Data processing agreement

Last updated 21 October 2026

This agreement is part of our terms of service and applies whenever Unmissd handles personal data for a business that uses it. It sets out what UK data protection law (Article 28 of the UK GDPR) requires between a business and a company that processes data for it. If anything in the terms conflicts with this agreement on data protection, this agreement wins.

"You" means the business using Unmissd. "We" and "Unmissd" mean the company named at the end of this page. "Customer data" means personal data about your customers and anyone else who contacts you through Unmissd, which we process for you. Words like "controller", "processor" and "personal data breach" mean what they mean in the UK GDPR.

1. Who is responsible

For customer data, you are the controller and we are your processor. For your own account details (your name, email, password and billing), we are the controller, as our privacy notice explains.

2. What we process

Schedule 1 below describes the subject matter, how long it lasts, the nature and purpose of the processing, the types of personal data and the people it's about.

3. Your instructions

We only process customer data on your documented instructions. Your instructions are these terms and this agreement, and the choices you make in Unmissd: your settings, the switches you turn on, the replies and invoices you send, the customers you delete. This includes sending data outside the UK, which we only do as described in section 8. If the law requires us to process customer data in some other way, we'll tell you first unless the law forbids that. If we think one of your instructions breaks data protection law, we'll tell you straight away.

4. Your part

You're responsible for having a lawful basis for the processing you ask us to do, for telling your customers about it, and for the accuracy of what you give us. That includes the messages you choose to send that a customer didn't ask for, such as follow-ups, review requests, service reminders and payment reminders: you must have the right to send them, for example under the "soft opt-in" for existing customers in the Privacy and Electronic Communications Regulations. Every automatic message we send for you tells customers how to opt out, and we stop as soon as they reply STOP.

5. Confidentiality

Everyone at Unmissd who can access customer data is bound to keep it confidential, and only accesses it when they need to, for example to support you or keep the service running.

6. Security

We take appropriate technical and organisational measures to protect customer data, as Article 32 of the UK GDPR requires. Schedule 2 lists them. We review them as the service changes and may improve them, but we won't reduce the overall level of protection.

7. Other companies we use (sub-processors)

You authorise us to use the companies listed in Schedule 3. We'll tell you by email at least 30 days before we add or replace one. You can object on reasonable data protection grounds within that time. If we can't address your objection, you can stop using Unmissd before the change, and we'll refund any fee you've paid for the time after you stop. Each sub-processor is bound by a written contract with data protection obligations at least as protective as this agreement. We remain responsible to you for what they do.

8. Sending data outside the UK

We only send customer data outside the UK with a safeguard UK law recognises: UK adequacy regulations (for example for the European Economic Area), the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge") for a certified US company, or the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Schedule 3 shows the safeguard for each sub-processor.

9. Helping with people's rights

Unmissd lets you see a customer's messages and details, correct their details and delete a customer completely. Where you need more help to answer a request from someone exercising their rights (for example a copy of their data in a common format), we'll help you, taking into account what we can reasonably do. If someone sends a request to us directly about customer data, we'll pass it to you without undue delay and won't answer it ourselves unless you ask us to.

10. Personal data breaches

If we become aware of a personal data breach affecting customer data, we'll tell you without undue delay, and within 48 hours. We'll tell you what we know: what happened, the types and rough number of people and records involved, the likely consequences, and what we've done or will do about it. We'll add to this as we learn more, and help you meet your duty to tell the Information Commissioner and the people affected.

11. Other help

We'll give you reasonable help with data protection impact assessments and any consultation with the Information Commissioner about the processing we do for you, taking into account the information we have.

12. When you stop using Unmissd

When your account is closed, we delete customer data within 30 days. Before then you can ask us for a copy in a common format. We'll keep only what the law requires us to keep. Copies in our hosting provider's backups are deleted as those backups expire.

13. Showing we comply

We'll give you the information you reasonably need to show we meet this agreement. You, or an independent auditor you appoint who is bound to confidentiality, may audit our compliance once a year on 30 days' written notice, during working hours and at your cost. You may also audit after a personal data breach, or when the Information Commissioner requires it. We'll first offer documents that may answer your questions without a visit.

14. Liability and changes

The liability terms in our terms of service apply to this agreement, except where the law doesn't allow them to. We may update this agreement to keep up with the law or a change in sub-processors (section 7). We'll email you about any change that matters before it takes effect.

Schedule 1: what we process

• Subject matter: the Unmissd service: answering, recording and following up the enquiries your customers make, and helping you run the jobs that follow.
• How long: for as long as you use Unmissd, then until deletion under section 12.
• Nature and purpose:
  • receiving, storing and replying to texts, WhatsApp messages, website form messages and Facebook lead ad enquiries;
  • texting back missed callers;
  • writing replies with AI;
  • checking messages for emergencies and alerting you;
  • booking and moving jobs, including in your Google Calendar if you connect it;
  • keeping your records of customers and jobs (notes, parts, photos, time on site, signatures);
  • invoices, and payment reminders if you turn them on;
  • after-job texts, review requests and service reminders if you turn them on;
  • notifications and reports to you.
• The people it's about: your customers and anyone who contacts you through Unmissd, including people who ring your number.
• Types of personal data:
  • name, phone number, email address, addresses and postcodes;
  • messages, including photos and voice notes;
  • call records (number, time, outcome);
  • job details, appliances, access notes and signatures;
  • invoices and whether they're paid;
  • emergency check records;
  • replies to after-job texts.
  We don't ask for special category data, but a customer may mention their health or another sensitive matter in a message (for example that someone vulnerable is without heating). That's handled the same way as everything else.

Schedule 2: security measures

• Encryption:
  • All traffic to the website, the phone app and our API uses HTTPS.
  • Messages from Twilio, Stripe and Meta are checked for a valid signature before we accept them.
  • The most sensitive values (phone-line credentials, Google Calendar access and bank details) are encrypted in our database, with a key kept separately.
• Accounts:
  • Passwords are stored only as bcrypt hashes.
  • Logins are locked after repeated failures and rate limited.
  • Changing a password signs out every other session.
  • Phone app sessions use short-lived tokens, can be signed out from Settings, and their refresh tokens are stored only as hashes.
• Separation and access:
  • Each business can only reach its own data: every request is limited to the business of the person signed in.
  • Only Unmissd staff who need it have admin access, and an admin using a business's account is shown and recorded.
• The application:
  • Forms are protected against cross-site requests.
  • A content security policy stops pages loading scripts from other sites.
  • Dependencies are kept up to date.
  • An automated test suite runs on every change.
  • The code has had a security audit, and its findings are tracked.
• Keeping data to a minimum:
  • Only postcodes are sent to the mapping services.
  • Photos have their location and other hidden details removed.
  • Notifications never include what a customer wrote.
  • Phone numbers, emails and message text are kept out of our logs.
• Deleting on time:
  • Raw webhook records after 30 days.
  • Customers' photos and photos sent to them after 90 days.
  • Live-update records after 7 days.
  • Your own location history after the period you choose.
  • A customer's whole record whenever you delete them.

Schedule 3: sub-processors

• Twilio (United States): sends and receives texts and WhatsApp messages, and connects calls. Safeguard: the UK–US data bridge (Twilio Inc.).
• SendGrid (Twilio, United States): sends emails to you, for example new enquiries and failed messages. Safeguard: the standard contractual clauses with the UK Addendum, in Twilio's data protection addendum.
• Meta (WhatsApp; United States and Ireland): carries WhatsApp messages, and sends us Facebook lead ad enquiries if you use them. Safeguard: the standard contractual clauses with the UK Addendum, in the WhatsApp Business UK Data Transfer Addendum.
• Anthropic (United States): the AI model that writes replies, checks for emergencies, reads booking details and replies to after-job texts, and suggests estimates or reads appliance details when you ask. Safeguard: the standard contractual clauses with the UK Addendum, in Anthropic's data processing addendum.
• Google (United States): your Google Calendar, only if you connect it; and notifications to Android phones. Safeguard: the UK–US data bridge (Google LLC).
• Expo (650 Industries, United States), with Apple (United States): delivers notifications to your phone app. Safeguard: the standard contractual clauses in their terms.
• OpenRouteService (HeiGIT, Germany): driving times and miles, from postcodes only. Safeguard: UK adequacy regulations for the European Economic Area.
• postcodes.io (Ideal Postcodes, United Kingdom): places postcodes on the map. Only postcodes are sent.
• Railway (United States): hosts the app and its database. Safeguard: the UK–US data bridge, with the standard contractual clauses and UK Addendum in Railway's data processing addendum.

Stripe takes your subscription payments, which concerns your own details, not customer data. If you take card payments on invoices, those go through your own Stripe account, under your own agreement with Stripe.

Contact

Unmissd is a trading name of [Company name] (company number [Company number]), [Registered address]. ICO registration number: [ICO registration number].

Email cyphasolutions@gmail.com with any question about this page.