01. Parties, status and scope
This agreement is between Paul Hardman, trading as JobPlain, a UK sole trader (the processor), and the business customer subscribing to JobPlain (the controller). Contact: support@jobplain.co.uk. It is intended to supplement the Terms of Service for processing on the customer's behalf under Article 28 UK GDPR.
JobPlain's separate controller activities, including its own account administration, subscription billing and legal compliance, are explained in the Privacy Policy. This document does not convert those activities into processing on the customer's instructions.
Business and legal correspondence address:
Jobplain
First Floor, Swan Buildings
20 Swan Street
Manchester
M4 5JW
GB
This address is provided by Virtually There for JobPlain’s business use and legal correspondence.
02. Processing particulars
- Subject and purpose: hosting and organising customer records, quotes, work orders, invoices and manually recorded payment statuses to provide JobPlain's business administration service.
- Nature: collection through customer input, storage, organisation, retrieval, display, alteration and authorised return or deletion; limited support access where necessary and authorised.
- Duration: provision of the service and approved return/deletion arrangements after termination, with only lawful restricted retention exceptions.
- Data subjects: the business's customers and prospective customers, and contacts or other individuals lawfully included in its work records.
- Data types: names, telephone numbers, emails, addresses, work descriptions, quote/job/invoice items, amounts, dates and payment statuses entered by the customer.
- Excluded data: special-category data, criminal-offence data and sensitive identity documents unless separately agreed with appropriate safeguards. Do not place unnecessary sensitive information in free-text fields.
The controller determines its lawful purposes, lawful bases, accuracy, notices, retention needs and authorised users. The processor must not sell customer personal data or use it for unrelated purposes.
03. Documented instructions
JobPlain shall process personal data only on the controller's documented instructions, including instructions about transfers, unless UK law requires otherwise. The agreed service, account actions and verified support requests form those instructions. Where legally permitted, JobPlain shall notify the controller before processing required by law.
JobPlain shall immediately inform the controller if, in its opinion, an instruction infringes UK GDPR or other applicable data-protection law, and seek clarification rather than silently implementing an unlawful instruction. The controller must have authority to supply and instruct processing of the data.
04. Confidentiality and security
JobPlain shall ensure persons authorised to process the data have committed to confidentiality or are under an appropriate statutory duty. Access shall be limited to what is necessary for their duties.
JobPlain shall implement appropriate technical and organisational measures under Article 32, taking account of risk, the processing, costs and the state of the art. Measures should address confidentiality, integrity, availability, resilience, recovery and regular evaluation of effectiveness.
The current application uses authenticated accounts and owner-scoped database controls to separate business records. No unverified encryption configuration, security certification, recovery target or uptime guarantee is claimed.
JobPlain’s organisational measures are: multi-factor authentication on its Lovable, Stripe and email accounts; administrative access held only by Paul Hardman; and a work computer protected by a screen lock, disk encryption and current security updates. These measures are reviewed at least once a year.
05. Subprocessors and changes
The controller gives general written authorisation for the subprocessors listed below. JobPlain shall engage them on written terms imposing substantially the same applicable data-protection obligations, including appropriate security; JobPlain remains responsible to the controller for their performance as required by Article 28.
Before a planned addition or replacement of a subprocessor, JobPlain shall provide at least 30 days’ notice to the controller’s verified account email, with relevant scope/security/transfer information and a meaningful opportunity for the controller to object on reasonable data-protection grounds. The parties shall seek a practical resolution; an unresolved objection must be addressed through an approved alternative or termination/return arrangement, not ignored. Urgent necessary changes require as much notice as practicable, reasons and mitigation; they do not remove the objection process.
- Lovable Cloud: Lovable Labs Incorporated is processor under the obtained DPA. Current downstream subprocessors, purposes and locations are listed at Lovable’s subprocessor register. Lovable Labs Sweden AB’s separate controller role for account data is described in Lovable’s Privacy Policy.
- Database and backups: AWS eu-west-1 — Europe (Ireland); daily full database snapshots are held in the same region. No fixed maximum snapshot expiry is published; retention follows Lovable Privacy Policy Section 13 criteria, including operational and security need, followed by deletion or anonymisation. No fixed expiry is promised. Authentication and transactional email delivery is not individually identified beyond the official subprocessor list.
- Stripe: Stripe is not used to process the controller’s customer records. For JobPlain’s own subscription payments, Stripe processes payment information on JobPlain’s behalf and acts as an independent controller for its own fraud prevention, compliance and legal purposes.
06. Rights requests and compliance assistance
Taking account of the nature of processing, JobPlain shall assist the controller by appropriate technical and organisational measures, insofar as possible, with requests to exercise data-subject rights. Requests about the controller's customer records shall be referred promptly to the controller; JobPlain shall not independently override lawful controller instructions.
Taking account of the information available to it, JobPlain shall assist with compliance under Articles 32–36, including breach duties, data-protection impact assessments and prior consultation where required. Requests should be directed to support@jobplain.co.uk. No fixed response-time guarantee or assistance charge applies.
07. Personal-data breaches
JobPlain shall notify the controller without undue delay after becoming aware of a personal-data breach affecting the controller's data. Where available, notification shall describe the nature of the breach, affected categories and approximate numbers, contact point, likely consequences and measures taken or proposed. Information may be provided in phases without undue further delay.
JobPlain shall cooperate in investigation, mitigation and the controller's notification duties. The controller decides its own regulator and individual notifications. The ICO's 72-hour notifiable-breach deadline for controllers is not a licence for JobPlain to wait 72 hours before notifying the customer.
08. International transfers
JobPlain shall make restricted international transfers only on documented instructions and in accordance with UK GDPR Chapter V. Under Lovable’s DPA, UK SCCs apply to ex-UK transfers, incorporating the UK Addendum to the EU SCCs. Lovable assesses destination-country laws and maintains those assessments. Section 8.2 provides EU SCCs, Module Two, for transfers outside the EEA; Lovable does not rely on Data Privacy Framework adequacy. The authoritative recipient/location schedule is Lovable’s Trust Center subprocessor list. Ireland database and backup storage does not imply UK-only storage or Ireland-only processing.
09. Compliance evidence and audits
JobPlain shall make available information necessary to demonstrate compliance with Article 28 and allow and contribute to audits, including inspections, by the controller or an auditor mandated by it. Proportionate confidentiality and security arrangements must protect other businesses' information without defeating this right.
Evidence review can be used where suitable; it shall not be an absolute substitute that removes required audit rights. No customer's audit grants access to another customer's records or privileged credentials.
JobPlain provides compliance evidence free of charge. The costs of any exceptional on-site inspection will be agreed in advance where lawful; this does not restrict statutory audit rights.
10. Return, deletion and retention
At the controller's choice, JobPlain shall return or delete the customer personal data after the end of processing services and delete existing copies unless UK law requires storage. Retained exceptions must be necessary, restricted, justified and subject to a recorded expiry/review date. Subscription cancellation alone does not erase business records.
Request closure, export or deletion at support@jobplain.co.uk. Identity and authority must be verified. Stripe subscriptions, pending setups and billing questions are coordinated separately, with explicit authority for billing actions; a debt is not automatically a lawful reason to refuse erasure.
Backups follow Lovable Privacy Policy Section 13 retention criteria; no fixed maximum expiry is published or promised. Restore controls must prevent deleted data being brought back into ordinary service. Stripe retains its own payment records under its arrangements and legal duties; JobPlain cannot promise to erase those by deleting local records. JobPlain's own tax duties do not justify blanket retention of tradespeople's invoices.
11. Version and finalisation
Version 2026-11-final-1, effective 11 November 2026. You agree after signing in and before using business features; your agreement is recorded with the exact versions and a server timestamp. This agreement governs its own subject matter if it conflicts with the Terms.