Data processing agreement

This agreement is between the installer company using Jouleo (the “controller”, “you”) and Helix8 Ltd, company number NI658912, registered office 52 The Beeches, Larne, BT40 2DW, Northern Ireland (the “processor”, “we”). It forms part of the pilot terms and of any paid terms that follow, and meets Article 28 of the UK GDPR. If it conflicts with those terms on data protection, this agreement wins.

1. What we process and why

• Subject matter and purpose: providing Jouleo, a job management system for solar and battery installers, to you.
• Duration: while you use Jouleo, plus the retention period in section 9.
• Nature of processing: storing, organising, displaying, sending, analysing (including AI document reading), exporting and deleting data, as you direct through Jouleo.
• People the data is about: your customers and their household members, your staff and subcontractors, suppliers' contacts, and people who enquire through your website widget or customer portal.
• Types of data: names, contact details, property addresses and roof imagery, job documents, photos, signatures, energy use and tariffs, quotes and payment schedules, staff roles and qualifications, and records of activity in the audit trail. Jouleo isn't designed for special category data; please don't add it unless a job genuinely needs it (for example a customer's vulnerability that affects the install).

2. Your instructions

We process your data only on your documented instructions, which are this agreement, the terms, and how you configure and use Jouleo, unless the law requires otherwise (in which case we'll tell you first unless the law forbids it). We'll tell you if we think an instruction breaks data protection law.

3. Confidentiality

Everyone at Helix8 Ltd who can access your data is bound by confidentiality. Support staff see your company's data only when you grant support access in Jouleo, and that access is time-limited and recorded in your audit trail.

4. Security

We keep appropriate technical and organisational measures in place, including:

• Storage on Amazon Web Services in London (eu-west-2), encrypted at rest and in transit.
• Each company's data kept separate, with every request checked against the signed-in company.
• Role-based access for your users, and limited, logged access for our staff.
• Malware scanning of uploaded files before they can be opened.
• An append-only audit trail of submissions, signatures and stage changes.
• Point-in-time backups of the database and versioned file storage.

5. Sub-processors

You give general authorisation for us to use these sub-processors:

• Amazon Web Services: hosting, storage, sign-in, malware scanning and AI document reading (Amazon Bedrock). Stored in the UK; AI requests handled within EU regions.
• Resend: sending emails such as invitations and notifications. US.
• Google: maps and roof imagery; Google Drive if you connect it. US/EU.
• OpenStreetMap Foundation (Nominatim) and postcodes.io: address search, which receives the address or postcode being looked up. UK/EU.
• Microsoft: OneDrive or SharePoint, only if you connect it. EU/US.
• Stripe: billing, once paid plans start. US/EU.

We'll give you at least 14 days' notice by email before adding or replacing a sub-processor. If you object on reasonable data protection grounds and we can't resolve it, you can end the agreement. Each sub-processor is bound by data protection terms that are at least as protective as these, and we remain responsible for them.

Integrations you choose to connect yourself, such as your own AI assistant account, act on your instructions under your own agreement with that provider and aren't our sub-processors.

6. Transfers outside the UK

Your data is stored in the UK. Where a sub-processor handles it outside the UK, we make sure the transfer is covered by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the ICO's International Data Transfer Agreement or Addendum.

7. Helping you

• Jouleo lets you find, export and correct a person's data, and we'll carry out deletions or restrictions you ask for, so you can answer their requests. If we receive a request directly, we'll pass it to you and not answer it ourselves.
• We'll give you reasonable help with security, breach notifications, data protection impact assessments and consulting the ICO, taking into account the information available to us.

8. Personal data breaches

We'll tell you without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting your data. We'll tell you what we know, what we're doing about it, and update you as we learn more, so you can meet your own 72-hour duty to notify the ICO.

9. When you leave

• You can export all your data at any time.
• Compliance records (documents, signatures and the audit trail) are kept, closed to everyone, until 6 years after your company's last record, so you can meet MCS and consumer-code record keeping and answer claims. You instruct us to keep them for that period by accepting this agreement.
• If you confirm in writing that you hold your own copy, we'll delete them sooner. Everything else is deleted within 30 days of the end of your agreement, unless the law requires us to keep it.
• Backups are overwritten on their normal cycle, within 35 days.

10. Audits and information

We'll give you the information you reasonably need to show that this agreement is being met, and allow reasonable audits by you or an auditor you appoint, with 30 days' notice, no more than once a year unless there's been a breach or the ICO requires it.

11. Liability and law

Liability under this agreement follows the terms it forms part of. It is governed by the law of Northern Ireland, and the courts of Northern Ireland deal with any dispute.

Contact

Questions about this agreement or a data request: hello@jouleo.co.uk