Data processing agreement
This covers the personal data of your customers and your team that passes through Kitso. You are the controller and we are the processor. It forms part of the terms of service.
Who is who
You are the data controller for the personal data described below. You decide what it is used for, how long you keep it and who you share it with, and you are responsible for having a lawful basis for it and for giving the people it is about the notice the law requires.
We are your processor for that data. We act only on your documented instructions, which are this agreement, the terms of service and what you do in the service, and we never use it for our own purposes. That includes where it goes: it is sent outside the United Kingdom only as this agreement describes. If the law ever requires us to do something else with it, we will tell you first unless the law forbids that.
For your own account details, such as your email address, your business information and your billing, we are the controller rather than your processor. The privacy policy covers that side. We are registered with the Information Commissioner's Office under number ZC263453.
What we process, and for how long
The subject matter is the data that reaches the service through the website and booking page we provide for you, and the records you and your team keep in the portal and the apps. The duration is the life of your subscription, plus the retention period below.
The people concerned are your prospective and actual customers, people who review your business, and the members of your team. We ask for no special category data and you should not enter any. The personal data is:
- Enquiries and bookings: a name, a phone number, an email address, a postcode or address, the message or booking details, which page it came from, and any photographs attached. Photographs on an enquiry are passed to you by email and not kept by us.
- Customer records: your customers' names, phone numbers, email addresses, addresses, notes, jobs, appointments, photographs of the work, quotes, invoices, payments and messages sent to them, and when a quote or invoice was opened, downloaded, answered or paid.
- Reviews: the reviewer's name, the review and its date, whether you add it or it comes from your Google Business Profile.
- Your team: each member's name, email address, login, the jobs they are put on, their notes, and the times they clock on and off.
- A record of each email sent for you: the address it went to and its subject line, kept for ninety days. That record holds no copy of what an email to your customer said.
What we do with it on your instructions
We process this data only to provide the service. That means storing it, checking it for content we cannot accept, showing it to you and your team, telling you about it in the ways you have chosen, backing it up, and doing the things you ask the service to do with it, including:
- Sending your quotes, invoices, reminders, booking confirmations, review requests and instant replies to your customers by email, in your business's name, when you send them or switch them on.
- Sending your invoices and their customers to accounting software you connect.
- Checking a photograph you add, such as a photograph of a job, with our AI provider before it is stored.
- On the Kitted plan, when you use Kit, sending the records it needs to answer you to our AI provider, and your voice to a speech provider if you talk to it.
- Reading a receipt you photograph, to fill in a cost.
What we never do with it
We do not sell it, mine it, advertise with it, contact your customers on our own account, or use it to train any AI model. It is never sent to an advertising or analytics service.
If we believe an instruction of yours would breach data protection law, we will tell you rather than carry it out.
Visits to your website
We also count visits to your site without cookies: the page, the referrer, whether somebody tapped your phone number or a booking button or used your form, and a visitor value described in the cookie policy. No network address and no browser details are stored. We handle these counts for you under this agreement, and they are kept and deleted with the rest of your account.
Where your site shows a map of your premises, the visitor's browser fetches it from Google directly, under Google's own terms. Google is not our sub-processor for that.
Confidentiality and security
Everyone with access to this data is bound to keep it confidential, and only those who need it to run or support the service can reach it.
We keep appropriate technical and organisational measures in place to protect it, including encryption in transit, passwords stored so that nobody here can read them, encrypted storage of the keys to accounts you connect, restricted access to production systems, and a record every time a person here opens your portal as you see it.
Each member of your team has their own login and sees only what you allow.
Who else touches it
These are the only companies other than us that handle this data for us. You give us general permission to use them. Each is bound by a written contract giving the same protection as this agreement, and we remain responsible to you for what they do. We will tell you before we add or replace one, and you can object.
| Who | What they do | What they see |
|---|---|---|
| Railway | Runs the software and hosts the database | All of it, at rest |
| Cloudflare | Serves your domain, so an enquiry passes through it on the way to us | Enquiries, in transit |
| Cloudflare | Stores backup copies of our database, in the European Union | All of it, at rest |
| Resend | Sends you the email telling you an enquiry has arrived, and sends the emails you send or switch on to your customers | What each email carries |
| Google, Mozilla, Microsoft or Apple | Relays a browser push notification, where you turned notifications on | Nothing readable. A browser push is encrypted so the relay cannot read it |
| Expo, with Apple and Google | Delivers a notification to our app, where you or your team allowed notifications | What the notification shows, such as an enquirer's name and number |
| Stripe | Processes payments from your customers, where you switch payments on | What your customer enters to pay, under Stripe's own terms with you |
| AI | Checks photographs before they are stored, reads receipts you photograph, and runs Kit on the Kitted plan when you use it | The photograph or receipt, and the records Kit needs to answer you |
| ElevenLabs | Turns your speech into text when you talk to Kit | What you say. We keep the words and not the sound |
| Gandi | Hosts your business email inbox, where you have one | The emails in that inbox |
| Ideal Postcodes, through postcodes.io | Turns a job's postcode into a place, so a job can show how far away it is | The postcode only |
Services you connect
Where you connect your own accounting software or Stripe account, data goes to it on your instruction under your own agreement with that company. That company is not our processor, and what it does with the data is between you and it. The same goes for your Google Business Profile, where you add us as a manager: its reviews are read from Google, and a reply you ask for is posted there, under your agreement with Google.
Where you take payments, Stripe processes the card details and the payment and acts as a controller of that data in its own right for its own legal duties. We never see your customers' card numbers. We keep a record of the payment, what it was for, whether it succeeded and the 0.2% fee we took on it, so it shows in your portal.
Helping you meet your obligations
If somebody asks you for a copy of their data, asks you to correct it, or asks you to delete it, we will help you answer within the time the law allows. You can find, change and delete records in your portal and export your enquiries from it, and we will send you anything else we hold on request. If one of those people writes to us instead, we pass the request to you.
We will also give you reasonable help with keeping this data secure, with a data protection impact assessment, and with a consultation with or a question from the Information Commissioner's Office about this data.
If there is a personal data breach affecting this data, we will tell you without undue delay and give you what you need to make your own report.
Where the data is
The data is stored in the United Kingdom or the European Economic Area. Some of the companies above are based in the United States and may handle it there. Where they do, the transfer is made under a safeguard UK data protection law recognises, such as the UK extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum.
When it ends
When your subscription ends you can export your data, and we will return anything the export does not include if you ask. Twelve months after you leave we delete it, or sooner if you ask. If you delete your account yourself, it is deleted straight away.
Backup copies made before a deletion are overwritten on a rolling cycle of about three months and are used for nothing else in the meantime. Beyond that we keep only what the law requires us to keep.
You may audit our compliance with this agreement, on reasonable notice and at your own cost, or ask us for the information you need to satisfy yourself of it.