guv: the processor ("we", "us").

The trade business using Guv, as named on its account: the controller ("you").

1. What this agreement covers

Your customers' personal data. The names, addresses, phone numbers, email addresses, photographs and signatures your people record against a job. You decide what is collected and why, so you are the controller and we are your processor.

Where your workers' phones are, where you use it. The position read when a stage is tapped, and the latest position while someone is on shift, are recorded because you use those features for your own purposes, so for that data too you are the controller and we are the processor. Before you use them you agree to tell your people, and not to use them as an attendance or performance-monitoring tool: they record a place at a moment, not hours worked. The app tells each person what it does before it reads anything; that is not your notice to your own people.

Not covered: your people's own account data (their sign-in email, name, phone number and role). We decide how that is used to run the service, so we are its controller, and the privacy policy covers it.

Where this agreement and the privacy policy differ on the data this agreement covers, this agreement applies.

2. Details of the processing

Set out in Annex 1 below.

3. Only on your instructions

We process your customers' data only on your documented instructions, including on any transfer outside the UK. Your instructions are this agreement, your people's ordinary use of Guv (adding jobs, taking photographs and signatures, sending messages), and any further written instruction you give us. We may charge for an instruction that needs work beyond providing the service.

We do not use your customers' data for our own purposes, sell it, use it for advertising, or use it to train AI or machine learning models.

AI features. Four features send data to an AI provider, Mistral AI in Paris, which processes it in EU and EFTA countries, does not keep it once the answer is returned, and may not train on it: importing a customer list (the column headings and up to twenty rows), reading an uploaded PDF booking (the whole document), and Ask in the search (only the words typed), and AI drafting (a voice note recorded on a job, written up as its report, which is not kept; or the job's description and report and the customer's name, to draft a message to the customer or an invoice's wording, never their address, phone number or email). The PDF reading, Ask and AI drafting are off for your trade business until one of your admins turns them on. Nothing created from an AI answer is saved until one of your people has checked it. Any new AI feature is a change under section 7 and is listed before it is switched on.

If we think an instruction would break UK data protection law, we will tell you and may hold off acting on it until it is resolved.

4. Confidentiality

Everyone we allow to process your customers' data is bound to keep it confidential. Today that is one person at Glebefish Limited. Anyone given access in future gets it through their own account with only the access they need, after agreeing in writing to keep it confidential.

5. Security

We keep your customers' data secure with the measures in Annex 2, which are what the service does today, not plans.

6. Sub-processors

You give us general written authorisation to use sub-processors. The ones we use, what each does, what data it handles and where, are published at guvguvguv.com/subprocessors, which is Annex 3 of this agreement. Each is bound by data protection terms that protect your customers' data at least as well as this agreement, and we remain responsible to you for what each does.

7. Changes to sub-processors

A change we choose to make: we update the published list and tell you by email before the change takes effect.

A change one of our sub-processors makes to its own suppliers: we pass its notice on to you as soon as we receive it. We cannot give you more notice than we are given. Where that notice is too short for you to act on, we suspend the affected feature rather than pass on notice you cannot use.

If you object on reasonable data protection grounds, we will work with you to find an alternative. If there is none, you may stop using the affected feature, or close your account under the terms.

8. Your customers' requests

We help you answer your customers' requests to see, correct, delete, restrict, move or object to the use of their data. The tools are in Guv: your people can edit a customer or a job, and an admin can export everything held about chosen customers, or erase it. Your customers have no account with us; if one contacts us, we point them to you and tell you.

9. Security incidents and impact assessments

We help you keep the processing secure, deal with personal data breaches, and carry out data protection impact assessments and any prior consultation with the ICO.

We tell you of a personal data breach affecting your customers' data without undue delay after we become aware of it, with what we know: what happened, roughly whose and how many records are affected, the likely consequences, and what we are doing about it. Your 72 hours to tell the ICO start when you become aware, so we do not wait to have every detail. We find out through Google Cloud's alerting, our audit logs and error reporting, which reach us by email; we do not run a round-the-clock security operations centre.

10. When the service ends

When your account closes, we delete your customers' personal data, and you can export it first; we cannot return it once it is deleted. Closing an account deletes the live records at once. A trial that ends without a plan being chosen is deleted on the date we email you, by default 37 days after its last day. Copies in our backups are overwritten as the backups age out, within 14 days. We keep nothing longer unless the law requires us to.

11. Showing we comply

We give you the information you need to show that this agreement is being kept, and allow for and contribute to audits by you or an auditor you appoint. In practice: we answer reasonable written questions about our processing, and share Annex 2, the sub-processor list and our sub-processors' own published certifications. We hold no ISO 27001, SOC 2 or similar certification ourselves. An on-site inspection is on reasonable notice, in business hours, no more than once a year unless a regulator requires it or after a breach, and under confidentiality.

12. Where the data is

Your customers' data is stored in Google's London region (europe-west2): the database, files and our server code all run there. What any sub-processor handles outside the UK, and where, is on the sub-processor list. We transfer your customers' personal data outside the UK only to a country the UK treats as adequate (the EU and EFTA countries are), or under an Article 46 safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

13. Term, liability and changes

This agreement lasts as long as your account, and section 10 for as long as it takes to complete. It is part of the terms of service, and each side's liability under it is as the terms set out. Nothing in it limits liability that the law does not allow to be limited, or either side's responsibilities under UK data protection law. It is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

We may update this agreement as the service changes. We tell you by email before a change that materially affects you takes effect, and a change you need to agree to is put to your admin in the app and on the dashboard, as a change to the terms is.

Annex 1: Details of the processing

Subject matter and duration. Providing Guv to you, for as long as your account is open, and section 10 after.

Nature and purpose. Recording, storing, organising, using, sending and deleting data, by automated means, so your people can book, plan, carry out and record work for your customers: jobs and rounds, photographs and sign-off, messages, quotes and invoices, and, where you turn them on, emails and texts to your customers about their own job, tracking links, a customer portal and card payments; and, where you turn AI drafting on, a job's work report written up from a voice note, and drafts of messages and invoice wording for your people to check.

Data subjects. Your customers and the people who sign for work; your subcontractors who are sole traders; and your own people, for their positions only (section 1).

Personal data.

• Customer names, phone numbers, email addresses and addresses, and the map coordinates worked out from an address.
• Job details, notes and the records of what was done.
• Photographs of the work, which may show a customer's property, and signature images with the name of the person signing and the time.
• Records of the emails and texts sent to customers and whether they were delivered, and a customer's request to stop receiving them, kept so that the request keeps working.
• Subcontractors' names and contact details, and the name and email of anyone sent a tracking link.
• Where your people's phones were when they tapped a stage, and their latest position while on shift, where you use those features.
• A job's work report: what was done, what was used and what needs following up. And, where you use AI drafting, the voice note it was written from, sent once and not kept.

Special category data and children. No field asks for special category data, though a note or a photograph could show it by accident; you control what your people record. Guv is a business tool and not meant for anyone under 18.

Annex 2: Security measures

• Each trade business sees only its own data, enforced on the server by the database and file storage security rules, which an automated test suite checks before every change.
• Roles are set by the server, in signed sign-in claims the app cannot change, and privileged actions run on the server behind an admin check.
• Sign-in is through Google Firebase Authentication; we never see or store passwords. Admins can turn on two-step sign-in with an authenticator app. Invitations expire after 7 days, and invitations and sign-ups are rate limited.
• Encryption in transit (HTTPS) and at rest. Logins you give us for other services, such as a mailbox or a load exchange, are also encrypted field by field under a key held outside the database.
• An audit log records changes to people's roles and access, and the connection and disconnection of outside logins, with who made them.
• Recovery: the database is protected from deletion, with seven days of point-in-time recovery and a daily backup kept for 14 days. Our incident response plan was tested on 27 September 2026.
• Monitoring: crash reporting and error alerts reach us by email. Automated tests run before every change, and the apps are tested end to end on real phones.
• On the phone: photographs and signatures taken without a signal are held on the phone only until they upload.
• Retention: photographs and signatures are deleted 12 months after the job is finished, the customer email log after 90 days, and map coordinates worked out from an address 30 days after the job is finished. Everything else is kept until you delete it or close the account.

Annex 3: Sub-processors

The list published at guvguvguv.com/subprocessors, as it stands at the time, changed only as section 7 sets out.