Data Processing Terms

"Business Customer" or "Customer" means the cleaning business that controls a Spotless Business Account. "Customer Data" means personal data processed by Spotless on behalf of that Customer through the service.

For Customer Data, the Business Customer is generally the controller and Spotless is the processor, except where Spotless independently determines the purpose and means of processing for its own controller activities such as SaaS billing, security, fraud prevention, support administration or legal compliance.

Terms such as controller, processor, personal data, processing and data subject have the meanings given in applicable UK data protection law.

Spotless will process Customer Data only on the Business Customer's documented instructions, including the instructions inherent in the Customer's configuration and use of the Spotless service, unless UK law requires us to process it otherwise.

The Terms of Service, product configuration, support instructions and actions taken by authorised users together form the Customer's documented instructions.

If we believe an instruction infringes applicable data protection law, we may inform the Customer and suspend that processing while the issue is clarified, unless the law prevents us from doing so.

Subject matter: hosting and processing Customer Data so Spotless can provide cleaning-business management software.

Duration: for the period the Customer uses Spotless, plus deletion, backup and lawful retention periods described in the Privacy Policy and these Terms.

Nature of processing: collection, recording, organisation, storage, retrieval, consultation, calculation, transmission, display, restriction, reconciliation, export, deletion and other processing required by enabled features.

Purposes:

• Client, service, booking, scheduling and public booking management
• Client Portal and Staff Portal operation
• Quotes, invoices, payments, refunds and finance records
• Workforce scheduling, attendance, timesheets, leave and payroll preparation
• Staff records, documents, qualifications and development
• Proof of service, photos, quality and operational records
• Stock, product orders and Client Shop where enabled
• Operational email and WhatsApp communications
• Marketing campaigns where configured by the Customer
• Reporting, support, security, troubleshooting and service continuity

Customer Data may relate to:

• The Business Customer and its authorised users
• Clients and prospective clients of the cleaning business
• Employees, workers, contractors and staff applicants
• Suppliers, referral contacts and other business contacts
• People appearing in service or proof-of-service records where lawfully captured

Depending on the Customer's use, Customer Data may include:

• Names, email addresses, phone numbers, addresses and postcodes
• Property, service, booking and access information
• Quotes, invoices, payment status and transaction metadata
• Marketing preferences, consent notes and suppression records
• Employee role, availability, rota, shifts, attendance, hours and leave
• Pay, payroll-preparation, bank, National Insurance and employment information
• Right to Work information and uploaded staff documents
• Training, qualifications, development and performance-related records
• Device location and GPS accuracy at clock-in or clock-out where geofencing is enabled
• Photos, receipts, profile images, service evidence and uploaded files
• Messages, feedback, support content and operational notes

Spotless is not intended as a general repository for special-category or criminal-offence data. However, some workforce or uploaded records may contain sensitive information depending on what the Business Customer chooses to collect.

The Customer is responsible for deciding whether that processing is necessary and lawful, identifying any Article 9 or other condition required, giving appropriate notices, applying data minimisation and limiting access to authorised people.

The Customer should not instruct Spotless to process sensitive data that is unnecessary for the enabled feature.

Spotless will ensure that people authorised to process Customer Data on our behalf are subject to an appropriate duty of confidentiality and access the information only as necessary for their role.

Spotless will maintain technical and organisational measures appropriate to the nature of the service and risk, including measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures used by the service include, where relevant:

• Authenticated user access
• Business and tenant separation controls
• Role-based and server-side authorisation checks
• Additional access restrictions around certain sensitive employee records
• Provider security controls for hosting, authentication, files and payments
• Logging, validation and safeguards around sensitive financial or payment workflows
• Backup, recovery and operational resilience controls provided by the underlying infrastructure

Security measures may evolve as the platform and risk environment change, provided the overall level of protection is not materially reduced without good reason.

The Business Customer gives Spotless general authorisation to use subprocessors where necessary to operate the service. We remain responsible for imposing data protection obligations on subprocessors that are appropriate to the processing they perform on our behalf.

Current subprocessor categories and material providers may include:

• Base44 and infrastructure or service providers used through the Base44 platform for application hosting, authentication, file storage, email delivery and integrations
• Stripe for SaaS subscription billing and connected-account payment processing
• Meta/WhatsApp infrastructure when the Customer enables WhatsApp messaging
• AI model services accessed through our application infrastructure when a user requests Spotless Assistant functionality
• Security, diagnostics, support and communications providers needed to operate the service

Where required by UK data protection law, we will provide reasonable notice of a material new subprocessor so a Business Customer can raise a reasonable data protection objection. An objection must relate to a genuine risk to Customer Data, not simply a commercial preference.

If Customer Data is transferred outside the United Kingdom to a destination that does not benefit from an applicable UK adequacy regulation, Spotless will use or rely on an appropriate lawful transfer mechanism where required, such as approved contractual safeguards together with any required transfer-risk assessment or supplementary measures.

The Customer is responsible for any international transfer it independently initiates through exports or third-party integrations outside Spotless's processor role.

Taking account of the nature of the processing, Spotless will provide reasonable assistance to the Business Customer to help it respond to data subject rights requests concerning Customer Data where the Customer cannot reasonably fulfil the request using available product controls.

If Spotless receives a request that clearly relates to Customer Data controlled by a Business Customer, we may direct the person to that Customer and, where appropriate, notify or assist the Customer.

If Spotless becomes aware of a personal data breach affecting Customer Data for which we act as processor, we will notify the affected Business Customer without undue delay after becoming aware of it, to the extent required by law.

We will provide information reasonably available to us that the Customer needs to assess its own notification duties, and we may provide information in phases as an investigation develops.

Taking account of the nature of processing and information available to us, Spotless will provide reasonable assistance with the Customer's data protection impact assessments, regulator consultations and compliance obligations where required by Article 28 and related UK data protection law.

The Customer remains responsible for determining whether its own use of a feature, including workforce geolocation, sensitive documents or marketing, requires a DPIA or other consultation.

On reasonable written request, Spotless will make available information reasonably necessary to demonstrate compliance with these Data Processing Terms and the processor obligations that apply to us.

If an on-site or more intrusive audit is legally required and cannot reasonably be satisfied by existing information, the parties will agree proportionate scope, timing, confidentiality and security arrangements so the audit does not expose other customers' data or materially disrupt the service.

During an active account, the Business Customer may use available exports and product controls to retrieve or delete Customer Data. The Customer should export records it is legally required to retain before closing the account.

Following account deletion or termination of processing, Spotless will delete or de-identify active Customer Data in accordance with our deletion process, subject to backup cycles and information that must be retained under law or for legitimate security, fraud-prevention or dispute purposes.

Where retained information is no longer needed for active service delivery, it will remain protected and will not be used for unrelated purposes.

The Business Customer is responsible for:

• Having a lawful basis for Customer Data it instructs Spotless to process
• Providing privacy information to clients, staff and other data subjects where required
• Ensuring instructions and configured workflows are lawful
• Using appropriate access permissions and promptly removing access that is no longer needed
• Keeping Customer Data accurate and proportionate to the purpose
• Responding to data subject requests and regulatory obligations for which it is the controller
• Assessing whether workforce location, marketing, sensitive documents or other higher-risk uses require additional safeguards

If these Data Processing Terms conflict with another part of the Terms of Service on a matter specifically concerning processor obligations for Customer Data, these Data Processing Terms take priority for that matter.

Liability under these Data Processing Terms is subject to the liability provisions of the Terms of Service except to the extent applicable law requires otherwise.

These Data Processing Terms continue for as long as Spotless processes Customer Data on behalf of the Customer.

We may update these Data Processing Terms to reflect changes in law, service architecture or subprocessors. Material changes will be communicated where required and the current revision date will be published on this page.

Data processing questions can be sent to:

vivernouk@gmail.com