Data Processing Agreement

1. Parties and roles

This agreement is between you, the business subscribing to Coglass ("Customer"), and Halliday Morrow Ltd, registered in England & Wales, company no. 17358542, registered office 39a The Riddings, Sutton Coldfield, England, B76 1RW ("Coglass", "we", "us").

In relation to the personal data you put into Coglass — your staff, your customers, your suppliers — you are the controller and we are your processor. You decide why and how that data is used; we process it to provide the Service to you.

We act as a controller only for our own account data: the contact and billing details of the person who administers your subscription. That is covered by our privacy policy, not this agreement.

2. Subject matter, duration, nature and purpose

• Subject matter — processing of personal data contained in your Coglass account.
• Duration — for as long as your subscription is active, plus the deletion period in section 10.
• Nature and purpose — hosting, storing, organising, transmitting and displaying your data so you can run your glazing business: quoting, surveys, scheduling, production, fitting records, invoicing, and communicating with your customers.

3. Types of personal data

• Your staff — names, work email addresses and phone numbers, login credentials, employment-related records held in the app (shifts, holiday, time off), vehicle allocations, and device location while clocked in or on a job.
• Your customers — names, addresses, site addresses, phone numbers, email addresses, order and quote history, payment status, photographs and drawings of their property taken during surveys and fittings, signatures captured on completion, and the content of messages exchanged with them.
• Your suppliers — business contact details.

Coglass is not designed for special category data as defined in Article 9. Please don't enter health, biometric or similar data into free-text fields.

4. Categories of data subject

Your employees and contractors; your customers and their occupants or site contacts; your suppliers' staff.

5. Our obligations

We will:

• Process only on your documented instructions — your use of the Service is the instruction; anything beyond it needs your written direction, unless the law requires otherwise, in which case we'll tell you first unless the law forbids it.
• Keep it confidential — anyone we let near your data is bound by confidentiality obligations.
• Secure it — the measures in section 11.
• Control sub-processors — as set out in section 7.
• Help you answer data subjects — where someone exercises a right of access, correction, erasure, portability, restriction or objection, we'll help you respond, taking account of what the Service already lets you do yourself.
• Help you meet Articles 32–36 — security, breach notification and impact assessments, to the extent the information is ours to give.
• Tell you about breaches without undue delay — see section 9.
• Delete or return data — at the end, as in section 10.
• Make information available and allow audits — as in section 12.

6. Your obligations

You are responsible for having a lawful basis to hold and use the personal data you put into Coglass, for the accuracy of that data, for telling the people concerned what you do with it, and for how you configure the Service — including who you give logins to, what permissions you give them, and which optional integrations you switch on.

7. Sub-processors

You give us general authorisation to engage the sub-processors listed below. We impose data protection obligations on each of them no less protective than these terms, and we remain responsible to you for what they do.

We will give you at least 30 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data protection grounds within that period, we'll work with you to find a solution; if we can't, you may cancel without penalty for the remainder of the paid period.

Always used

Only if you switch them on

8. International transfers

Where a sub-processor above processes personal data outside the UK, that transfer is made under an appropriate safeguard recognised by UK law — in practice the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, or the provider's certification under an adequacy decision. We'll tell you which applies to a given provider on request.

9. Personal data breaches

If we become aware of a personal data breach affecting your data we will notify you without undue delay, and in any event within 72 hours of becoming aware. We'll tell you what happened, which categories of data and roughly how many people are affected so far as we know, what the likely consequences are, and what we're doing about it — updating you as we learn more. Reporting to the ICO and to affected individuals is your decision as controller; we'll give you what you need to make it.

Report a suspected breach to us at contact@coglass.co.uk.

10. Return and deletion

You can export your data at any time while your subscription is active. On request during your subscription, or within 30 days of it ending, we will provide an export of your orders, customers and invoices.

After that 30-day window we delete your account data from the live system. Copies may remain in encrypted backups for up to a further 90 days before those backups rotate out; they are not used for any purpose in the meantime. We may keep the minimum required to meet our own legal obligations, such as billing records for tax purposes.

11. Security measures

The technical and organisational measures we apply include:

• Separation between customers — each customer runs in their own application instance with their own database, rather than sharing tables with other customers.
• Encryption in transit — HTTPS/TLS across the web app, mobile apps and public links.
• Access control — per-user logins, role-based permissions you configure, and password hashing. Administrative access to the servers is restricted to named personnel using key-based authentication.
• Tokenised public links — quotes, invoices and tracking pages shared with your customers are reachable only via an unguessable link.
• Backups — the database and uploaded files are backed up daily and held off the primary host.
• Payment data — card details are handled by our payment provider; they do not reach our servers.
• Data minimisation before AI processing — email addresses, phone numbers and postcodes are stripped from enquiry text before it is sent for parsing.

We review these measures as the Service develops and may improve them, but will not reduce the overall level of protection.

12. Audit

We'll make available the information reasonably needed to show we're meeting these obligations, and will respond to a reasonable security questionnaire. Where that isn't enough for your compliance requirements, you may audit us — on at least 30 days' written notice, no more than once a year unless a regulator or a breach makes it necessary, during business hours, without unreasonably disrupting the Service, and subject to confidentiality.

13. General

This agreement forms part of our Terms of Service; where the two conflict on data protection, this agreement wins. It is governed by the law of England and Wales. If a change in law requires a change to these terms, we'll make it and tell you.

14. Contact

Data protection queries, audit requests, breach reports or a countersigned copy: contact@coglass.co.uk, or 0121 517 0383.

This agreement may be updated from time to time; material changes to the sub-processor list are notified as set out in section 7. The "last updated" date above reflects the current version.