Customer privacy notice for trades firms
Version 1.0, 2026-10-27 (0.1 of 2026-10-26 described the design; 1.0 is checked against the product as built and against GDPR Articles 13 and 14 and S.I. 336 of 2011 Regulation 13; see VERIFICATION.md).
Paste the text between the lines into the firm's own privacy notice (on its website, and linked from its quotes and invoices) and adjust the bracketed parts. Delete any paragraph marked [if ...] for a feature the firm does not use. The firm is the controller.
How we use your details
The data controller is [firm legal name, trading name, address, email, phone for data requests].
We use a service called Turstone to run our jobs: our diary, quotes, invoices, texts and phones. Turstone processes your details for us, under our instructions, in the EU, except the speech of calls to our automated assistant (see "If you phone us").
What we keep. Your name, your company name if you are a business, your phone numbers and email address, the address and Eircode of each property we work at, any access notes you give us (such as a key safe code, kept encrypted), the equipment we look after (for example your boiler's make, model, serial number and service dates), your jobs and visit times, our quotes and invoices, and the payments you make. Please do not tell us health details by text, by phone message or in job notes; if something about your health matters for a visit, tell us when we ring you.
Texts we send you. We text the mobile number you give us: - to confirm a visit, remind you of it, and say when the technician is on the way; - with a link to view a quote, and up to two reminders if you have not answered; - with a link to view and pay an invoice, and reminders at 7, 14 and 30 days after it is due if it is still unpaid; - [if we use service reminders] when your equipment is due its annual service, with one follow-up 21 days later. [State the basis: we send these because you are an existing customer who had work done by us in the last 12 months / because you agreed to them.] You can refuse them now, when you give us your number, by telling us, and at any time with the opt-out link in every text, free of charge; - [if we use review requests] after a job, a link to review us. It is your choice whether to write one; - [if we use a waiting list] if you asked us, an offer when an earlier visit becomes free; - [if we offer service plans] with a link to start or pay for a service plan you agreed with us.
Every text has a link to opt out. If you opt out, all texts from us to that mobile number stop.
Quotes and invoices online. The link in our text opens a page with your quote or invoice. If you accept a quote online, we keep the name you type, your signature, the time you accepted, a fingerprint of the quote exactly as you saw it, and whether you asked us to start the work within your cancellation period. We do not record your IP address or your device. If you cancel online with "Cancel contract here", we keep the name you give, the email address or mobile you give for our reply, and the time you sent it. Each link is personal to you; please do not share it.
Paying us. [if we take card payments] When you pay by the link, you pay on a page run by Stripe, into our own Stripe account. We are the merchant. Turstone never holds your money and never sees your card number; Stripe may keep its own records under its own privacy notice. [if we offer monthly service plans] For a monthly plan, your card is saved by Stripe in our Stripe account, never by Turstone. You can also pay by bank transfer to the IBAN on the invoice [or in cash or by cheque].
Photos, certificates and signatures. Our technicians may take photos of the work and the equipment at your property, and may ask you to sign on their phone when a job is done. Location data is removed from photos before they are stored. Job photos are deleted 24 months after they were taken. We keep copies of the certificates we issue for your property (for example gas or electrical certificates); the official records stay with the registration bodies. Photos, certificates and signatures are stored encrypted.
If you phone us. [if we use missed-call text-back] If we cannot answer, you hear a short message and, if you called from an Irish mobile, get one text back. [if we use the AI receptionist] Outside our working hours, calls to [firm number] may be answered by an automated assistant, which tells you it is an AI before anything else. It takes a message for us to call you back. It does not give repair advice or prices, other than the fixed safety lines below. If you describe an emergency, it gives you a safety line, such as the Gas Networks Ireland emergency number for a smell of gas, or 112 or 999. [if we allow phone booking] It may pencil you in for a visit in a free slot; you get a text, and we ring you to confirm. Calls are not recorded. A written note of the call is kept securely for 30 days and then deleted. To stop one number calling over and over in a night, a scrambled form of your number is kept for 24 hours. The call is handled by Turstone using Twilio for the phone line and the speech (Twilio uses speech providers such as Google and Amazon to turn what you say into text and to speak the replies) and Amazon Web Services in the EU for the assistant. The speech of the call may be processed outside the EU, under Twilio's data protection agreement with Standard Contractual Clauses and, where it applies, the EU-US Data Privacy Framework.
Why we may do this. For jobs, quotes, invoices, plans and their texts, we rely on the contract with you or the steps you asked for before it. For keeping invoices, on our legal duty to keep VAT records for 6 years. For service reminders and review requests, on the rule for existing customers in the ePrivacy Regulations, or your consent, with an opt-out in every text. For photos, call messages and the written note of a call, on our legitimate interest in doing the job well, keeping a record of it and returning your call. [Firm: change any of these that does not fit your business.]
Who handles it. Turstone processes this data for us, in the EU, except the speech of calls to our automated assistant (above). Texts and call records go through our phone provider in Ireland (the networks that deliver them may handle them elsewhere). Our technicians may open your Eircode in Google Maps on their phone to find the property. Turstone's providers are listed at turstone.com/legal/subprocessors. Some of them belong to groups based in the United States; where data could be accessed from there, we rely on Standard Contractual Clauses and the provider's EU data-protection commitments.
How long. We keep your details while you are our customer. If we have done no job and sent no invoice for you for 6 years, we review whether to delete your details. Invoices and credit notes are kept for 6 years, as Irish VAT law requires, even if you ask us to delete your other details. Job photos are kept for 24 months after they were taken; certificates until we no longer need them for the property. An online acceptance or cancellation of a quote is kept with the quote. The text of a message, including one you send us, is kept for 90 days, and a record that a message was sent (without its text) for 24 months. A note of a call to our automated assistant is kept for 30 days.
Your rights. You can ask us for a copy of your data, to correct it, to delete it (except what we must keep, such as invoices), to restrict its use, to object to it, and to get it in a portable form. Where we rely on your consent, you can withdraw it at any time. You can complain to the Data Protection Commission (www.dataprotection.ie). Contact us at [firm contact for data requests].
Notes for the firm (not customer-facing)
- Keep the service reminder basis consistent with what you chose in Turstone's setup.
- Tell customers about the automated assistant before you switch it on; the paragraph above is enough for the notice, and the assistant also says it is an AI at the start of every call (EU AI Act Article 50(1)).
- The existing-customer rule (S.I. 336 of 2011, Regulation 13(11)) needs you to offer the customer a free and easy way to refuse marketing texts when you take their number: show or read them the service-reminder line above at that time, and note any refusal (opt them out in Turstone).
- Give this notice at the time you collect the details (GDPR Article 13): on your website, linked from your quotes, and read or handed over when you take a new customer's details by phone or at the door.
- The 6-year review prompt and the invoice rule describe Turstone's defaults; change the "How long" paragraph if you keep records for a different period for your own reasons.