data processing terms.

What these terms are

These are the data processing terms that form part of our terms of service, between your business and Bare Design Studio Limited, trading as OneWeek Marketing, company number 10395852, registered office Bank Gallery, High Street, Kenilworth, Warwickshire CV8 1LY. They cover what UK GDPR Article 28 requires when one business handles personal data for another.

If these terms and the terms of service disagree about personal data, these terms win.

Who’s who

• You are the controller for the details of your customers and of anyone who contacts your business through OneWeek. You decide why they’re used.
• We are your processor. We handle those details for you, to run your service.

For your own account details (yours and your team’s names, mobile numbers and billing), we’re the controller. Our privacy notice covers those; we’ll add the section for clients before the app opens.

What we handle and why

Why

Only to run your OneWeek service: your website, enquiries, call forwarding, missed-call text-back, review requests, quotes, your app and your monthly results.

Whose details

• your customers, and people who enquire with your business
• people who call or text your tracked numbers
• people who use the enquiry form on your website
• visitors to your website: which pages they use and where they came from, measured by our own tools

Which details

• names, phone numbers, email addresses and postcodes
• enquiries and messages: texts, WhatsApps and form messages, and what the job is
• call details: the caller’s number, the time, how long the call lasted and whether it was answered. Calls aren’t recorded.
• photos customers send you for a quote
• quotes you send, and each job’s status and value
• review requests, and the Google reviews customers leave
• where an enquiry came from, such as which number was rung or which page or campaign it started on

We don’t need sensitive details, such as health information, to run the service. Please don’t ask customers to send them.

For how long

For as long as you use OneWeek, then until we’ve deleted it as set out under “How long we keep it, and when you leave”.

Your instructions

• We only handle your customers’ details on your documented instructions: these terms, the settings and choices you make in your app, and anything else you ask us in writing (a WhatsApp or an email counts).
• If the law makes us do something else with them, we’ll tell you first, unless the law stops us.
• If we think an instruction would break data protection law, we’ll tell you straight away.

Confidentiality

Only people at Bare Design Studio who need to see your customers’ details for their work can see them, and they’re all bound to keep them confidential.

Keeping it secure

We protect your customers’ details with measures that fit the risk, including:

• encrypted connections (HTTPS) to your website, the app and our systems
• every record tied to your account, and every look-up checked against it, so no other business can see your data
• app logins by a code sent to your mobile, and protected admin logins for our own team only
• checking that messages from Stripe, Twilio and Meta really came from them before we act on them
• customer photos stored privately, never in a public folder
• a log of every action our team takes in your account
• nightly backups, kept for 30 days, with restores tested every quarter
• monitoring that alerts us if something stops working
• keys and passwords kept out of our code

Companies that help us run OneWeek

You give us general permission to use the companies below (our sub-processors). Each is bound by a written contract with data protection terms at least as protective as these, and we stay responsible to you for what they do.

• Flywheel (part of WP Engine), or another host we tell you about: hosts your website and the OneWeek platform and app.
• Twilio: your tracked numbers, call forwarding, missed-call texts, review-request texts and text login codes.
• Meta (WhatsApp Business Platform): WhatsApp alerts to you, the WhatsApp inbox on Pro and Team, and review requests by WhatsApp.
• Resend: sends our emails, such as enquiry alerts and confirmations.
• Google: your Google Business Profile and its reviews, business look-ups and website speed checks, and Google Ads if you have the Marketing Assistant.
• Anthropic (Claude): helps draft your website’s words and Google posts, and reads your onboarding answers, voice notes and photos. This is mostly your own business details. We use zero data retention wherever Anthropic offers it.
• Deepgram: turns voice notes into text, in its EU region. It doesn’t train on our audio.
• Stripe: takes your payments to us. It handles your billing details, never your customers’ details.
• Companies House: we check your company details against its public register. It never receives your customers’ details.
• Backblaze (B2, EU region): stores our nightly backups.

Before we add or replace one, we’ll tell you at least 30 days ahead. If you object and we can’t sort it out, you can leave without any extra charge.

These companies keep their own logs (for example, records of calls, texts and payments) for their own legal and security reasons, on their own terms. Our deletions cover what we hold; their logs follow their own rules.

Details leaving the UK

Some of these companies are based in the United States or handle data outside the UK. Where your customers’ details leave the UK, we only use a company covered by UK adequacy regulations (such as the UK extension to the EU–US Data Privacy Framework) or one that has signed the ICO’s international data transfer agreement or addendum. Ask us which applies to any company and we’ll tell you.

Helping you with your customers’ rights

• If a customer asks you to see, correct or delete their details, or objects to being contacted, we’ll help. We can export or delete a customer’s details from our admin screen.
• If a customer contacts us directly, we’ll pass it to you without delay and won’t answer for you unless you ask us to.
• Where it’s reasonable, we’ll also help you with security, with any data protection impact assessment, and with anything the ICO asks you.

If something goes wrong

If there’s a breach affecting your customers’ details, we’ll tell you without undue delay after we find out: what happened, whose details are affected, what we’re doing about it and who to contact. That gives you what you need if you have to tell the ICO, which is usually within 72 hours. We’ll help you deal with it.

How long we keep it, and when you leave

• While you’re with us, customer phone numbers and messages are kept for 24 months after the last contact, then deleted by a daily job. Photos are deleted with their enquiry.
• When you leave, we send you an export of your data, then delete what we hold within 30 days, unless the law makes us keep something. Our backups roll off within 30 days after that.
• If you’d rather we deleted everything without an export, just tell us.

Checks and audits

We’ll give you the information you need to show we’re meeting these terms. You, or an auditor you choose who is bound to confidentiality, can audit us on reasonable notice, once a year and at your own cost, or more often if there’s been a data breach or a regulator asks.

Missed-call texts, review requests and STOP

• Missed-call text-back replies to someone who has just rung you: one text from your tracked mobile number, signed with your business name, at most once every 12 hours to the same number, and never to a withheld number.
• Review requests go to your own customers, on your behalf, after you mark a job as won and say yes: one request and at most one reminder, between 9am and 7pm, Monday to Saturday. They go by text from your tracked number, or by WhatsApp from your connected number on Pro and Team.
• You’re the controller and we’re the processor for both. You decide who’s contacted, and you’re responsible for having a lawful reason to contact them, including under the Privacy and Electronic Communications Regulations (PECR).
• Your enquiry form and the first text-back tell the customer they may get a text or WhatsApp from your business about the job, and that they can reply STOP to opt out.
• STOP always works, on every number. Once someone replies STOP, we stop messaging them on your behalf for good, and keep only what we need to make sure of that.
• We follow Google’s rules: we never ask for a particular star rating, and never choose who gets asked based on what they might say.
• Texts that pass a customer on to another business are switched off.

What we need from you

• Only give us instructions that are lawful.
• Make sure your customers know how you use their details. We set up a privacy page on your website; check it’s right for your business.
• Tell us if a customer asks you to stop contacting them or to delete their details, so we can do the same in OneWeek.

Liability

The limits on liability in our terms of service apply to these terms too, except where the law doesn’t allow them to.

Questions

Email hello@oneweek.marketing.