Data processing terms
Last updated 12 Nov 2026
Sometimes members put other people's personal information on Trade-Link-UK, for example a client's name and address on an invoice, or details of a site and the people there. For that information the member is the controller and Trade-Link-UK is their processor. These terms are the contract between us that Article 28 of the UK GDPR requires. They form part of our terms of use.
1. What we process for you
- Subject matter: storing and displaying the information you enter so you can use the site's tools.
- People involved: your clients, their contacts and anyone else you enter details about.
- Types of information: names, business names, addresses, site locations, email addresses, phone numbers, and job, invoice and payment details.
- Duration: while your account is open, and then as set out in section 6.
Information about you as a member, and the contracts and fees between members, is not covered here. We are the controller for that, and our privacy policy applies.
2. Your responsibilities
- You must have a lawful basis to give us the information and tell the people concerned that you use Trade-Link-UK, for example in your own privacy notice.
- Only enter what you need. Don't enter special category information, such as health details, or criminal records.
- Your use of the site is your instruction to us to process the information.
3. Our commitments
We will:
- only process the information on your documented instructions, which are these terms and your use of the site, unless the law requires otherwise, in which case we will tell you if we can;
- make sure our team members who can see it are bound by confidentiality;
- keep it secure with appropriate technical and organisational measures, including encryption, access rules and private storage;
- help you respond to requests from the people concerned to use their rights;
- help you meet your security, breach-reporting and impact-assessment duties, taking into account the information available to us;
- tell you without undue delay, and within 48 hours where we can, after we become aware of a personal data breach affecting it;
- make available the information you need to show we meet Article 28, and allow reasonable audits on 30 days' written notice, at your cost, no more than once a year unless there has been a breach; and
- tell you straight away if we think an instruction breaks data protection law.
4. Sub-processors
You give us general permission to use the sub-processors below. We have contracts with them that give the same protection as these terms. We will update this page at least 14 days before adding or replacing one, and you may object by emailing support@trade-link-uk.com. If we can't resolve the objection, you may close your account.
| Sub-processor | What for | Where |
|---|---|---|
| Supabase | Database, logins, sign-up and log-in emails, live notifications and file storage (photos, documents, selfies) | The data centre region chosen for our project, with some support access from the US |
| Vercel | Website hosting and request logs | Global network, company in the US |
| OpenRouter and the AI model provider it routes to | Answering help assistant questions (phone numbers, emails and links are removed first) | US |
| OpenStreetMap Foundation | Map images on the map page (receives your IP address) | UK and EU |
| Google Fonts | The site's fonts (receives your IP address) | US |
| Stripe | Taking invoice payments by bank, paying Subcontractors out, and card payments for plans and for our fee. Stripe also checks the identity of Subcontractors who set up payouts, as a controller in its own right | UK, EU and US |
| Resend | Password and account emails, emails about your notifications (contracts, invoices, messages and so on), and alerts to our team about new sign-ups and documents to check | US |
5. Transfers outside the UK
Where a sub-processor handles the information outside the UK, we make sure there are appropriate safeguards, such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework or the ICO's International Data Transfer Agreement or Addendum.
6. When your account closes
You can download your information first from Your data. We then delete it, except where it forms part of records we must keep by law, such as invoices, which we keep for 6 years after the end of the tax year and use for nothing else.
7. Liability
The limits on liability in section 6 of the terms of use apply to these terms. If these terms and the terms of use conflict on data protection, these terms win.