Data Processing Agreement

This agreement forms part of the Terms of Service and applies whenever Cerrax processes personal data on your behalf. It uses the meanings given in the UK GDPR and the Data Protection Act 2018. Where this agreement and the Terms conflict on data protection, this agreement governs.

1. Which of us is which

You are the controller of the personal data you put into Cerrax or ask us to collect for you — about your customers, the people who enquire with you, your other contacts, and your staff and crew in their working role. We are your processor of it. We act on your instructions, and use that data for our own purposes only in the ways this agreement lists: making de-identified records (section 9); keeping descriptions of a job's items and rooms, with any email address, phone number or postcode removed, for 30 days to improve how Cerrax recognises items (we keep no other text sent to our AI sub-processor); keeping the service secure and preventing abuse; and meeting our own legal obligations. For those, and only those, we are responsible as a controller. For your own account data — your team’s logins, your firm’s settings and billing — we are a controller in our own right, and our Privacy Policy covers that.

Your responsibilities. You are responsible for having a lawful basis for the personal data you give us or ask us to collect, for telling the people concerned about it (our Privacy Policy describes what we do, and you may point to it), and for any consent your messages need. You have the rights this agreement gives you.

One exception, which is your customer's choice, not yours. When your customer sends a video or photographs of their home, they may tick a separate box allowing Cerrax to keep them to train software that recognises furniture and rooms. For that use alone, Cerrax is a controller in its own right, on the customer's consent, and our Privacy Policy (§3) covers it: identifying details are blurred before it is ever used for training, nothing uses it today, and the customer can withdraw at any time, after which the video and photographs are deleted under the ordinary 90-day rule. Everything else in this agreement applies to them as it does to the rest of your customers’ data.

A second exception: partner offers (Terms section 5C). Cerrax runs partner offers for its own purposes. For the processing described in section 3A, Cerrax is therefore a controller in its own right, not your processor, and that processing is outside the processing we do for you. You decide whether offers appear on your pages. If that were ever held to make us joint controllers, section 3A is our arrangement under Article 26 UK GDPR: Cerrax is responsible for the privacy information about offers, which we show your customers on their page (section 3A(6)); Cerrax asks the tracking question, whose answer stays on your customer's own device (section 3A(5)); Cerrax answers any request or complaint about offers; and you pass any such request to us without delay.

2. What we process, and for how long

• Subject matter and purpose: running your removals business on Cerrax — receiving and organising your enquiries, keeping your customer records (contacts), pricing, quoting and following up quotes, booking and running jobs, and sending the messages you set up — all on your instructions.
• Nature of the processing: collecting, storing, organising, reading (including with AI, to suggest details for a person at your firm to confirm), pricing, sending messages on your behalf, de-identifying (section 9), exporting and deleting.
• Duration: for as long as your account is open, and afterwards only as section 8 allows.
• Type of personal data: names, addresses, contact details, move dates, and details of the property and its contents that you or your customer enter; and, where your crew use Cerrax on the day of the move, photographs of the property, its access and any damage found, together with the name and drawn signature of whoever signs the inventory off; and, where you invite it and your customer chooses to send them, a video of their home or photographs of it. Where you use them: your contacts (names, email addresses, phone numbers, company, preferred language, addresses used, the choices they gave you about your messages and when, where they came from, and your notes); enquiries, including the text of enquiry emails sent to your Cerrax lead address; the messages you send through Cerrax and whether they were delivered; follow-up tasks and their notes; whether a payment has been made (never card details); and reviews and ratings your customers give you.
• Categories of data subject: people who enquire with you (whether or not they become customers); your customers; other people you keep as contacts, such as landlords and letting agents; people named in notes, messages, photographs or video; and your staff and crew in their working role (assignments, job sheets, hours).

We do not ask for and do not want special-category data. Please do not enter health, biometric or similar information into free-text fields. If it arrives anyway — in an enquiry or a note — we hold it only as part of that record, never use it for pricing or learning, and keep it out of section 9.

A signature captured against an inventory is held as evidence that your customer agreed what was moved and in what condition. Nothing measures, compares or matches it, and it is never used to identify anyone — so we do not treat it as biometric data. Collecting signatures is optional: if you would rather your crew did not, simply do not use it.

3. We act on your instructions

We process your customers’ personal data only on your documented instructions — which include your use of the product and this agreement — unless the law requires otherwise, in which case we will tell you first unless the law forbids that. Your instructions include instructions about transferring data outside the UK (section 13). If we think an instruction breaches data protection law, we will tell you promptly and may pause carrying it out until you confirm or change it.

Your instructions include these, when you use the features concerned: receiving emails sent to your Cerrax lead address and reading them — using our AI sub-processor where an email has no labelled layout — to suggest details you confirm; keeping contact records and the choices your customers make about your messages; and sending the reminder, thank-you and referral messages you switch on, in your name, honouring every request to stop at once and for all of those messages from you to that person. We keep a record of each choice and each stop, and a scrambled record of a stop for as long as it must be honoured.

Also on your instructions, when you use the features concerned: sending your customers the messages about a job that you set up (by WhatsApp where you have connected it, otherwise by email), including a review request and the private rating and comment a customer may give you; creating links you choose to share — a job sheet for your crew, or evidence (the customer's name, photographs, video and signatures, never their contact details) for your insurer, broker or claims handler; publishing your jobs to calendar subscriptions you create; and keeping follow-up tasks and their notes.

3A. Partner offers

(1) Showing an offer sends nothing. Choosing and showing an offer uses only your country, the task and the category. Nothing about your customer is sent to anyone when an offer is shown.

(2) What a tap carries. When your customer taps an offer, their browser opens the partner's page. If tracking is allowed (paragraph 3), the link passes through the partner's affiliate network and carries a reference made of three things only: a code for your firm, the offer and the country. It never carries your customer's name, contact details, address, move date, property details or any job reference. The network and the partner then collect what any website collects from a visitor, such as the device's IP address and a cookie or similar record of the visit. They collect it directly from your customer's browser, for their own purposes, under their own privacy notices; for that information they are independent controllers, not our sub-processors (paragraph 7).

(3) The tracking question. The first time your customer taps an offer on their page, we ask whether the partner and its network may record that the visit came from you. "Yes" opens the tracked link. "No" opens the partner's own page by a plain link that carries no reference and does not pass through the network. Neither answer is pre-selected, both are equally easy, and your customer can change the answer at any time from "How offers work" on the same device.

(4) The broadband postcode. A broadband offer may carry a button labelled "Check availability at [postcode]". Only when your customer taps that button do we put the new home's postcode, and nothing else, in the link, so that the partner can show what is available there. If tracking is allowed, the postcode passes through the network's link on its way to the partner. No other offer, and never an insurance offer, carries anything about your customer.

(5) What we keep, and for how long. We keep nothing about any individual customer for offers. Your customer's answer to the tracking question, and whether they have hidden offers, are kept only on their own device, in their browser — not with the job and not by us. They can change either there at any time; if they clear their browser or use another device, the answer is gone and they are asked again. For each tap we keep only a click record: a code for your firm, the offer, the country, whether tracking was allowed, and the time. It holds no customer, job or device identifier, no IP address and no postcode. Click records are kept for 24 months, so that Cerrax can match and check what partners and networks pay it, and then deleted. The network receives only what the tap itself carries (paragraph 2).

(6) What your customers are told. Your customers' move page carries a short notice about offers, which we write and keep up to date. If your own privacy notice describes how you use Cerrax, add that notice to it or link to it.

(7) Networks and partners are not our sub-processors. Section 6 does not apply to them. We give them none of the personal data we process for you; the one exception is the postcode in paragraph 4, which your customer's own browser carries at your customer's request. Whatever they collect, they collect directly from your customer's browser, for their own purposes. The networks we use are named in section 8 of our Privacy Policy; we will add a new one there, and tell you by email, before we use it.

(8) Off means off. If you switch offers off, or your customer hides them, no offer is shown on that page and nothing in this section happens there.

4. Confidentiality

Everyone we allow to access your customers’ personal data is bound by a written duty of confidentiality that continues after they leave, and only sees what their role requires. Access inside the product is governed by roles and individual permissions, checked on the server for every request.

5. Security

We take appropriate technical and organisational measures, described in our security overview — encryption in transit and at rest, role-based access control, an audit trail of consequential actions, point-in-time recovery and separate daily backups. That page states plainly what we do not yet have. We will not materially reduce the overall level of security described there while this agreement lasts.

6. Sub-processors

You give us general authorisation to use sub-processors. The current list is in section 8 of our Privacy Policy and is kept current there. We impose data protection obligations on each of them no less protective than these, and we remain responsible to you for their performance. We will email your account owner at least 30 days before a new sub-processor starts handling your customers’ data (sooner only in an emergency, such as a provider failing, and then we tell you as soon as we can). You may object within that time on reasonable data protection grounds; if we cannot resolve it, you may end the affected service or your subscription and we will refund any fees paid in advance for the unused period. Services you connect yourself under your own account with them — your own Stripe, WhatsApp Business or Xero account — act on your instruction under your agreement with them, and are not our sub-processors. If you connect Zapier, or any other service of your choice through a webhook or API key, we send it the details you ask it to receive (such as an enquiry’s contact details and move date); it acts under your own account and agreement with it, not as our sub-processor.

If you subscribe your own calendar to your Cerrax calendar link, your calendar provider fetches your jobs under your own agreement with it; it is not our sub-processor.

7. Helping you meet your own obligations

Taking into account the nature of the processing, we will help you with requests from data subjects — access, correction, erasure, portability, objection — and with your duties on security, breach notification and impact assessments. If a data subject contacts us directly about data we hold for you, we will refer them to you rather than answer for you. You can find, export, correct and delete a contact or a job yourself in the product; for anything the product cannot do, we will act within 10 working days of your written instruction. We will also pass on, and help you handle, any data protection complaint about data we process for you, and help with any impact assessment or consultation with the ICO that our processing requires.

Breaches. If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any event within 48 hours — with what we know then, and the rest as we learn it: what happened, the data and people affected, the likely consequences, and what we are doing about it.

8. Deletion and return

Your instruction on how long we keep it. Unless you tell us otherwise, you instruct us to keep each job record — the quote, its booking and outcome, the crew's sheets and the photographs attached to them — for six years after the move (or after the quote, if the job did not go ahead), or for longer while a claim or dispute about that job is open, and then to delete it. A video, and any photographs your customer sends with it, are deleted 90 days after the job's last date, except as section 1 describes. You can change this instruction by telling us.

Unless you tell us otherwise, you also instruct us to delete: an enquiry that was never priced or sent, 12 months after its last activity; a quote that was sent but never accepted, 24 months after it was sent; and a contact record 12 months after the last job record linked to it is deleted (or 12 months after it was made, if it was never linked to a job). A record of a person's consent is kept while their contact record is kept and for six years after; a scrambled record of a request to stop messages is kept for as long as it must be honoured.

When your subscription ends you can export your data for 30 days. We then delete your customers’ personal data within 90 days, and it leaves our backups as they expire (within 98 days), except where UK law requires us to keep it or you ask us to keep specific records, such as evidence in an open claim. Committed pricing records are never silently altered — personal identifiers within them are removed, which is how erasure is honoured without falsifying a record of what was quoted. Section 9 records are not your customers’ personal data and are not affected.

Two records keep their own periods: email delivery records (recipient, subject and whether it was delivered), 90 days; and the audit trail of actions in your account, up to six years after your account closes, with a customer's details removed when that customer is erased.

9. De-identified job data

(a) You instruct us to make de-identified records from the jobs we hold for you. (b) A de-identified record holds only the shape and economics of a job — volume, a distance band, access features, crew, vans, hours, price and cost, whether the quote was won and why not, the month of the move, and an area no finer than a postcode area — and never a name, contact detail, postcode district or full postcode, address, map position, free text, photograph, video, signature, your firm's identity, or any reference that links it back to the job. (c) We treat a record as de-identified only when neither we nor anyone likely to receive it could, using means reasonably likely to be used, identify a living person from it, taking account of other information we or you hold. Data that can be linked back — for example by a job reference, or while we still hold the original job — is not de-identified and stays under this agreement until the original is deleted or its customer erased. (d) We will never try to re-identify anyone from these records, and will forbid anyone we share them with from doing so. (e) Once a record meets this standard it is not your customers’ personal data; it is ours, and we may keep and use it to improve and provide Cerrax, including after the underlying records are deleted and after this agreement ends. (f) We never show another firm, or anyone else, your individual prices or anything that identifies your firm.

10. Learning across firms

We use de-identified records under section 9, and statistics made from them, from across all firms using Cerrax to improve the pricing engine for everyone, including you. This is stated here rather than assumed, because it is how the product gets better and we would rather you knew than found out.

11. Your numbers stay yours

Your rates, your margins, your customers and your prices are never visible to another firm, and never shown to the people you are quoting. The learning in section 10 runs on aggregated, de-identified signal — not on access to any one firm’s data by anybody else.

12. Audit

We will make available the information you reasonably need to show we are meeting these obligations — first by written answers and our security documentation — and will allow and contribute to an inspection by you or an auditor you appoint where those are not enough or the ICO requires it: at your cost, on 30 days' notice, under confidentiality, without access to other firms' data, and no more than once a year unless a supervisory authority or a breach requires otherwise.

13. International transfers

Where a sub-processor processes data outside the UK, we rely on UK adequacy regulations (including the UK–US data bridge for providers certified to it) or, where none applies, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Our Privacy Policy names the providers concerned. Where your data is stored today is a question you can ask us at any time, and we will answer it for the day you ask.

Liability. Section 11 of the Terms of Service (limitation of liability) applies to this agreement.

14. Contact

Data protection questions, data subject requests and breach notifications: hello@cerrax.io.