SOOFBack to SOOF

SOOF legal

Data Processing Addendum

Last updated: 20 October 2026

Scope and parties

This Data Processing Addendum (DPA) forms part of the End User Agreement between the customer and Dextericy Ltd (company number 17461625), the operator of SOOF. It applies where SOOF processes personal data on the customer's behalf, for example workers, clients, site contacts and other individuals whose details the customer enters into SOOF. The customer is the controller and Dextericy Ltd is the processor. It does not cover personal data for which Dextericy Ltd is the controller, such as account administration, billing and website enquiries; see the Privacy Policy for those. It applies automatically from first use of SOOF, including during a free trial, and no signature is needed. A countersigned copy is available from hello@soof.co on request.

Definitions

Data Protection Law means the UK GDPR, the Data Protection Act 2018 and, where it applies to the customer's use of SOOF, the EU GDPR, each as amended. Personal data, controller, processor, processing, data subject and personal data breach have the meanings given in Data Protection Law. Customer Personal Data means personal data processed by SOOF on the customer's behalf under the agreement. Sub-processor means a third party engaged by SOOF to process Customer Personal Data.

Details of processing

Subject matter and purpose: providing the SOOF service, which supports the customer's management of jobs, clients, workers, vehicles, documents, scheduling and finances. Duration: the term of the agreement and the retention period described below. Data subjects: the customer's workers and other users, clients and their contacts, suppliers and subcontractors, and other individuals named in operational records. Types of data: names, work contact details, role and pay-related details the customer chooses to record, job, site, scheduling, vehicle, inspection, document, signature and photograph records, invoice and payment status, and user activity records. The customer decides what it enters and should not enter special category data or criminal offence data unless it needs to and has a lawful basis.

Our obligations as processor

SOOF will process Customer Personal Data only on the customer's documented instructions, which are this DPA, the agreement and the customer's use and configuration of the service, unless law requires otherwise, in which case we will tell the customer first where the law allows. We will tell the customer if we believe an instruction breaches Data Protection Law. We will ensure everyone authorised to process Customer Personal Data is bound by confidentiality, and we will not sell Customer Personal Data or use it for our own marketing or advertising.

Customer responsibilities

The customer is responsible for having a lawful basis to process Customer Personal Data, for giving its workers, clients and others any required privacy notices, for the accuracy and lawfulness of the data it enters, and for managing its users' access permissions in SOOF. Where the customer uses AI-assisted features, it should check the output before relying on it.

Security

SOOF applies appropriate technical and organisational measures, including tenant separation so that one customer's data is not visible to another, role-based access controls, encrypted transport, encryption of stored integration tokens, restricted administrative access, logging, and backups. We review these measures as the service develops and will not materially reduce the overall level of protection during the term.

Sub-processors

The customer gives general authorisation for SOOF to use the sub-processors listed on the Sub-processors page at https://soof.co/sub-processors. We will update that page before a new sub-processor starts processing Customer Personal Data and, where practicable, give at least 14 days' notice by email to the account owner. The customer may object on reasonable data-protection grounds within that period by emailing hello@soof.co. If we cannot resolve the objection, the customer may stop using the affected feature or end the agreement before the change takes effect. We impose data-protection obligations on each sub-processor that are materially no less protective than this DPA and remain responsible for their performance. Optional connected services such as Xero, Stripe and Google Calendar are chosen and authorised by the customer and are not our sub-processors.

International transfers

SOOF's primary database is hosted in London, UK. Where a sub-processor processes Customer Personal Data outside the United Kingdom, we rely on a UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the approved standard contractual clauses, together with any required transfer risk assessment. Details of the safeguard for a given transfer are available from hello@soof.co.

Data subject requests

Taking into account the nature of the processing, SOOF will give the customer reasonable help, using the tools in the service where possible, to respond to requests from individuals exercising their rights under Data Protection Law. If an individual contacts us directly about Customer Personal Data, we will redirect them to the customer where we can identify the customer, and will not respond substantively without the customer's instruction unless the law requires it.

Personal data breaches

We will notify the customer's account owner without undue delay, and aim to do so within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as we then know, the nature of the breach, the likely consequences, the data and individuals affected and the measures taken or proposed, and we will update it as we learn more. We will take reasonable steps to contain and remedy the breach. The customer is responsible for deciding whether to notify the Information Commissioner's Office or affected individuals.

Assistance and audits

We will give the customer reasonable help with data protection impact assessments and prior consultations with a regulator where they relate to SOOF's processing. We will make available the information reasonably necessary to show compliance with this DPA and allow for audits, including inspections, by the customer or an auditor it appoints. To keep this proportionate, the customer should first ask for our written responses and available documentation, give at least 30 days' notice, agree scope and timing with us, keep the audit to business hours and not more than once a year unless a regulator requires it or a breach has occurred, and bear its own costs. Auditors must be bound by confidentiality.

Return and deletion

When the agreement ends, or earlier on the customer's written request, we will delete or return Customer Personal Data, at the customer's choice, within a reasonable period. Copies in routine backups are overwritten in the normal backup cycle. We may keep data to the extent law requires, and will continue to protect it and use it only for that purpose. Customers should export the records they need before closing an account.

Liability, order of precedence and law

Each party's liability under this DPA is subject to the limitations and exclusions in the End User Agreement, except where Data Protection Law or other applicable law does not allow them. If this DPA conflicts with the End User Agreement on the processing of Customer Personal Data, this DPA prevails. This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction. Contact: hello@soof.co.