1. Scope and roles
These data-processing terms form part of the WPB Build terms of service. They apply when a building business uses WPB Build to handle personal information about its workers, homeowners, prospective customers or other people.
The building business is the controller and WPB Holding Ltd is its processor for that information. WPB Holding Ltd is registered in England and Wales under company number 17520349, with its registered office at 5th Floor, 167–169 Great Portland Street, London, W1W 5PF.
Each party will meet the data-protection duties that apply to it. The controller is responsible for its lawful basis, privacy information, the accuracy of the information it enters and the instructions it gives.
2. Documented instructions and confidentiality
WPB Holding Ltd will process personal information only to provide, secure and support WPB Build in accordance with the controller’s documented instructions, these terms and the controller’s use of the service. We will tell the controller if we believe an instruction infringes applicable data-protection law.
If UK law requires other processing, we will inform the controller before processing unless the law prohibits that notice. People authorised to handle the information are bound by appropriate confidentiality duties.
3. Security
Taking account of the nature of the processing, available technology, cost and risk, we will maintain appropriate technical and organisational measures. These include authenticated accounts, role-based access, database row-level controls, private file storage, encrypted network connections, short-lived photograph links, restricted production access and backup and incident procedures.
The controller remains responsible for choosing suitable worker access, protecting account credentials, sharing homeowner links carefully and avoiding unnecessary sensitive information in notes and photographs.
4. Sub-processors and international transfers
The controller gives general written authorisation for WPB Holding Ltd to use sub-processors needed to operate WPB Build. The launch service is expected to use:
- Supabase for authentication, database services and private file storage;
- Vercel or the confirmed production host for the application and server requests;
- Resend for service and notification email; and
- Anthropic only if an optional writing or quote-assistance feature is enabled and deliberately used.
We will require each sub-processor to protect the information to an equivalent standard for the services it performs. We remain responsible for our sub-processors’ performance of those obligations.
We will give reasonable advance notice of a material new sub-processor so the controller can raise a reasonable data-protection objection. If an objection cannot be resolved, the controller may stop using the affected feature or end the service.
Where information is transferred outside the UK, we will use a lawful transfer mechanism where required, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, together with supplementary safeguards where appropriate.
5. Requests, incidents and compliance help
Taking account of the processing and the information available to us, we will provide reasonable assistance with:
- requests from people exercising their data-protection rights;
- security, personal-data breach notifications and communications;
- data-protection impact assessments and prior consultation; and
- information reasonably needed to demonstrate compliance with these terms.
If we become aware of a personal-data breach affecting controller information, we will notify the controller without undue delay and provide available details needed for the controller’s assessment. The controller remains responsible for deciding whether it must notify a regulator or affected people.
If we receive a request directly about controller information, we will refer it to the controller where practical and will not respond on the controller’s behalf unless instructed or legally required.
6. Return, deletion and audits
During the service, the controller can access and delete information using the available product controls. When the service ends, we will delete or return controller information at the controller’s choice, except where law requires retention. Live information is normally deleted within 30 days and encrypted backups expire within 90 days.
On reasonable written request, we will provide information needed to show compliance with these terms. The controller may conduct an audit no more than once in a 12-month period, unless a breach or regulator requires more, by first reviewing current independent reports and written answers. Any further inspection must be reasonably scoped, protect other customers and confidential systems, and avoid unnecessary disruption.
7. Processing schedule
| Subject and duration | Providing WPB Build for the term of the business account, followed by the deletion periods above. |
|---|---|
| Nature and purpose | Collecting, storing, organising, retrieving, displaying, transmitting, securing, supporting and deleting job communication and record-keeping information. |
| People | Business owners, directors, workers, subcontractors, homeowners, prospective customers, suppliers and other people included in authorised job content. |
| Information | Names, contact details, business details, account identifiers, job addresses, roles, assignments, messages, photographs, project stages, variation decisions, payment schedules and records, support messages, security logs and device or request information. |
| Sensitive information | The service is not designed for special-category information, criminal-offence information, payment-card details, passwords or medical records. Controllers must not add it unless separately agreed and lawfully permitted. |
| Controller rights | The controller retains control of its information and may access, correct, export or delete it using the service or by contacting us. |
Questions about these terms can be sent to privacy@wpbbuild.com.