Data processing agreement for trades firms
Version 1.0, 2026-10-27 (0.1 of 2026-10-26 described the design; 1.0 is checked against the product as built and against GDPR Article 28(3); the checks are in VERIFICATION.md).
This agreement sits under the Turstone trades terms of service (the terms) between the firm that accepts it (the "Controller") and Turstone Ltd, company number to be added, registered office to be added (the "Processor"). It is the contract Article 28(3) of the GDPR requires, read with the Data Protection Act 2018. The Data Protection Commission (DPC) is the supervisory authority.
1. Subject matter, duration, nature and purpose
- Subject matter: Turstone provides software for running a trades business: customers, sites and equipment; the firm's diary and jobs; quotes and invoices; a technician app; service reminders and service plans; copies of certificates, photos and signatures; texts, a two-way inbox, missed-call text-back, an enquiries board and an AI receptionist; review requests and a waiting list for cancelled visits (each off until the firm switches it on); reports and exports.
- Duration: from acceptance until deletion under section 10.
- Nature: storing, matching, scheduling, rendering documents (PDFs), sending and receiving text messages, answering calls with an automated assistant and writing down the message, recording a customer's quote acceptance and any cancellation, creating payment requests on the firm's own Stripe account and reading their status, reporting.
- Purpose: running the Controller's trade business only. Turstone does not use the data for its own purposes, does not sell it, does no advertising with it, and does not train any model on it. The AI receptionist uses an AI model to talk to a caller and take a message; it makes no decision about anyone, and a phone booking is made by Turstone's server from the Controller's diary under the Controller's settings, never by the model.
2. Types of personal data
The categories, and how long each is kept, are in the annex below. In short: customers and their contact details, sites, equipment, jobs, quotes, their acceptance and any cancellation, invoices and payments, service plans, photos, certificate copies and signatures, call messages and transcripts from the receptionist, and texts.
No special-category data. Turstone has no field for health or other special-category data (Article 9) or criminal-offence data (Article 10), and asks for none. The Controller must not put any in (for example in a job title, a job note or a site note). Free text that a customer writes (a text to the inbox, what a caller says to the receptionist) cannot be controlled; it is stored sealed and deleted on the periods in the annex.
Turstone is the controller, not the processor, for the account and sign-in data of the firm's owners, office users, technicians and any agency users (identity, role, sign-in events) and for the firm's billing with Turstone. That data is outside this agreement and is covered by Turstone's privacy notice. The Controller is the controller of the audit-log entries about its own people.
3. Data subjects
The Controller's customers (people and the contacts of business customers), people who live at or give access to a site, callers to the firm's Turstone number, people who enquire, and the Controller's own office users and technicians as they appear in jobs, documents and the audit log.
4. Documented instructions
Turstone processes only on the Controller's documented instructions: this agreement, the terms, and the settings the firm makes in the product, including where Union or Member State law requires otherwise, in which case Turstone tells the Controller first unless that law forbids it. Turstone immediately informs the Controller if it believes an instruction infringes data protection law.
5. Confidentiality
Everyone at Turstone with access is bound by confidentiality. Turstone staff access to firm data is limited to metadata through the audited ops console; reading more needs a time-limited, logged break-glass session that the firm can see in its audit log.
6. Security (Article 32)
Turstone applies the measures in the platform security annex (../dpa-annex-security.md), including the items it commits to complete before any real customer data, and keeps them at least at that level. For trades it adds: - Files (photos, certificates, documents, signatures) are encrypted with the firm's own data key before they leave Turstone's API, then stored in a private Amazon S3 bucket in eu-west-1 that also uses server-side encryption with KMS, blocks public access, accepts TLS only and is reachable only by Turstone's API and worker. Uploads and downloads go only through the API, never by a shared link to the store. Only JPEG, PNG and PDF files are accepted, and their contents are checked; Turstone never opens or renders an uploaded PDF on its servers. - Photos are re-encoded on the phone before upload, and the server removes location, time and camera data again before the file is sealed. - Sealed fields: job notes, site access notes (key safe and gate codes), signatures, the receptionist's message and transcript, and inbox text are sealed with the firm's data key. - Technician app: the session stays in memory; the offline queue (at most 72 hours, 50 entries, 40 MB) and today's own visits (until midnight) are kept on the phone encrypted under a key that cannot be exported from the browser. Access notes, money totals, other jobs and the customer list are never kept on the phone. The today cache is wiped at Dublin midnight, on the first app open of a later day, on sign-out, when another user signs in, and at the next sync after the technician is removed. The offline queue is wiped on sign-out, when another user signs in, and at the next sync after the technician is removed; its entries are dropped once older than 72 hours. This protects the stored files, not an unlocked phone; screen locks on the phones are the Controller's measure (section 13). - Technician scope: a technician sees only their own visits from today to 7 days ahead, and never the customer list or money totals beyond the amount due on their own job. - Quote acceptance and cancellation store no IP address and no device fingerprint. - Issued invoices and credit notes cannot be changed or deleted in the application.
7. Sub-processors
The Controller gives general written authorisation for the sub-processors in Turstone's public list at turstone.com/legal/subprocessors. The list is shared with the dental product: where it says "practice" or "patient", read "firm" and "customer". Trades adds no new sub-processor: files are stored with Amazon Web Services (already listed for storage), calls use Twilio and Amazon Bedrock (already listed for the receptionist). Turstone gives 30 days' notice of a new or replaced sub-processor (by email to the owner and on the public list). The Controller may object on reasonable data-protection grounds within that time; if the parties cannot resolve it, the Controller may end the agreement without penalty. Turstone binds each sub-processor by contract to the same data-protection obligations as these, with sufficient guarantees of appropriate technical and organisational measures, and remains fully responsible to the Controller for them.
Not sub-processors: Stripe for the firm's customer payments (the firm has its own Stripe account under its own agreement and is the merchant of record; Turstone only creates Checkout sessions on that account and reads their status), and Google Maps when a technician taps Navigate (the technician's own action on the phone; Turstone sends nothing to Google).
8. Data-subject requests and assistance
The Controller answers requests from its customers (access, rectification, erasure, restriction, objection, portability). Turstone assists by appropriate technical and organisational measures: - the firm can correct and delete customers, sites, equipment, jobs and files in the product, and export a customer's records; - opt-out is built in: a link in every text stops all texts from that firm to that mobile number; - erasure of a customer deletes the customer, sites, equipment, quotes, jobs and files, and first cancels any service-plan subscription on the firm's Stripe account; issued invoices and credit notes are kept, without the link to the customer record, because the firm must keep VAT records (Article 17(3)(b)); - Turstone forwards any request it receives to the Controller without undue delay and does not answer it itself.
Turstone also assists with security (Article 32), breach notification (Articles 33 and 34), data protection impact assessments and prior consultation (Articles 35 and 36), and gives the information needed to show compliance (Article 28(3)(h)).
9. Personal data breach (Articles 33 and 34)
Turstone notifies the Controller without undue delay and in any case within 24 hours of becoming aware of a personal data breach affecting the Controller's data, with what it knows: nature, categories and approximate numbers, likely consequences, measures taken, and a contact. The Controller decides whether to notify the DPC (within 72 hours of becoming aware) and the people affected; Turstone helps with both.
10. Deletion at the end
- Before the end, the Controller can export all its data, including invoices, credit notes and payments. The Controller keeps its own VAT records for 6 years; Turstone does not keep them for it after the end.
- When the agreement ends, Turstone stops processing and starts deletion within 30 days. Stored files are deleted before the firm's data key, so no file can be opened afterwards; earlier versions of files in the store expire within 30 days.
- Database backups are overwritten within 35 days of their creation; nothing is restored from them for any other purpose.
- At the Controller's choice, made before the end, Turstone deletes or returns the data (Article 28(3)(g)); without a choice, Turstone deletes. On request Turstone gives a deletion certificate.
- Where law requires Turstone to keep something of its own (for example its billing records with the firm), it is kept only for that purpose.
11. Audits
Turstone makes available the written security documents, the results named in the security annex once they exist, and sub-processors' audit reports where they may be passed on, and allows an audit by the Controller (or an auditor it appoints under confidentiality) once a year on 30 days' notice, during business hours, and at any time after a breach that affected the Controller's data.
12. International transfers
Data is hosted in the EU (AWS eu-west-1, backups in eu-central-1). Texts, call records and the firm's numbers use Twilio's Irish region (IE1). The receptionist's AI model runs in the EU (Amazon Bedrock; an EU inference profile may process in other EU regions). The receptionist's live speech recognition and spoken replies are processed by Twilio (ConversationRelay) and its own speech providers (such as Google and Amazon); Twilio does not document that processing as pinned to its Irish region or the EU, so call speech may be processed outside the EU, under Twilio's data processing agreement with Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Twilio stores no ConversationRelay transcript by default; the transcript Turstone keeps is the sealed one in the annex. As disclosed in the platform DPA, AWS CloudFront and the web application firewall process requests at edge locations in the EU and North America. Where a provider has a US parent, Turstone relies on the Standard Contractual Clauses and, where certified, the EU-US Data Privacy Framework, supported by Turstone's transfer impact assessments. WhatsApp is not part of the trades product unless Turstone adds it with notice.
13. The Controller's own measures
- Phones used for the technician app have a screen lock; the Controller removes a technician in Turstone as soon as they leave or a phone is lost.
- The Controller tells its customers about texts, the AI receptionist, photos and signatures (see the customer notice) and chooses the basis for service reminders.
- The Controller puts no special-category data into Turstone.
- The Controller keeps its own records of processing (Article 30) for its business.
14. Liability and precedence
Liability follows the limits in the terms. On data protection, this agreement prevails over the terms.
Details to fill in
Controller: the firm's legal name and address and data-protection contact, as entered on the Welcome page. Processor: Turstone Ltd, to be added, to be added, contact [email protected]. Accepting on the Welcome page records the Controller's agreement, with the date.
Annex: data categories and retention
These are the product's periods as built. "Sealed" means encrypted with the firm's own data key.
- Customers. First name, surname, company name, private or business, mobile (the texting number), another phone for calling, email address, the customer's VAT number (business customers), import reference, office notes (sealed). Kept until the firm deletes the customer, or the end of the agreement. A customer with no job, no payment request and no change for 6 years is listed for the owner, who decides whether to erase it; nothing is deleted automatically.
- Sites. Address and Eircode; access notes (key safe, gate codes), sealed. Kept with the customer or until the firm deletes the site.
- Equipment. Kind (for example boiler or heat pump), make, model, serial number, install date, last and next service dates, warranty end, certificate numbers and dates. Kept with the site or until the firm deletes it.
- Jobs. Job type and title, diary visits and times, assigned technician, status history, checklist answers, job notes (sealed). Kept with the customer or until the firm deletes the job.
- Quotes. Lines, prices, VAT and totals, deposit, validity, status and times, a decline reason chosen from a list, the follow-up count (0 to 2). Kept with the customer or until the firm deletes it (a quote is not a tax record).
- Quote acceptance. Typed name, signature (sealed), time, a hash of the quote as shown, the version of the acceptance wording, whether the customer asked to start within the cancellation period, and the version of the cancellation notice. No IP address, no device fingerprint. Kept with its quote.
- Quote cancellation. The name the customer confirmed, the email address or mobile they gave for the reply, the time they sent it. No IP address, no device fingerprint. Kept with its quote.
- Invoices and credit notes. Number, dates, the firm's and the customer's names, addresses and VAT numbers, the firm's IBAN, lines, VAT by rate, totals, payments received (method, amount, date), and the log of which reminder (7, 14 or 30 days) was queued and when. Never deleted by the application while the firm's account is open, and kept when a customer is erased (the link to the customer is removed). Revenue asks for VAT records to be kept for 6 years; the firm exports them before it leaves.
- Payment requests. Amount, kind (invoice, deposit, plan), status and times, Stripe reference; never card data. Kept 24 months, with the Stripe references removed 180 days after the request ends and Connect event ids after 90 days; the payment row on the invoice keeps its own Stripe payment reference with the invoice.
- Service plans. Plan, price when the customer joined, status, billing method, the subscription reference on the firm's Stripe account. Kept with the customer; the Stripe subscription is cancelled first on erasure and at the end.
- Service-reminder log. Which service reminder was queued for a piece of equipment and due date, and when. Kept with its equipment.
- Photos. Job and site photos, location data removed, sealed in the file store. Job photos taken in the technician app: deleted 24 months after they were taken, or sooner if the firm deletes them. Photos the office adds to a site or equipment: until the firm deletes them or the site.
- Certificates and documents. Copies of certificates (for example RGII, Safe Electric), commissioning sheets and other documents, with kind, reference, issue and expiry dates, sealed in the file store. Kept until the firm deletes them or the site.
- Signatures. Signature strokes (not a picture), sealed. Kept with their quote or job.
- Deleted files. Removed from the live store 30 days after deletion; any stored earlier copy expires within a further 30 days.
- Call messages (AI receptionist). (The live call speech passes through Twilio and its speech providers and may be processed outside the EU: section 12.) The caller's number, name, short reason, a good time to call back, the emergency kind if one was spoken, whether a visit was pencilled in; the message and the written transcript are sealed. No recording. Kept 30 days after the call.
- Caller hash (AI receptionist). A keyed hash of the caller's number, used only to limit calls from one number in a night. Cleared once the call is 24 hours old.
- Missed calls. The caller's number on the enquiry card and the day's call counts (counts only). A missed-call enquiry that did not become a booking: 30 days after the call; one that did follows the enquiry rule below; the day counts until the end of the agreement.
- Enquiries. Name, phone, email and source of a person who asked for work. No activity: marked lost after 30 days; lost: deleted 90 days after closing; booked: name, phone and email removed 90 days after booking (the card stays, counts only).
- To-dos. Staff to-dos (call-backs, quote accepted, quote cancelled, job to schedule, callout review, service request). Closed to-dos: 24 months; open ones until closed.
- Audit log. Who in the firm (or Turstone, by break-glass) did what, and when; no message text. Kept while the firm's account is open, and deleted at the end.
- Review-request record. A hash of the person and the job date, used for the once-in-365-days rule. Kept 365 days.
- Waiting-list entries. The customer and the waiting-list choice they made. Kept with the customer, or until the firm or the customer removes the entry; the slot offers 90 days after the slot.
- Texts. Message log (who, which template, when, delivery status, link clicks), opt-outs, the text of messages including texts a customer sends to the inbox (inbox text sealed). Message text: 90 days; message log: 24 months; opt-outs are kept so they keep working.
- Technician phones. Today's own visits: until Dublin midnight (and on the wipes in section 6). Changes waiting to sync: up to 72 hours.
Security measures: as in the platform annex (../dpa-annex-security.md) and section 6 above.