This Data Processing Agreement ("DPA") forms part of the Terms of Service between: Jiutech Ltd, a company incorporated in England and Wales, trading as "climateJob" ("climateJob", "we", "us", "our" or the "Processor") and the person or business subscribing to and using the climateJob Service (the "Customer" or "Controller").

​

This DPA applies where climateJob processes Personal Data on behalf of the Customer in connection with the climateJob Service.

It is intended to satisfy the requirements applicable to controller-processor contracts under the UK GDPR and applicable UK Data Protection Laws.
 

1. Definitions

In this DPA: Applicable Data Protection Law means all data-protection and privacy legislation applicable to processing under this DPA, including the UK GDPR, the Data Protection Act 2018 and other applicable UK data-protection legislation as amended from time to time.

Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing and Supervisory Authority have the meanings given to them under Applicable Data Protection Law.

Customer Data means information submitted to, stored within, generated through or otherwise processed using the Service by or on behalf of the Customer.

Customer Personal Data means Personal Data contained within Customer Data that climateJob processes on behalf of the Customer.

Data Subject Request means a request made by a Data Subject to exercise a right available under Applicable Data Protection Law.

Service means the climateJob software, application, website and associated functionality provided under the Terms of Service.

Sub-processor means a third party appointed by climateJob to process Customer Personal Data on behalf of the Customer.

Terms means the climateJob Terms of Service governing the Customer's use of the Service.

2. Relationship with the Terms

This DPA forms part of the agreement between climateJob and the Customer.

The Terms continue to apply except where expressly modified by this DPA.

If there is a conflict between this DPA and the Terms concerning the processing of Customer Personal Data, this DPA will prevail to the extent of that conflict.

Nothing in this DPA reduces either party's obligations under Applicable Data Protection Law.

3. Roles of the Parties

For Customer Personal Data processed through the Service: The Customer generally acts as the Controller. climateJob generally acts as the Processor.

For example, where a Customer uses climateJob to store information concerning their own customers, properties, jobs, equipment, photographs, signatures or service history, the Customer determines why that information is processed and climateJob processes it to provide the Service.

Where climateJob processes Personal Data for its own purposes, including certain account administration, billing, legal compliance and direct business operations, climateJob may act as a Controller.

Such processing is governed by the climateJob Privacy Policy rather than this DPA.

4. Scope of Processing

The Customer instructs climateJob to process Customer Personal Data as reasonably necessary to:

• provide the Service

• host and store Customer Data

• manage customer records

• manage jobs

• manage assets and equipment

• provide scheduling functionality

• generate job documentation

• generate signed PDF reports

• process and store electronic signatures

• store photographs and documents

• provide refrigerant and F-Gas-related functionality

• calculate refrigerant charge and CO2e information

• provide compliance-related scheduling

• send transactional emails and documents requested by the Customer

• provide technical support

• maintain security

• prevent fraud and misuse

• maintain and restore the Service

• provide backups where applicable

• and otherwise perform the agreement with the Customer

The details of the processing are set out in Schedule 1.

5. Duration of Processing

climateJob may process Customer Personal Data for the duration of the Customer's Subscription and for such additional period as is reasonably necessary to return, export or delete Customer Personal Data in accordance with this DPA.

Certain information may remain temporarily within backup systems following deletion from active systems.

Where information is retained in backups, climateJob will ensure that it remains protected and is not actively processed except where necessary for security, disaster recovery, legal compliance or restoration purposes.

6. Documented Instructions

climateJob will process Customer Personal Data only on documented instructions from the Customer unless processing is required by applicable law.

The Customer's documented instructions include: this DPA; the Terms; configuration and actions performed by the Customer through the Service; support requests; written instructions provided by the Customer; and other documented instructions mutually agreed between the parties.

The Customer instructs climateJob to use the Sub-processors identified in Schedule 2.

If climateJob is required by law to process Customer Personal Data other than in accordance with the Customer's instructions, climateJob will notify the Customer before processing unless applicable law prohibits such notification.

If climateJob reasonably believes an instruction infringes Applicable Data Protection Law, climateJob will inform the Customer.

This reflects the Article 28 requirement that a processor acts on documented instructions unless law requires otherwise.

7. Customer Responsibilities

The Customer is responsible for ensuring that: Customer Personal Data is collected lawfully; an appropriate lawful basis exists for processing; appropriate privacy information is provided to Data Subjects; Customer Personal Data is accurate where required; only Personal Data reasonably necessary for legitimate business purposes is entered into climateJob; the Customer has authority to instruct climateJob to process the Personal Data; the Customer's instructions comply with Applicable Data Protection Law; and the Customer appropriately responds to Data Subject Requests.

The Customer determines what Customer Personal Data is entered into climateJob.

The Customer must not instruct climateJob to process Personal Data unlawfully.

8. climateJob's Processor Obligations

climateJob will: process Customer Personal Data only in accordance with documented instructions; comply with obligations directly applicable to processors under Applicable Data Protection Law; implement appropriate technical and organisational measures; ensure persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations; assist the Customer with Data Subject Requests as required by law; assist with Personal Data Breaches where required; provide reasonable assistance with DPIAs and regulatory consultations where required; maintain appropriate records where legally required; impose appropriate data-protection obligations on Sub-processors; and provide information reasonably necessary to demonstrate compliance with its obligations under this DPA.

9. Confidentiality

climateJob will ensure that persons authorised to process Customer Personal Data: access it only where reasonably necessary; are subject to appropriate confidentiality obligations; and receive appropriate instructions regarding handling Personal Data.

climateJob will not disclose Customer Personal Data to a third party except: as instructed by the Customer; to an authorised Sub-processor; where required to provide the Service; where required by law; or where otherwise permitted under this DPA.

The Article 28 processor contract requirements expressly include a duty of confidence for people authorised to process the data.

10. Security

climateJob will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against: accidental or unlawful destruction; accidental loss; alteration; unauthorised disclosure; unauthorised access; and other unlawful processing.

Measures will take account of: the nature of the Personal Data; the nature and scope of processing; available technology; implementation costs; and the risks to Data Subjects.

The current security measures are described in Schedule 3.

climateJob may update its security measures from time to time provided that the overall level of protection is not materially reduced.

11. Personal Data Breaches

If climateJob becomes aware of a Personal Data Breach affecting Customer Personal Data, climateJob will notify the Customer without undue delay.

Where reasonably practicable, climateJob will aim to provide initial notification within 48 hours after becoming aware of the breach.

The notification will include information reasonably available to climateJob concerning: the nature of the breach; categories of affected Personal Data; categories of affected Data Subjects; likely consequences; measures taken or proposed to address the breach; and information reasonably required by the Customer to assess its regulatory obligations.

Where all information is not immediately available, climateJob may provide information in stages.

climateJob will take reasonable steps to investigate, contain and remediate the breach.

Notification of a breach does not constitute an admission of fault or liability.

The Customer remains responsible, as Controller, for determining whether notification to the ICO or affected Data Subjects is legally required.

12. Data Subject Requests

If climateJob receives a Data Subject Request relating to Customer Personal Data, climateJob will, where reasonably possible: notify the Customer; direct the Data Subject to the Customer where appropriate; and not independently respond to the request except on the Customer's documented instructions or where required by law.

Taking into account the nature of the processing, climateJob will provide reasonable assistance to enable the Customer to respond to Data Subject Requests.

This may include reasonable assistance concerning: access; rectification; erasure; restriction; objection; and data portability.

Processor contracts must require appropriate technical and organisational assistance with individuals' rights.

13. DPIAs and Regulatory Assistance

Taking into account the nature of processing and information available to climateJob, climateJob will provide reasonable assistance to the Customer with: Data Protection Impact Assessments; security obligations; Personal Data Breach assessments; regulatory notifications; communications with affected Data Subjects; and prior consultation with the ICO or another competent Supervisory Authority where legally required.

The Customer remains responsible for determining whether a DPIA or regulatory consultation is required.

14. Sub-processors

The Customer provides general written authorisation for climateJob to engage Sub-processors necessary to provide the Service.

The Sub-processors currently used in connection with climateJob are identified in Schedule 2.

climateJob will ensure that relevant Sub-processors are subject to written contractual obligations providing an appropriate level of protection for Customer Personal Data.

Where a Sub-processor processes Customer Personal Data on behalf of climateJob, climateJob remains responsible to the Customer for the Sub-processor's performance of its applicable data-protection obligations to the extent required by Applicable Data Protection Law.

This reflects the ICO's guidance that equivalent Article 28 protections must be imposed on sub-processors and that the processor remains liable to the controller for their compliance.

15. Changes to Sub-processors

climateJob may add, replace or remove Sub-processors where reasonably necessary to operate the Service.

Where a change involves a new Sub-processor processing Customer Personal Data, climateJob will provide reasonable advance notice where required by Applicable Data Protection Law.

The Customer may object to a new Sub-processor on reasonable grounds relating specifically to data protection.

Any objection must: be made promptly following notification; explain the specific data-protection concern; and provide reasonable supporting information.

The parties will work in good faith to seek a reasonable solution.

If no reasonable solution can be reached and the Sub-processor is reasonably necessary to provide the Service, either party may terminate the affected Service in accordance with the Terms.

16. International Transfers

climateJob will not transfer Customer Personal Data outside the United Kingdom except where the transfer complies with Applicable Data Protection Law.

Where necessary, an appropriate transfer mechanism may include: UK adequacy regulations; the UK International Data Transfer Agreement; the UK Addendum to EU Standard Contractual Clauses; applicable Standard Contractual Clauses; an applicable recognised data-transfer framework; or another lawful transfer mechanism.

Some of climateJob's Sub-processors operate internationally.

Relevant transfer information is provided in Schedule 2.

Where a Sub-processor processes Customer Personal Data internationally, climateJob will rely on the applicable contractual and legal safeguards provided by that Sub-processor where appropriate.

17. Government and Regulatory Requests

Where climateJob receives a legally binding request from a public authority for Customer Personal Data, climateJob will, where legally permitted: notify the Customer; assess the validity and scope of the request; disclose only information legally required; and take reasonable steps to protect Customer Personal Data.

Nothing in this DPA requires climateJob to breach applicable law.

18. Return, Export and Deletion of Customer Data

During the Subscription, the Customer may use available climateJob functionality to access and export Customer Data.

The Customer is responsible for exporting any Customer Data that it wishes to retain.

Following termination or expiry of the Subscription, climateJob will provide the Customer with a 30-day period during which the Customer may request access to or export of Customer Data that remains available within climateJob's active systems.

The Customer should make any such request as soon as reasonably practicable and, in all circumstances, before the expiry of the 30-day period.

After the 30-day period has expired, climateJob may permanently delete Customer Data from its active systems in accordance with its applicable deletion procedures.

Customer Data may remain temporarily within backup systems following deletion from active systems. Such data will remain appropriately protected and will not ordinarily be restored or otherwise processed except where necessary for: disaster recovery; security; legal compliance; or restoration of the Service.

Backup copies will be deleted in accordance with the applicable backup lifecycle.

Where Applicable Data Protection Law requires the return or deletion of Customer Personal Data, climateJob will comply with those requirements.

The Customer acknowledges that climateJob cannot guarantee the availability of Customer Data after the expiry of the 30-day post-termination period.

19. Audit and Compliance Information

climateJob will make available information reasonably necessary to demonstrate compliance with its processor obligations under Applicable Data Protection Law.

Where reasonably sufficient, climateJob may satisfy this obligation by providing: relevant policies; security documentation; Sub-processor information; certifications or audit reports available to climateJob; responses to reasonable security questionnaires; and information supplied by relevant infrastructure providers.

Where this information is insufficient to demonstrate compliance, the Customer may request an audit.

Audits must: be reasonable and proportionate; normally occur no more than once in any 12-month period unless required by law, a Supervisory Authority or following a material security incident; be conducted on reasonable advance notice; minimise disruption to climateJob; protect confidential information belonging to climateJob and other customers; and be performed by the Customer or a suitably qualified independent auditor subject to confidentiality obligations.

The Customer will bear its own audit costs unless the audit identifies a material breach of this DPA by climateJob.

The ICO confirms that processor contracts must require processors to provide information necessary to demonstrate Article 28 compliance and allow and contribute to appropriate audits and inspections.

20. Records and Cooperation

climateJob will maintain records relating to processing activities where required by Applicable Data Protection Law.

climateJob will reasonably cooperate with the Customer in demonstrating compliance with the requirements applicable to the Customer's use of the Service.

21. Special Category and Highly Sensitive Data

climateJob is designed primarily for air-conditioning and refrigeration business management and is not designed for the routine processing of special category personal data.

Customers should not intentionally upload: health information; biometric information used for identification; racial or ethnic origin; religious or philosophical beliefs; political opinions; trade union membership; genetic information; information concerning a person's sex life or sexual orientation; or criminal conviction/offence information, unless such processing is genuinely necessary, lawful and appropriate for the Customer's use of the Service.

The Customer remains responsible for determining whether it has an appropriate lawful basis and any additional condition required to process such information.

22. Liability

Each party's liability arising from this DPA is subject to the limitations and exclusions contained in the climateJob Terms of Service, except to the extent such limitation or exclusion is prohibited by Applicable Data Protection Law.

Nothing in this DPA limits liability that cannot legally be limited or excluded.

23. Term and Termination

This DPA begins when climateJob first processes Customer Personal Data on behalf of the Customer.

It continues for as long as climateJob processes Customer Personal Data on behalf of the Customer.

Termination of the Subscription does not affect provisions which must continue to apply to protect Customer Personal Data, including confidentiality, deletion, security and audit obligations.

24. Changes to this DPA

climateJob may update this DPA where reasonably necessary to: comply with changes in law; reflect regulatory guidance; update Sub-processors; reflect changes to the Service; improve data-protection arrangements; or reflect changes to processing activities.

Where a change materially reduces the Customer's data-protection rights, climateJob will provide reasonable notice before the change takes effect where required by law.

25. Governing Law

This DPA is governed by the laws of England and Wales.

The courts of England and Wales will have jurisdiction over disputes arising from this DPA, subject to mandatory provisions of Applicable Data Protection Law.

Schedule 1 - Details of Processing

1. Subject Matter. Provision of the climateJob SaaS platform for air-conditioning and refrigeration engineers. Processing supports functionality including: customer management; job management; asset management; scheduling; call-outs; servicing and maintenance; commissioning; job documentation; digital signatures; PDF generation; email delivery; photographs and document storage; refrigerant management; cylinder management; F-Gas-related record keeping; CO2e calculations; and compliance-related scheduling.

2. Duration. For the duration of the Customer's Subscription and any limited period reasonably required thereafter for deletion, return, backups, security or compliance with applicable law.

3. Nature of Processing. Processing may include: collection; recording; organisation; structuring; storage; retrieval; consultation; transmission; calculation; generation of documents; email delivery; modification; export; restriction; backup; and deletion.

4. Purpose. To provide and support the climateJob Service in accordance with the Customer's instructions.

5. Categories of Data Subjects. Customer Personal Data may relate to: the Customer's customers; prospective customers entered by the Customer; property owners; tenants or occupiers; site contacts; business contacts; suppliers; subcontractors; engineers or other workers where information is entered by the Customer; and other individuals whose Personal Data the Customer lawfully enters into the Service.

6. Categories of Personal Data. Identity and contact information: name; email address; telephone number; postal or service address; business contact information. Property/site information: site address; contact information; property/job relationship. Job information: job descriptions; appointment information; service records; maintenance records; commissioning records; call-out records; notes; dates and times. Equipment and asset information: equipment manufacturer; model; serial number; equipment location; installation information; service history; equipment photographs. Refrigerant/F-Gas information: refrigerant type; charge weight; cylinder information; refrigerant quantities; CO2e information; leak-check information; compliance schedules. Documents and media: photographs; uploaded documents; generated PDFs; signed job reports; electronic signatures; notes. Technical information: information generated as part of using, securing or operating the Service where it constitutes Personal Data.

7. Special Category Data. Special category data is not intentionally required as part of climateJob's normal functionality. Customers are instructed not to upload such information unless lawful and necessary.

Schedule 2 - Approved Sub-processors and Service Providers

The Customer provides general written authorisation for climateJob to use the following providers where they process Customer Personal Data.

Provider | Service | Relevant Processing:
 

Supabase | Database, backend infrastructure and Supabase Auth | Storage of application data, authentication and account-related processing
 

Netlify | Hosting and deployment | Application hosting, delivery and related technical processing
 

Resend | Transactional email delivery | Email addresses, message content, metadata and attachments including signed PDF reports
 

Stripe | Subscription/payment processing | Billing, transaction and payment-related information where relevant
 

Wix | Website, forms and website functionality | Website visitor information and information submitted through website forms
 

• Supabase. Supabase is used for: database infrastructure; backend services; and Supabase Auth. Where Supabase processes Customer Personal Data on climateJob's behalf, it acts as a Sub-processor.

• Netlify. Netlify is used for: application hosting; deployment; and related infrastructure. Where Netlify processes Customer Personal Data on climateJob's behalf, it acts as a Sub-processor.

• Resend. Resend is used to deliver transactional emails and documents generated through climateJob. This may include: recipient email addresses; sender information; email content; email metadata; and signed PDF attachments. Where Resend processes Customer Personal Data to provide email delivery on climateJob's behalf, it acts as a Sub-processor.

• Stripe. Stripe provides payment and Subscription services. Stripe may act as a Processor for certain processing and as an independent Controller for certain activities it determines itself, including some fraud-prevention, financial-risk and regulatory-compliance activities. Not all Stripe processing therefore falls within the scope of this DPA.

• Wix. Wix provides climateJob's marketing website, forms and related website functionality. Where Wix processes Personal Data collected through the climateJob website on behalf of climateJob, Wix acts as a Processor to climateJob. Important: Wix website visitor/form data is generally data for which climateJob itself is the Controller, rather than Customer Personal Data processed on behalf of climateJob subscribers. Therefore Wix will not necessarily be a Sub-processor under this DPA for that processing.

Schedule 3 - Technical and Organisational Measures

climateJob will maintain security measures appropriate to the risks associated with the Service.

Current measures include or are intended to include, where applicable:

1. Authentication. User authentication through Supabase Auth. Individual user accounts. Account credentials must not be shared. Authentication tokens/session controls provided through the authentication infrastructure.

2. Access Control. Access to Customer Personal Data is limited to persons and systems requiring access for legitimate operational purposes. Administrative access will be restricted appropriately.

3. Infrastructure. climateJob uses established third-party infrastructure providers including Supabase and Netlify. Relevant providers maintain their own security controls under their contractual arrangements with climateJob.

4. Transmission Security. Personal Data will be transmitted using appropriate encrypted connections where supported by the relevant infrastructure and services.

5. Storage Security. Customer Personal Data is stored using the infrastructure and security mechanisms provided by climateJob's relevant hosting/database providers.

6. Password Security. Authentication credentials are managed using Supabase Auth. climateJob does not intentionally store user passwords in plain text.

7. Data Minimisation. climateJob is designed to process information reasonably necessary to provide its business-management functionality. Customers are instructed not to enter unnecessary special category or highly sensitive information.

8. Backups and Availability. Appropriate backup, resilience and recovery functionality may be provided through climateJob's infrastructure providers.

9. Sub-processor Security. climateJob selects established service providers and maintains appropriate contractual data-protection arrangements with relevant Sub-processors.

10. Incident Management. Suspected Personal Data Breaches will be: assessed; investigated; contained where possible; documented where required; and notified in accordance with this DPA and Applicable Data Protection Law.

11. Security Review. Security arrangements may be reviewed and updated as climateJob develops, taking account of: changes to the Service; changes in technology; identified risks; security incidents; regulatory requirements; and industry practices.

Schedule 4 - Data Return and Deletion

During an active Subscription, Customers should regularly export Customer Data they wish to retain.

Following termination:

• The Customer's access to the Service may cease or be restricted. The Customer will have a 30-day post-termination period to request access to or export available Customer Data. The Customer is responsible for requesting and completing any required export during this period. After the 30-day period expires, climateJob may permanently delete Customer Data from active systems. Residual copies may remain temporarily within backup systems. Backup copies will remain protected and will not be routinely processed. Backup copies will be deleted in accordance with the applicable backup lifecycle. Information may be retained where required by applicable law

The 30-day period does not mean climateJob guarantees that every item of Customer Data will remain available in an immediately exportable format for the entire period. Customers should therefore export their data as soon as possible after cancellation.

Where the Customer makes a valid request to return or delete Customer Personal Data, climateJob will comply to the extent required by Applicable Data Protection Law.

 

Contact

Questions concerning this DPA should be sent to:

Jiutech Ltd, trading as climateJob.
Company number: 17419641.
Registered office: 21 Falconers Rise, Northampton, NN4 0RJ, UK.
Data protection contact: hello@climatejob.co.uk
Website: www.climateJob.co.uk

end of these terms
last updated: 27th August 2026