Processor Terms

Last updated: 21-10-2026

1. Who's who

• You are the engineer or business using PATGo. For your customers' details, you're the controller: you decide why and how they're used.
• We are Peter Birchley, trading as PATGo, Unit 14, Hardys Bussiness Park, Newark, NG24 3SD (hello@patgo.co.uk). For those details we're your processor: we handle them only to run PATGo for you.
• For your own account details (your email, plan and sign-in), we're the controller — that's covered by our privacy policy, not these terms.
• These terms meet the requirements of Article 28 of the UK GDPR.

2. What we handle

• Whose details: your customers, and their staff or contacts whose details you record.
• What details: what you put into your jobs — typically customer and site names and addresses, contact names, site notes, locations, appliance records and results, and photos you take (which may show people or places).
• What we do with them: store them in our cloud when you're signed in, sync them between your phones, show them back to you, and delete them when you or these terms say so.
• How long: for as long as you use PATGo, then as set out in section 9.

Please don't put special category information (such as health details) into PATGo — it isn't designed for it.

3. Your instructions

• We handle your customers' details only on your instructions. Your instructions are these terms, the way you use PATGo (what you log, sync, export and delete) and anything else you ask us in writing.
• We won't use them for anything of our own — no selling, sharing, advertising, profiling or training of AI models.
• If the law ever requires us to do something else with them, we'll tell you first unless the law forbids it.
• If we think an instruction from you breaks data protection law, we'll tell you.

4. Security and confidentiality

• Only Peter Birchley can get into PATGo's systems, and only when you ask for help or to keep the service running. Anyone who ever works on PATGo in future will be bound to keep your data confidential.
• Everything travels over encrypted connections and is stored encrypted by our cloud provider, in London.
• Every account is walled off from every other by access rules in the database itself, and we test those rules before releases that touch them.
• Our accounts with the providers in section 5 are protected by strong passwords and two-step sign-in.
• Records on your phone stay on your phone, under your control, and backups are saved only where you choose.

5. Other providers (sub-processors)

You agree that we use this provider to handle your customers' details:

• Supabase — our cloud database and photo storage. Your data is held in its London region.

Our other providers — Cloudflare and GitHub (which serve the app's files), Resend (which emails sign-in codes to you), Google (only if you sign in with Google), Stripe (payments) and DreamHost and Formspree (our website) — don't receive your customers' details.

We have written terms with every provider that protect your data at least as well as these terms do, and we remain responsible to you for what they do. We'll give you at least 30 days' notice on this page and by email before adding or changing a provider that handles your customers' details. If you object, tell us — if we can't resolve it, you can cancel and we'll refund the unused part of your plan.

6. Outside the UK

Your data is stored in the UK. Some of our providers are based in the United States and may be able to reach it, for example to support their service. Where that happens, it's covered by safeguards approved under UK data protection law, such as the UK International Data Transfer Addendum.

7. Helping you

• If one of your customers asks to see, correct or delete their details, you can do most of it yourself: edit or delete the job, or use Export everything. If you need more, ask us and we'll help.
• If a request comes to us directly, we'll pass it to you rather than answer it ourselves.
• We'll give you reasonable help with anything else data protection law asks of you that involves PATGo, such as security questions or a data protection impact assessment.

8. If something goes wrong

If we become aware of a breach affecting your customers' details, we'll tell you without undue delay — and in any case within 48 hours — with what we know about what happened, what's affected and what we're doing about it, and keep you updated. That gives you time to meet your own duty to report it to the ICO where needed.

9. At the end

• You can export everything at any time, and before your account closes.
• When your account is closed, we delete your data from our cloud within 30 days. Our cloud provider's backups expire shortly after that.
• An unpaid account is deleted after 90 days, with a warning and a reminder to export first, as our Terms of Service explain.
• Cloud jobs and photos are deleted after 7 years in any case.
• We keep nothing afterwards unless the law requires it.

10. Showing we comply

We'll answer your reasonable questions about how we handle your data, in writing, and give you the information you need to show you're using a processor that meets the law. If a regulator requires an inspection, we'll cooperate with it on reasonable notice.

11. General

• These terms form part of our Terms of Service and last as long as we handle your customers' details. The liability section of the Terms of Service applies to them, except where the law doesn't allow it.
• If these terms and the Terms of Service ever conflict about your customers' details, these terms win.
• We'll tell you about any change to these terms in the same way as for the Terms of Service.
• Need a signed copy for your own records or a customer? Email hello@patgo.co.uk.

Contact

Peter Birchley, trading as PATGo
Unit 14, Hardys Bussiness Park, Newark, NG24 3SD
hello@patgo.co.uk · peter@patgo.co.uk