Terms of service

1. The agreement

These terms of service (the Terms) are a binding agreement between Jobiit Technologies Limited, a company registered in Ireland under company number 810674, VAT number IE4714847GH, with its registered office at 79 Berford, Duleek, Co. Meath, A92 E67F, Ireland, trading as Tradrbox (we, us, our), and the business for which an account is set up on the Service (the Firm, you, your).

Our privacy notice forms part of the Terms. If the two conflict, the data processing terms in section 26 govern the processing of personal data, then the rest of the Terms, then the privacy notice.

For businesses only. The Service is supplied only to businesses, for use in their trade, business, craft or profession, and never to consumers. Consumer protection law — including the Consumer Rights Act 2022 in Ireland and the Consumer Rights Act 2015 in the United Kingdom — does not apply to the Terms. The person who sets up the Firm’s account confirms that they do so on behalf of a business, that they have authority to bind it to the Terms, and that they have read them.

Acceptance. The Firm accepts the Terms and the privacy notice by ticking the box on the signup form before its account is created. We record which edition was accepted, when, and by whom, and keep that record for as long as the Terms last. Using the Service afterwards, including inviting further Users, confirms that acceptance.

Formation. The contract is made in English. We keep the edition the Firm accepted, and the current edition is always at tradrbox.com/legal/terms. Neither party being a consumer, the provisions of the European Communities (Directive 2000/31/EC) Regulations 2003 and, for a UK Firm, the Electronic Commerce (EC Directive) Regulations 2002 that businesses may agree to disapply — about the information given before an order and acknowledging receipt of one — do not apply.

2. Definitions

• Administrator — a User with the administrator role, who manages Users, settings, billing and exports and may close the Firm’s account.
• Billing Portal — the Stripe-hosted page, opened from the Office App, where the Firm manages its plan, payment method, billing details and invoices.
• Business Day — a day other than a Saturday, a Sunday or a public holiday in Ireland.
• Fees — what the Firm pays for its plan, as shown to it before it pays, excluding VAT.
• Field App — Tradrbox’s application for iPhone and for Android, and any update to it.
• Firm Data — everything the Firm or its Users put into the Service, or the Service records or produces for the Firm: customers, contacts, sites and equipment, jobs, visits, hours and materials, quotes, invoices, credit notes, payments, statements, forms, certificates, photographs, video, signatures, staff records, settings, the Firm’s logo, and the documents drawn from any of them.
• Firm Personal Data — the personal data in Firm Data about the Firm’s customers and their contacts, anybody else the Firm works for or with, and the Firm’s own staff. The Firm is its controller and we are its processor, on the terms in section 26.
• Office App — the web application at app.tradrbox.com.
• Plan — Solo, Team or Business, billed monthly or yearly.
• Service — the website at tradrbox.com, the Office App, the Field App, the pages the Firm’s customers and invitees open from its emails, the emails and documents the Service produces, and the systems that provide them.
• Sign-in — the right of one person to sign in to the Service for the Firm.
• Stripe — Stripe Payments Europe, Limited, a company registered in Ireland, and its affiliates.
• Trial — the first fourteen days of the Firm’s subscription, for which no Fees are charged.
• User — a person the Firm has given a Sign-in, as an Administrator or as staff.

Headings do not affect meaning. “Including” means including without limitation. A reference to a law is to it as amended or replaced. “Writing” includes email. Where the Terms describe how the Service works, they describe it as it stands on the date at the top; it may change under section 15.

3. The Service

Tradrbox is software for trades businesses — plumbers, heating engineers, gas installers, electricians and firms like them — to run their work from the first call to being paid: customers, the sites they work at and the equipment there; jobs and visits; quotes their customers can accept online; invoices, statements and payments; forms and certificates; and exports for their accountant. The Office App is for Administrators; the Field App is for the people doing the work, and goes on working without a signal.

The Service records work. It does not do, inspect or certify it. Every judgement about an installation, an appliance or its safety is made by the person doing the work. An answer recorded on a form or certificate is a record of that person’s judgement, not a substitute for it, and producing a certificate through the Service does not register it with any scheme, registration body or authority unless the Firm does so.

Two countries. The Service is built for businesses established in Ireland or the United Kingdom. The Firm’s country is chosen at signup and cannot be changed afterwards: it decides the Firm’s currency, its tax settings and the forms it is given, and a Firm set up in the wrong country must close its account and sign up again. A UK Firm also states which nation it is in — England, Wales, Scotland or Northern Ireland — because that decides which building regulations and certificate routes the Service offers; the Firm is responsible for stating it correctly.

4. Accounts, Users and Sign-ins

The person who sets the Firm up on the website becomes its first Administrator. Administrators invite further Users by email. Each User signs in with their own email address and password through Google’s Firebase Authentication; we never receive or store passwords.

Solo includes one Sign-in, Team five and Business twenty, counted as active Users plus invitations that have been sent and not yet accepted, withdrawn or expired. A member of staff whose work is recorded by somebody else needs no Sign-in unless they sign in themselves.

If the Firm holds more Sign-ins than its Plan includes — after moving to a smaller Plan, for example — nobody is removed and the Service carries on in full for seven days, during which the Administrators are emailed. After that, only Administrators can sign in until the Firm is back within its Plan, which it can do at any time by removing a User, withdrawing an invitation or moving to a larger Plan; the restriction lifts as soon as it is.

The Firm is responsible for its Users: for what they enter, for their keeping to the Terms, for keeping their sign-in details private, and for removing anybody who leaves or should no longer have access. What is done through a User’s account is treated as done by the Firm. The Firm must tell us straight away at hello@tradrbox.com if it knows or suspects an account has been compromised.

Every User must be at least sixteen. The Firm confirms that it has a lawful basis — ordinarily that the person works for it — for giving us the name and email address of each person it invites, and that it tells them what data protection law requires (section 26).

5. The free Trial

A new Firm starts with a fourteen-day Trial of the Business Plan, billed monthly unless the Firm chooses otherwise. No payment details are asked for at signup, and no Fees are charged during the Trial. The Administrators are emailed before the Trial ends.

If the Firm adds a payment method in the Billing Portal, its Plan starts, and the first Fees are charged, when the Trial ends. If it has not, the subscription pauses, no Fees are charged, and section 9 applies; adding a payment method afterwards charges the first Fees and restores the Service.

One Trial is available per business. We may refuse, shorten or end a Trial we reasonably believe is being used to avoid paying, including by signing the same business up again under another name or email address. We may change or withdraw the Trial for new Firms without affecting a Trial already under way.

6. Fees, VAT and payment

The Fees for each Plan are those shown to the Firm before it pays, and exclude VAT. An Irish Firm is billed in euro and a UK Firm in pounds sterling. A yearly Plan costs eleven times the monthly Fee and buys twelve months.

Fees are payable in advance for each month or year, from the day the Trial ends, and are collected for us by Stripe from the payment method the Firm keeps in the Billing Portal, which the Firm authorises us and Stripe to charge on each renewal and on any change of Plan under section 7. Each charge has a VAT invoice in our name, which the Firm can read and download in the Billing Portal.

VAT. We are registered for VAT in Ireland, and VAT on the Fees is worked out by Stripe Tax from the Firm’s country and the tax details it gives us:

• A Firm established in Ireland is charged Irish VAT at the rate in force on the date of each invoice, shown separately. A change of rate changes the VAT, not the Fees.
• A Firm established in the United Kingdom is supplied as a business, so the Fees are charged without VAT and each invoice says: Reverse charge applies: VAT to be accounted for by the recipient under Section 8 of the UK Value Added Tax Act 1994. The Firm must account for any VAT due itself.

Evidence of business status. Because a supply to a business is treated differently for VAT from a supply to a consumer, a UK Firm must give us its UK VAT number or, if it has none, declare when it signs up that it is buying the Service for its trade business. It may also give its Companies House number or a trade registration number, which help show that it is a business, but it does not have to. Stripe checks a VAT number against the tax authority’s register. We keep the declaration and when it was made, with the Firm’s name and address and any number given. Every Firm must give us accurate tax and billing details and tell us promptly when they change. If a UK Firm’s declaration or any number it gives proves to be false, we may decline to supply the Service or end it under section 10, and the Firm is responsible for any VAT, interest or penalty that results.

If a payment fails, Stripe tries again and the Administrators are emailed; section 9 sets out what follows. We may also charge interest and compensation on late payments under the European Communities (Late Payment in Commercial Transactions) Regulations 2012 or, for a UK Firm, the Late Payment of Commercial Debts (Interest) Act 1998.

No refunds. Fees are not refundable. A Plan cancelled part-way through a month or a year is not refunded for the rest of it, and closing the Firm under section 8 refunds nothing. This does not limit a refund the law requires, one the Terms expressly give, or one we choose to give.

We may change the Fees for a Plan by emailing the Administrators at least thirty days before the change. It takes effect at the Firm’s first renewal after those thirty days. A Firm that does not accept it may cancel before that renewal and owes nothing more.

7. Changing Plan

The Firm may move between Solo, Team and Business, and between monthly and yearly billing, at any time in the Billing Portal. Stripe works out the difference for the rest of the current period and charges or credits it on the Firm’s next invoice. Moving to a smaller Plan removes nobody; section 4 says what happens if the Firm then holds more Sign-ins than the Plan includes. Features a smaller Plan does not include stop being available when the change takes effect; records made with them remain Firm Data.

8. Cancelling, and closing the Firm’s account

Cancelling. The Firm may cancel its subscription at any time in the Billing Portal. It carries on until the end of the period already paid for, no further Fees are charged, and section 9 then governs the Firm’s access to Firm Data.

Closing. An Administrator may instead close the Firm’s account from the Office App, after typing the Firm’s registered name to confirm. Closing:

1. cancels the subscription immediately, with no refund for any unused part of the period already paid for;
2. permanently deletes Firm Data from our database at once, and ends every User’s access; and
3. deletes the Firm’s photographs, video, signatures and documents from storage straight afterwards.

Closing cannot be undone. Before closing, the Firm is responsible for exporting everything it wants to keep (section 11) and for meeting, by other means, any obligation it has to keep records (section 12). If Stripe cannot be reached to cancel the subscription, nothing is closed or deleted, and the Administrator can try again.

9. When a subscription lapses

A subscription lapses when a payment fails, when the Trial ends without a payment method, or when a cancelled subscription reaches the end of its paid period. The Service then carries on in full for seven days, and the Administrators are emailed when it lapses, three days later, and on the seventh day.

After those seven days, until the Firm pays:

• the Firm cannot start new work — open a job, raise a quote or an invoice, add a customer, book a visit, invite or take on people, or change its prices; but
• it can finish work already begun: statutory certificates can still be completed, and work recorded in the Field App is still received; and
• reading and exporting Firm Data is never withdrawn, whatever the state of the subscription.

Paying — through the Billing Portal or the link in our emails — restores the Service where the Firm left off.

We keep the Firm Data of a lapsed Firm for at least ninety days from the day its subscription lapsed. After that we may delete it, having first emailed the Administrators at least thirty days’ notice giving the date, so that they can export it. Paying before that date stops the deletion. Closing under section 8 deletes Firm Data straight away instead.

10. Suspension and ending the Terms

We may suspend or restrict the Firm’s access, or end the Terms, if the Firm materially breaches them and, where the breach can be put right, has not done so within fourteen days of our written notice describing it.

We may suspend access immediately, and tell the Firm as soon as we reasonably can afterwards, where we reasonably believe it is needed to prevent or investigate fraud or unlawful use, to protect the security of the Service or other businesses using it, or to comply with the law or an authority. Failing to pay is dealt with under section 9, not here.

Either party may end the Terms by written notice with immediate effect if the other becomes insolvent, has a receiver, examiner, liquidator, administrator or similar officer appointed, makes an arrangement with its creditors, or stops trading.

When we end the Terms under this section, the Firm may still read and export its Firm Data for the period in section 9, unless the law forbids it. Fees already paid are not refunded.

11. Firm Data

The Firm owns its Firm Data. We claim no rights in it except this licence: the Firm allows us, for as long as the Terms last and for any retention period under section 9, to host, store, copy, transmit, draw documents from, back up and otherwise process Firm Data, and to pass it to the sub-processors named in the privacy notice, only to provide, secure and support the Service and to comply with the law.

We may compile statistics about how the Service is used that identify no Firm, User or customer, and use and publish them; they are not Firm Data. We do not sell Firm Data, use it for advertising, or use it to train AI models.

We access Firm Data only as far as we need to provide, secure and support the Service — to look into a fault the Firm reports, for example — or where the law requires. Everybody who works for us with that access is bound to keep it confidential.

The Firm is responsible for the accuracy and lawfulness of Firm Data, including its right to hold its customers’ and staff’s personal data and to record the photographs and video it takes.

Export. An Administrator may export, at any time and whatever the state of the subscription, the Firm’s invoices, credit notes, statements and forms, its accounts ledger for its accountant, and its records, as files in open formats (PDF, CSV and ZIP); and every User may export the data recorded about them. We may add formats, and will not withdraw the ability to export.

12. The Firm’s documents, certificates and legal obligations

The Firm’s documents are its own. Quotes, invoices, credit notes, statements and certificates are issued in the Firm’s name to its customers. The Service works out VAT, and any withholding tax such as Relevant Contracts Tax or the Construction Industry Scheme, from the Firm’s settings and what the Firm records, applying the rules as we understand them — including the reverse charge on construction services. The Firm must check every document before it is issued, and is responsible for its VAT registration, its VAT and withholding treatment, its rates, prices and descriptions. We do not give tax or legal advice.

Certificates and forms. We prepare the forms and certificates supplied with the Service with reasonable care from published sources, but do not warrant that any is complete, current or sufficient for a particular installation, scheme or legal purpose. Every obligation the law or a registration body places on the Firm or its people — to be registered or competent, to inspect and test, to certify, to notify an authority or a scheme, and to keep records for the time required — stays with them. The Service helps the Firm keep those records; it takes on no duty to keep them.

The Firm’s customers. The Firm is the trader in every contract with its customers. Where a customer is a consumer, the Firm is responsible for giving them the information and cancellation rights the law requires. The Service can send a customer written confirmation of an accepted quote, with a notice of the right to cancel for a domestic customer, but the Firm is responsible for that notice being right for its contract, and for everything else it owes its customers.

Due dates and reminders. The Service shows dates falling due and can remind customers of unpaid invoices from the settings the Firm chooses. The Firm is responsible for checking dates and for its own credit control; no reminder shown or sent, and none missing, relieves it of that.

13. Payments from the Firm’s customers

Where the Service offers it, the Firm may connect its own Stripe account to take card payments from its customers. Those payments go directly to the Firm’s Stripe account: we never hold, receive or pass on the Firm’s customers’ money, and we are not party to any transaction between the Firm and its customer.

The Firm is the merchant for those payments. It appears on its customers’ statements, answers for what it supplies, and bears Stripe’s fees, refunds, disputes and any negative balance. By connecting an account the Firm enters into Stripe’s connected account agreement directly with Stripe, and authorises us to pass Stripe what it needs to open and run the account. Stripe handles that data under its agreement with the Firm, not as our sub-processor, and may decline, restrict or close an account under its own terms. We charge no fee on those payments; before we introduce one we will give the Administrators at least thirty days’ notice, and it will apply only to payments taken afterwards.

Payments the Firm records itself — cash, cheque or bank transfer — are the Firm’s own records, and we make no statement to its customers about them.

14. Acceptable use

The Firm must not, and must make sure its Users do not:

1. put anything unlawful into the Service, or anything the Firm has no right to hold;
2. record something false — an answer to a check that was not carried out, or hours that were not worked;
3. share sign-in details, or let anybody without their own Sign-in use the Service;
4. probe, scan, overload or interfere with the Service or its security, or try to reach another business’s data;
5. copy, modify, reverse-engineer or decompile the Service or the Field App, except as far as the law allows despite this;
6. resell or make the Service available to anybody else, or use it to build a competing product;
7. send anything through the Service that is unlawful, abusive or unsolicited marketing; or
8. use the Service in breach of the terms of Stripe, Apple or Google where they apply.

Where we reasonably believe this section has been broken, we may remove the content concerned and act under section 10, and will tell the Firm why.

15. Availability, support and changes to the Service

We use reasonable efforts to keep the Service available and to email the Administrators in advance of planned work that will interrupt it where we reasonably can. The Field App goes on working without a connection and sends its work when one returns. We do not promise any particular level of availability.

Support is by email at hello@tradrbox.com on Business Days and is included in every Plan. We aim to answer within one Business Day; that is an aim, not a contractual service level.

We develop the Service continually and may add, change or remove features. Where a change materially reduces what the Firm’s Plan includes, we will give the Administrators at least thirty days’ notice by email; a Firm that does not accept it may cancel before it takes effect and, on a yearly Plan, receives a refund of the Fees for the unused whole months. Features marked as a preview may change or end without notice.

The Service relies on others, including Google, Apple, Stripe and the providers named in the privacy notice. We are not responsible for their availability or for changes they make, but will use reasonable efforts to limit the effect on the Service.

16. Intellectual property

We and our licensors own all intellectual property in the Service, the Field App, the forms and certificate templates, the document designs and the Tradrbox name. Nothing in the Terms transfers any of it. A record the Firm makes with one of our templates is Firm Data under section 11; the template stays ours.

We grant the Firm a non-exclusive, non-transferable licence, for as long as the Terms last, to let its Users use the Service, and to install the Field App on devices the Firm or its Users own or control, only to run the Firm’s business.

The Field App on Apple devices. This licence is granted by us, not by Apple; the Terms are between the Firm and us, and Apple is not a party to them. It covers use on Apple-branded devices the User owns or controls, as the App Store’s usage rules permit. We alone are responsible for the Field App, its maintenance and support, and any claim about it — including product liability, failure to meet a legal or regulatory requirement, consumer protection, and infringement of anybody’s intellectual property — and Apple has no obligation to support it. If the Field App fails to meet a warranty that is not disclaimed, the Firm may tell Apple, which may refund any price paid for it, and Apple has no other warranty obligation. The Firm confirms that it is not in a country subject to a United States government embargo, or designated by it as supporting terrorism, and is not on any United States government list of prohibited or restricted parties. Apple and its subsidiaries are third-party beneficiaries of this paragraph and may enforce it against the Firm.

The Field App on Android. Downloading it from Google Play is also subject to Google Play’s terms. Google is not a party to the Terms and has no obligation to support the Field App.

We may use feedback the Firm gives us without obligation. We will not name the Firm as a customer publicly without its consent.

17. Confidentiality

Each party will keep the other’s confidential information confidential, use it only for the Terms, and disclose it only to those of its people, advisers and (in our case) sub-processors who need it and are bound to keep it confidential, or where the law or an authority requires. The Firm’s confidential information includes Firm Data; ours includes non-public information about the Service and any terms agreed specially with the Firm. This does not cover information that is or becomes public through no fault of the recipient, that the recipient already held freely, or that it developed independently. It survives the end of the Terms for five years, and for Firm Data for as long as we hold it.

18. Warranties

We will provide the Service with reasonable skill and care and substantially as the website describes it. Apart from that, the Service is provided “as is”, and to the fullest extent the law allows we exclude every other warranty, condition or term, whether express or implied by statute, common law or otherwise — including as to quality, fitness for a particular purpose, accuracy and non-infringement. The Firm confirms that it has not relied on any statement not set out in the Terms.

In particular we do not promise that the Service will be uninterrupted or free of errors, that a form or certificate is sufficient for any legal purpose, that a VAT or withholding calculation is right for the Firm’s circumstances, or that the Service meets a regulatory requirement that applies to the Firm. The Firm is responsible for checking whatever it relies on.

19. Limits on liability

Nothing in the Terms limits or excludes either party’s liability for death or personal injury caused by its negligence, for fraud or fraudulent misrepresentation, or for anything else the law does not allow to be limited or excluded.

Subject to that, our total liability to the Firm arising out of or in connection with the Terms or the Service, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for all claims arising in any twelve months, is limited to the greater of the Fees paid or payable by the Firm in the twelve months before the event giving rise to the first claim, and €1,000 (or £1,000 for a Firm billed in pounds sterling).

Subject to the first paragraph, we are not liable for loss of profit, revenue, business, contracts or expected savings; for loss or corruption of data, beyond restoring it from our backups where we can; for loss of goodwill or reputation; for any fine, penalty, tax or interest imposed on the Firm by a tax authority, regulator, registration body or court; or for any indirect or consequential loss — however it arises, and even if we were told it might.

Nor are we liable for loss caused by the Firm or its Users; by inaccurate, incomplete or unlawful Firm Data; by the Firm not exporting its data or keeping records the law requires it to keep; by any judgement made by a person using the Service about work, an installation or its safety; or by Stripe, Apple, Google or anybody else outside our control.

These limits apply to our liability under section 26 too, but nothing in the Terms limits either party’s liability to a data subject under Article 82 of the GDPR. The Firm’s obligation to pay the Fees, and its liability under section 20, are not limited by this section.

20. Indemnity

The Firm will indemnify us, and our directors, officers, employees and agents, against every claim, loss, liability, cost and expense (including reasonable legal fees) arising out of: (a) a claim by a customer of the Firm or anybody else about work the Firm did or did not do, or about an installation or a certificate; (b) the Firm’s VAT, tax or invoicing errors; (c) Firm Data the Firm had no right to hold or that infringes anybody’s rights; (d) the Firm breaking its obligations as controller under data protection law; or (e) the Firm or a User breaking the Terms or the law.

We will tell the Firm promptly of any such claim, not admit liability without its consent (which it will not unreasonably withhold), and let it conduct the defence at its own cost, provided it does so diligently, keeps us informed, and settles on no terms that admit liability for, or place an obligation on, any of us without our written consent.

21. How long the Terms last

The Terms start when the Firm’s account is created and last until the later of the end of its subscription and the deletion of its Firm Data under section 8 or section 9, unless ended earlier under section 10. Any provision that by its nature should survive does so, including those on Fees already due, lapse and retention, Firm Data, the Firm’s obligations, intellectual property, confidentiality, warranties, liability, the indemnity, governing law and data processing.

22. Changes to the Terms

We may change the Terms. When we do, the date at the top changes and we email the Administrators describing the change at least thirty days before a change that is to the Firm’s disadvantage takes effect. Continuing to use the Service after that date accepts the change. A Firm that does not accept it may cancel under section 8 before the change takes effect and, on a yearly Plan, receives a refund of the Fees for the unused whole months. A change the law requires, or one only to the Firm’s benefit, may take effect sooner.

23. Notices

We give notice to the Firm by email to its Administrators’ addresses, and may also show it in the Office App. The Firm gives notice to us by email to hello@tradrbox.com. An email notice is treated as received on the next Business Day after it is sent. The Firm agrees that contracts, notices and other communications we give electronically satisfy any legal requirement that they be in writing.

The emails the Service sends to Administrators and Users about their account, billing and the Terms are part of the Service and cannot be switched off while the Firm has an account.

24. General

• Entire agreement. The Terms, with the privacy notice and, where the Firm has connected a Stripe account, Stripe’s agreements with it, are the whole agreement between the parties about their subject and replace anything discussed before. Neither party has relied on a statement not in them. This does not limit liability for fraud.
• Assignment. We may transfer the Terms to an affiliate or to whoever takes over all or part of our business, and will tell the Firm if we do. The Firm may not transfer the Terms or its account without our written consent, which we will not unreasonably withhold for a genuine sale of the Firm’s business.
• Subcontracting. We may subcontract, including to the sub-processors named in the privacy notice, and remain responsible for our subcontractors as for ourselves.
• Events outside our control. Neither party is liable for failing or being late to perform (except to pay) because of an event beyond its reasonable control, including a failure of the internet or of a telecommunications or power network, a failure of Google, Apple or Stripe, a cyber-attack, industrial action by others, an epidemic or an act of government. If it lasts more than thirty days, either party may end the Terms by written notice.
• Severance. If any provision is held invalid or unenforceable, it is narrowed or removed as little as necessary and the rest continues.
• Waiver. Not using a right, or using it late or in part, does not give it up.
• Relationship. Nothing in the Terms makes the parties partners, joint venturers, agents or employer and employee.
• Third parties. Apart from Apple and its subsidiaries under the Field App terms above, and the people protected by the indemnity, nobody but the parties may enforce the Terms.

25. Governing law and disputes

The Terms, and any dispute or claim arising out of or in connection with them, their subject matter or formation (including non-contractual disputes or claims), are governed by the laws of Ireland, and the courts of Ireland have exclusive jurisdiction, whether the Firm is established in Ireland or the United Kingdom. Either party may still seek urgent interim relief in any court that has jurisdiction.

Before starting proceedings, a party will raise the dispute with the other in writing and, if it is not resolved within thirty days, consider in good faith whether mediation could resolve it. Neither party must mediate, and nothing here delays an application for urgent relief.

26. Data processing terms

This section applies when we process Firm Personal Data for the Firm, and is the contract Article 28(3) of the EU GDPR requires and, for a Firm in the United Kingdom, Article 28(3) of the UK GDPR. Terms defined in the GDPR have the same meaning here. For the personal data we hold as controller — about Users’ accounts, billing and our dealings with the Firm — the privacy notice applies instead.

Roles

The Firm is the controller of Firm Personal Data and we are its processor. The Firm is responsible for having a lawful basis for collecting and using it, for giving its customers, staff and anybody else concerned the information the law requires, and for its instructions to us being lawful. Where the Firm records special category data — the reason a member of staff was absent, where that is sickness — the Firm is responsible for having a condition for processing it.

What we process, and for how long

We process Firm Personal Data to provide the Service to the Firm: hosting it; drawing documents from it; sending the emails the Firm’s use of the Service triggers; presenting quotes to the Firm’s customers to answer and invitations to its staff; keeping copies on its Users’ devices in the Field App; backing it up; and exporting it. We do so for as long as the Terms last and for any retention period under section 9.

Data: names, business names, addresses, email addresses and telephone numbers of the Firm’s customers and their contacts; the sites the Firm works at, access notes, and the equipment there; jobs, visits, hours, materials, quotes (including the name typed by whoever accepts one), invoices, credit notes, payments, statements and withholding-tax records; forms and certificates with their answers, photographs, video and signatures; and, about the Firm’s staff, names, email addresses, pay and cost rates, working patterns, absences and their kind (which may include sickness), and registration numbers. Data subjects: the Firm’s customers and their contacts and occupiers, subcontractors, and the Firm’s own staff.

Our obligations

We will:

1. process Firm Personal Data only on the Firm’s documented instructions — which are the Terms and the Firm’s use of the Service, including as to transfers outside Europe — unless the law requires otherwise, in which case we will tell the Firm first unless the law forbids it;
2. make sure the people authorised to process it are bound to keep it confidential;
3. take the measures described in the privacy notice — each business’s records walled off by the database, encryption in transit and at rest, signed links that expire for files and documents, and least-privilege access — and whatever else Article 32 requires for the risk;
4. help the Firm, as far as the nature of the processing allows, to answer requests from people exercising their rights;
5. help the Firm meet its obligations under Articles 32 to 36, taking into account the nature of the processing and the information we have, and we may charge a reasonable fee where that help is substantial and not caused by us;
6. make available the information needed to show that we meet Article 28, and allow for and contribute to audits by the Firm or an auditor it appoints — on at least thirty days’ written notice, no more than once in twelve months unless a supervisory authority requires it or there has been a personal data breach, on Business Days, and under reasonable confidentiality; and
7. tell the Firm straight away if, in our opinion, an instruction breaks data protection law.

Sub-processors

The Firm gives general authorisation for us to use the sub-processors named in the privacy notice, which says what each does and where. We will email the Administrators at least thirty days before adding or replacing one, and the Firm may object on reasonable data protection grounds within that time. If we cannot resolve the objection, the Firm may end the Terms by written notice and, on a yearly Plan, receives a refund of the Fees for the unused whole months. Each sub-processor is bound by written contract to data protection obligations no less protective than these, and we remain liable to the Firm for them.

Transfers

Our servers and database are in the European Union. Where a sub-processor handles Firm Personal Data outside the European Economic Area or the United Kingdom, the transfer is protected by an adequacy decision or regulation, by the Data Privacy Framework or its UK Extension for a certified provider, or by the Standard Contractual Clauses with, for UK data, the International Data Transfer Addendum, as the privacy notice sets out.

Personal data breaches

We will tell the Firm without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Firm Personal Data, describing — as far as we then know — what happened, the kinds and rough number of people and records concerned, the likely consequences, and what has been or will be done, and will add to that as we learn more. The Firm remains responsible for notifying its supervisory authority and the people affected where the law requires, and we will help it to.

Return and deletion

The Firm may export Firm Personal Data at any time (section 11). When the Service ends for the Firm — on closing under section 8, or at the end of the retention period under section 9 — we delete Firm Personal Data from our live systems, and it leaves our backups as they expire within thirty days, unless the law requires us to keep something, in which case we keep only that and go on protecting it. On written request we will confirm the deletion in writing.

Requests from people

If somebody contacts us about Firm Personal Data, we will not answer the substance unless the law requires it; we will point them to the Firm and tell the Firm promptly. The Service lets the Firm find, correct, export and delete its customers’ records itself, which answers most such requests.

The Firm’s Stripe account

Data passed to Stripe for an account the Firm has connected is handled by Stripe under its own agreement with the Firm, not as our sub-processor; our part is limited to passing it on the Firm’s instruction and keeping the references and outcomes Stripe returns.

27. Contact

Jobiit Technologies Limited, trading as Tradrbox. Email: hello@tradrbox.com. Post: Jobiit Technologies Limited, 79 Berford, Duleek, Co. Meath, A92 E67F, Ireland. Registered in Ireland, company number 810674; VAT number IE4714847GH.