Data Processing Agreement (DPA)

1. Purpose

This Data Processing Agreement forms part of the Terms & Conditions between:

• WebLiveView Ltd ("Processor")
• The subscribing plumbing or heating company ("Controller")

This agreement governs the processing of personal data under the General Data Protection Regulation (GDPR).

2. Roles

• The plumbing company is the Data Controller.
• WebLiveView Ltd (Booked Jobs) is the Data Processor.

The Controller determines the purpose and means of processing customer data.

The Processor acts only on documented instructions from the Controller.

3. Nature of Processing

The Processor provides:

• Online job booking forms
• Customer communication notifications
• Job scheduling tools
• Payment reference notifications
• Customer data storage

Processing is limited to enabling plumbing service operations.

4. Types of Personal Data Processed

On behalf of the Controller, the Processor may process:

• Name
• Phone number
• Email address
• Property address
• Boiler details
• Job descriptions
• Service dates
• Payment confirmation references

The Processor does not store full payment card details.

5. Processor Obligations

WebLiveView Ltd agrees to:

• Process data only for service delivery
• Not use customer data for marketing
• Implement appropriate technical and organisational security measures
• Restrict access to authorised personnel only
• Assist the Controller with data access or deletion requests
• Notify the Controller without undue delay in the event of a data breach

6. Sub-Processors

The Controller authorises the use of the following sub-processors:

• Tally (form collection)
• Supabase (EU-hosted database)
• Stripe (payment processing)
• WhatsApp Business API provider
• Secure hosting providers

All sub-processors must provide GDPR-compliant safeguards.

7. Data Retention

Customer booking data is retained:

• For up to 6 years (to support tax and service record obligations), unless the Controller requests earlier deletion.

Upon account termination:

• Data may be deleted within a reasonable timeframe.
• The Controller may request written confirmation of deletion.

8. International Transfers

Where data is processed outside the EU, appropriate safeguards such as Standard Contractual Clauses will apply.

9. Data Subject Rights

If a customer submits a GDPR request:

• The Controller remains responsible for responding.
• The Processor will assist where technically possible.

10. Term & Termination

This DPA remains in effect for the duration of the subscription agreement.

Upon termination of services, processing ceases and data may be deleted in accordance with the retention policy.

11. Governing Law

This agreement is governed by the laws of Ireland.