Data Processing Terms

These terms apply where Treetask Ltd processes personal data on behalf of a business using Treetask. They form part of our Terms of Service and are set out here in the order UK GDPR Article 28 asks for, so you can complete a supplier assessment without contacting us.

No signature is needed — accepting the Terms of Service accepts these. If your organisation needs a countersigned copy, email hello@treetask.app.

1. Roles

For the records your business enters — your customers, their sites and contact details, your surveys, quotes, jobs, invoices, photographs and safety paperwork — your business is the controller and Treetask Ltd is the processor. For your own account data (the name and email of the people who log in) and for the technical data needed to run and secure the Service, we are the controller; that processing is described in our Privacy Policy.

2. Subject matter, duration, nature and purpose

Subject matter and purpose — providing the Service: storing and displaying your records, producing quote and invoice documents, syncing them to your crew’s devices, and operating any integration you connect.

Duration — for as long as your account is open, plus the deletion period in section 8.

Nature — storage, organisation, retrieval, display, document generation, transmission to recipients you choose, and deletion.

3. Types of personal data

Names, postal addresses, email addresses and telephone numbers of your customers and their site contacts; job, quote and invoice details; photographs taken on site; and the names, certificates, qualifications, holiday records and emergency contact details of your crew.

Special category data — if you use the accident book, records of an injury are data concerning health. The Service restricts who can read an incident to full-access users, the person who reported it and the person it concerns, rather than everyone at the business.

4. Categories of data subject

Your customers and their contacts; members of the public named in a record, such as a neighbour or an injured person; and your own staff and contractors.

5. Our instructions

We process your records only on your documented instructions — in practice, the actions you take in the Service — except where UK law requires otherwise, in which case we will tell you unless the law forbids it. We do not sell your data, use it for advertising, or use it to train AI models.

6. Confidentiality and security

Everyone with access is bound by confidentiality. Data is encrypted in transit and at rest; each business’s records are isolated at the database level so one account can never read another’s; integration credentials are encrypted and never exposed to the browser; and access within a business is limited by role, with office and money records closed to site-access crew.

7. Subprocessors

You give general authorisation for the providers listed on our subprocessors page. Each is bound by terms no less protective than these. We will email account holders before adding a subprocessor that handles business records, so you have the chance to object — and to leave and take an export with you if you do.

8. Return and deletion

You can export everything your business has entered, at any time, from Settings — a complete machine-readable archive, not a summary. When you close the business account there is a 30-day window in which you can reopen it, after which the records are permanently deleted, including from backups within their normal rotation. Deleting an individual record deletes it immediately.

Data you pushed to a connected accounts package stays in that package under its own terms; we cannot delete it for you.

9. Assistance

We will help you meet your own obligations: responding to a data subject who contacts us directly by referring them to you and supporting your response; assisting with access, correction, deletion and portability requests; and, given the Service’s scale, assisting with any assessment you need to carry out.

10. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a breach affecting your data, with what we know and what we are doing about it. Reporting to the ICO within 72 hours is your responsibility as controller; we will give you what you need for it.

11. Audit

We will provide the information reasonably needed to demonstrate compliance with these terms, and answer security questionnaires. For a business of our size, that is documentation and written answers rather than on-site inspection.

12. International transfers

Where a subprocessor holds data outside the UK, the transfer relies on the UK Addendum to the EU Standard Contractual Clauses, or the UK extension to the EU–US Data Privacy Framework where the provider is certified. Locations are listed per provider on the subprocessors page.

13. Contact

hello@treetask.app