SOOF legal
UK GDPR and data protection
Last updated: 20 October 2026
Our approach
SOOF is operated by Dextericy Ltd, a company registered in England and Wales. We design and run SOOF to meet the requirements of the UK GDPR and the Data Protection Act 2018, and we want to make it straightforward for our customers to meet their own obligations when they use it. This page is a summary. The Privacy Policy, Data Processing Addendum and Sub-processors page contain the detail.
Controller and processor
When a customer enters information about its workers, clients or other contacts into SOOF, the customer is the controller and we are its processor. We process that data on the customer's instructions under our Data Processing Addendum, which applies automatically and needs no signature. For our own account administration, billing, security and website enquiries, we are the controller, as the Privacy Policy explains.
What we do
Customer data is kept in separate tenant workspaces, with role-based permissions so each user only sees what their role allows. The primary database is hosted in London, UK. Data is encrypted in transit and tokens for connected services are encrypted when stored. We keep backups and logs, restrict administrative access, and review our sub-processors before and during use. We do not sell personal data, and we do not use customer data to advertise. Website analytics is optional and only runs with consent.
Helping customers with individual rights
People have rights to access, correct, erase, restrict, object to and move their personal data. If someone contacts us about data a customer entered, we will redirect them to the customer and help the customer respond. Customers can correct or remove worker and client records in SOOF, and can contact hello@soof.co for help with a request they cannot complete themselves.
Sub-processors and transfers
Our current sub-processors are listed at https://soof.co/sub-processors, and we update that page before adding a new one. Where personal data is processed outside the UK we rely on a UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum.
Breach response
If a personal data breach affects customer data, we notify the customer's account owner without undue delay and aim to do so within 48 hours of becoming aware, so the customer can meet its own duty to report to the Information Commissioner's Office within 72 hours where required.
What customers should do
As controller, a customer should have a lawful basis for the personal data it records, give its workers and clients a privacy notice, give users the minimum access they need, avoid recording special category data unless necessary, and check AI-assisted output before relying on it. We can help with data protection impact assessments if you need one.
Contacts
Dextericy Ltd is the data controller for the personal data described in the Privacy Policy. For data protection questions or to request a countersigned DPA, email hello@soof.co. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.