Data processing agreement

Draft. The final version is published before HoodFlow opens to the public.

Version 16-10-2026

This agreement is part of the terms of use and covers the personal details of your shop's customers that you keep in HoodFlow. It is meant to meet Article 28 of the UK GDPR. HoodFlow Tracker is run by [Fill in: business name], a [Fill in: sole trader or limited company], at [Fill in: postal address].

1. Who is who

Your shop is the controller: you decide which customer details to keep and why. HoodFlow is the processor: we store and handle them only to run the service for you.

2. What we handle

• Whose details: your customers and the people they send to you, and your staff.
• What: names, phone numbers, email and postal addresses, cars and number plates, photos of cars, quotes, jobs, invoices and payments, and anything else you type in.
• Why: to provide HoodFlow — storing, showing, sending (emails, tracking links, quotes, invoices) and backing up your records.
• How long: while your account is open; see section 8 for the end.

3. We only follow your instructions

We handle the data only as the service works and as you instruct through the app, unless the law requires otherwise (and then we tell you first if we're allowed to). We never sell it or use it for our own purposes.

4. Keeping it safe

• Each shop can only reach its own records; this is enforced by the database itself and tested on every change.
• Data is stored in London and sent over encrypted connections. Passwords are stored scrambled.
• Staff logins can be limited by the shop's owner, and removed at any time.
• Anyone working for HoodFlow is bound to keep the data confidential, and doesn't look at a shop's records.

5. Companies that help us

You agree we may use the companies on the companies that help us page. Each is bound by a written agreement with the same protections. We tell you at least 30 days before adding or changing one, and you can object (and close your account) if you disagree. We stay responsible for them.

6. Outside the UK

Your records are stored in the UK. Where a helper handles data outside the UK (for example the AI helper, if your shop uses it), we only use companies covered by UK adequacy rules or the ICO's approved contract terms.

7. Helping you

• If a customer asks to see, correct or delete their details, you can do it in the app (or download everything); we help if you need it.
• If we find a data breach affecting your records, we tell you without undue delay, and within 48 hours, with what we know, so you can meet your 72-hour duty to the ICO.
• We give you the information you reasonably need to show you follow the UK GDPR.

8. When the account ends

You can download everything at any time. When you close your account, we delete your shop's records, photos and logins straight away; backups are overwritten within 30 days. We don't keep copies unless the law requires it.

Contact

Data protection questions: [Fill in: contact email].