Privacy Notice

This notice applies to:

• people who enquire about TaskMyJob or register a business for a trial;
• owners, office staff, engineers and other authorised users who sign in to the platform;
• people who contact us for support, or who receive our service and marketing messages; and
• visitors to our website.

It also explains, in section 3, how we handle the records a subscribing business keeps about its own customers.

Where we decide why and how personal data is used, we act as the data controller. In that role we hold:

• registration and account details, including business name, trading address, contact name, email address and telephone number;
• sign-in credentials, being a hashed password and the secret behind your two-factor authentication code, neither of which is readable by us;
• subscription, billing and payment records, including the plan you are on, invoices, payment references and the outcome of each charge;
• records of how the account is used, including sign-in events, the audit trail of changes made in the account, and support correspondence;
• your communication preferences, including which internal alerts you have chosen to receive; and
• technical information needed to run the service securely, such as the request logs generated by our hosting provider.

We do not ask for special category data about you, and we do not use automated decision-making that produces legal effects.

When a business uses TaskMyJob to run its work, it uploads its own records: customer names, addresses, contact details, enquiries, quotes, job notes, photographs taken on site, invoices and payment history. In data protection terms that business is the controller of those records, and we are its processor. We handle them only on that business's instructions and for the purpose of providing the platform.

If you are a customer of a business that uses TaskMyJob and you want to see, correct or delete what is held about you, contact that business directly. It decides what to keep and for how long. If you approach us instead, we will pass your request on rather than act on it ourselves.

The terms on which we process those records are set out in Schedule 2 of our Terms & Conditions.

As controller, we rely on the following lawful bases under the UK GDPR:

• Performance of a contract: creating and running your account, providing the platform, taking subscription payments, and providing support.
• Legitimate interests: keeping the platform secure, preventing and investigating misuse, understanding how the product is used so we can improve it, maintaining our records, and marketing our own services to business contacts. We balance these against your interests and you can object at any time.
• Legal obligation: keeping accounting and tax records, and responding to lawful requests.
• Consent: where we ask for it separately, for example certain marketing messages. You can withdraw consent at any time without affecting earlier processing.

We do not sell personal data. We share it with service providers who help us run the platform, each engaged under a written contract that limits them to our instructions. The full list, with each provider's purpose and location, is published at taskmyjob.co.uk/sub-processors.

Some providers are engaged only where a business chooses to switch a feature on, such as accounting synchronisation or customer finance. We may also share personal data with our professional advisers, with a purchaser if the business is sold, and with regulators or law enforcement where we are legally required to.

Card details are captured by our payment provider's own hosted fields and exchanged for a token. Full card numbers are never transmitted through, or stored on, TaskMyJob systems. We hold only the payment reference, the amount, the outcome and the last few digits needed to identify a transaction. We operate within PCI DSS SAQ A scope for that reason.

The customer database is hosted in AWS eu-west-2 (London) and file storage is in the Vercel lhr1 (London) region. All customer data at rest is held in the United Kingdom.

Vercel and Neon are US-incorporated companies, so limited access from outside the UK is possible for platform support and administration. Both are engaged under their standard data processing agreements incorporating the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, and the EU Standard Contractual Clauses.

Where a business enables an optional integration, data is also transferred to that provider under the business's own account and terms. Xero is based in New Zealand and Australia, Intuit QuickBooks in the United States, and Sage in the United Kingdom. Route and travel time lookups use OpenRouteService, hosted in Germany. Postcode lookups use postcodes.io, hosted in the United Kingdom.

We keep account data for as long as the business subscribes, and then for as long as we need it to deal with anything arising from the relationship.

• Customer Content stays available for self-service export for 30 days after termination, subject to payment of all outstanding fees, and is then deleted or anonymised.
• Accounting and tax records are kept for six years from the end of the relevant financial year, as UK tax law requires.
• Security and audit records are kept for as long as they remain useful for investigating misuse.
• Marketing contact details are kept until you ask us to stop.

Where a business is the controller of the records in question, that business sets the retention period and we act on its instructions.

Our security measures include mandatory two-factor authentication for every user, bcrypt password hashing, encryption of stored payment credentials, encrypted connections, strict organisation-level isolation enforced at every database query, role-based and feature-based access control, a full audit trail of every data change, restricted administrative access, backups and incident response processes.

Cyber Essentials certification is pending, with Cyber Essentials Plus to follow. We are not currently ISO 27001 certified, although our practices are aligned to the principles of that standard. We periodically commission a CREST-accredited external penetration test, and the report and remediation summary are available to customers under a non-disclosure agreement on request.

We set strictly necessary cookies only. There is no analytics, advertising or third-party tracking on the platform, which is why you do not see a consent banner. The detail is in our Cookie Notice.

We may send service messages about your account, which are part of providing the platform and cannot be switched off while the account is open. Separately, we may send product updates and marketing about our own services to business contacts. Every marketing message carries an unsubscribe link, and you can opt out at any time by emailing us.

Where we are the controller, you have the right to ask us to give you a copy of your personal data, correct it if it is wrong, delete it, restrict how we use it, or provide it in a portable format. You can object to processing we carry out on the basis of legitimate interests, and withdraw any consent you have given.

To exercise any of these, email enquiries@taskmyjob.co.uk. We will respond within one month. We may ask you to confirm your identity first. There is no charge unless a request is manifestly unfounded or excessive.

Where the records concerned belong to a business that uses TaskMyJob, the rights above are exercised against that business, not against us.

If you are unhappy with how we have handled your personal data, please tell us first at enquiries@taskmyjob.co.uk so we can put it right.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk, by telephone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We may update this notice from time to time. Material changes will be communicated in accordance with our Terms & Conditions. The date at the top shows when it last changed.

For any question about this notice or about how we handle personal data, contact:

Email: enquiries@taskmyjob.co.uk
Telephone: 07976 748850