ClientBuild

Data Processing Agreement

Version 1.0 · Effective from the date you accept our Terms of Service

1. Who this is between

This Data Processing Agreement (“DPA”) is between:

• Trademark Design and Build Ltd, a company registered in England and Wales (company number 11021125), whose registered office is at Second Floor, 3 Liverpool Gardens, Worthing, West Sussex, BN11 1TF, trading as ClientBuild (“we”, “us”, “the Processor”); and
• the person or business that subscribes to ClientBuild (“you”, “the Controller”).

This DPA forms part of, and is governed by, our Terms of Service. It takes effect when you accept those Terms and continues for as long as we process personal data on your behalf.

2. What this document does

When you use ClientBuild, you put personal data about your own clients into the platform — their names, addresses, and details of their building projects. That data belongs to you and your clients, not to us.

In data protection law, that makes you the controller and us the processor. Article 28 of the UK GDPR requires a written agreement between us setting out how we handle that data. This is that agreement.

This DPA does not cover data about you as our customer — your own name, email, billing details and business information. We are the controller of that data, and our Privacy Policy explains how we handle it.

3. Definitions

Data Protection Law means the UK General Data Protection Regulation and the Data Protection Act 2018, as amended or replaced from time to time.

Personal Data, controller, processor, data subject, processing and personal data breach have the meanings given in Data Protection Law.

Customer Personal Data means personal data that we process on your behalf under this DPA, as described in Annex 1.

Sub-processor means any third party we engage to process Customer Personal Data on our behalf.

4. Your obligations

You confirm that:

1. you have a lawful basis for the personal data you put into ClientBuild, and have provided the necessary information to the individuals concerned;
2. your instructions to us for processing Customer Personal Data comply with Data Protection Law; and
3. you will not upload special category data (such as health, ethnicity, religious or biometric data) or criminal offence data to the platform. ClientBuild is not designed to hold it, and doing so is a breach of these terms.

5. Our obligations

We will:

1. Process only on your instructions. We will process Customer Personal Data only on your documented instructions, which are: to provide the ClientBuild service as described in our Terms of Service, and anything you specifically ask us to do. If we are required by law to process it otherwise, we will tell you first unless the law prevents us.
2. Keep it confidential. Anyone we authorise to access Customer Personal Data will be bound by a written duty of confidentiality.
3. Keep it secure. We will apply appropriate technical and organisational security measures, as set out in Annex 3.
4. Use sub-processors responsibly. We will only use the sub-processors listed in Annex 2, or others notified to you under clause 6. Each will be bound by data protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.
5. Help you answer your clients. If one of your clients exercises a right under Data Protection Law — access, correction, erasure, portability, restriction or objection — we will provide reasonable assistance to help you respond. If a request comes to us directly, we will pass it to you rather than answer it ourselves.
6. Help you meet your own duties. We will give you reasonable assistance with security obligations, breach notification, data protection impact assessments and consultations with the Information Commissioner, taking into account the nature of our processing and the information available to us.
7. Tell you about breaches. We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data. Our notice will describe what happened, the categories and approximate number of records affected, the likely consequences, and the steps we are taking. This gives you time to meet your own 72-hour duty to report to the Information Commissioner.
8. Return or delete it at the end. On termination, and in accordance with clause 7, we will return or delete Customer Personal Data.
9. Demonstrate compliance. We will make available the information reasonably necessary to show we are meeting our obligations under this DPA, and will allow and contribute to audits as described in clause 8.

6. Sub-processors

You give us general authorisation to use the sub-processors listed in Annex 2.

If we intend to add or replace a sub-processor, we will give you at least 30 days' notice by email. If you reasonably object on data protection grounds within that period, you may terminate your subscription without penalty and receive a refund of any fees paid for the unused portion of your current billing period.

7. Retention, return and deletion

We do not retain Customer Personal Data once you stop using the Service. When your subscription ends, we delete Customer Personal Data from our live systems within 30 days. Backup copies are overwritten on our normal backup cycle and are deleted within a further 90 days.

Deletion is permanent, so export your data before your subscription ends. You may request an export at any time while your subscription is active, and we will provide it in a commonly used machine-readable format within 30 days. We will also provide an export on request during the 30-day period after your subscription ends, after which the data is gone and cannot be recovered.

You may request deletion at any time, including during an active subscription, and we will action it within 30 days of your request.

We may retain data for longer only where required by law, in which case we will continue to protect it under this DPA and process it only for that purpose.

8. Audit

On reasonable written notice, and no more than once in any 12-month period unless required by a supervisory authority or following a personal data breach, we will provide information reasonably necessary to demonstrate compliance with this DPA. This may take the form of written responses, security documentation, or third-party certifications held by us or our sub-processors.

Any information disclosed under this clause is confidential and may be used only to verify our compliance.

9. International transfers

Customer Personal Data is stored in the United Kingdom (Supabase, West Europe — London, eu-west-2).

Supabase Inc is a United States company, so limited access from outside the UK can occur — for example when their engineers provide support. Supabase covers this under Module Two of the EU Standard Contractual Clauses, and publishes a Transfer Impact Assessment which we hold on file and will provide on request.

Where any other transfer of Customer Personal Data outside the UK is necessary, we will ensure it is subject to appropriate safeguards under Data Protection Law, including the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or a relevant adequacy decision.

10. Liability and general terms

The limitations and exclusions of liability in our Terms of Service apply to this DPA, except where Data Protection Law does not permit them to.

If any part of this DPA conflicts with our Terms of Service, this DPA takes precedence in respect of the processing of Customer Personal Data.

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1 — Details of the processing

Subject matter	Provision of the ClientBuild construction project management platform.
Duration	For the term of your subscription, plus the retention period in clause 7.
Nature and purpose	Storing, organising, displaying, calculating with and transmitting project and financial information so that you can manage building projects and give your clients visibility of their own project.
Types of personal data	Names; email addresses; postal addresses of projects; telephone numbers; project financial information including budgets, valuations, variations and invoices; bank sort codes and account numbers where entered for payment purposes; messages and files uploaded to project discussions.
Categories of data subject	Your clients (typically homeowners); your employees and subcontractors; other individuals whose details you enter into a project.
Special category data	None. The platform is not designed to process special category or criminal offence data, and clause 4.3 prohibits uploading it.

Annex 2 — Approved sub-processors

Sub-processor	Purpose	Location
Supabase	Database hosting and file storage	United Kingdom (London, eu-west-2)
Netlify	Serves the application itself. Does not store Customer Personal Data — all data is held in the database above.	Global content delivery network
Anthropic	Reading and extracting figures from invoices you upload	United States, under appropriate transfer safeguards

Stripe processes your own subscription payments as a separate controller and is not a sub-processor under this DPA. Where you connect your own Xero account, Xero acts under your own arrangements with them, not ours.

Annex 3 — Security measures

We maintain the following technical and organisational measures:

• Access control. Each customer's data is isolated at database level by row-level security policies, so no customer can access another customer's records. Your clients can see only the projects they have been granted access to, and cannot see bills, costs or margins.
• Authentication. Accounts are protected by individual email and password credentials. Passwords are stored hashed, never in plain text.
• Encryption. Data is encrypted in transit using TLS 1.2 with modern ciphersuites. Data, including backups, is encrypted at rest using AES-256. Encryption keys are generated per project and protected by keys held in FIPS 140-2 compliant hardware security modules.
• Least privilege. Administrative access to production systems is limited to those who need it, is individually attributed, and is revoked promptly when no longer required.
• Backups. Data is backed up regularly, with backups subject to the same access controls and encryption as live data.
• Confidentiality. Anyone with access to Customer Personal Data, including contractors, is bound by a written confidentiality obligation.
• Support access. Where you ask us for support and share an export of your data, we use it solely to investigate your issue and delete it once resolved.
• Breach response. We maintain a documented process for identifying, containing and notifying personal data breaches within the timescales in clause 5.7.