Privacy notice

Who we are

WorkRound is a trading name of DB Meridian Ltd, a company registered in England and Wales under number 17427999. Our registered office is 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX. You can contact us about privacy at [email protected].

Who is responsible for the information?

DB Meridian Ltd is the data controller for information about people who create or administer a WorkRound account, contact us, or use this website.

The business that signs up to WorkRound is normally the data controller for the personal information it enters about its own customers. That business decides why and how it uses those details and is responsible for having a lawful basis, giving its customers appropriate privacy information and responding to their rights. DB Meridian Ltd acts as its data processor by storing and using that information only to provide, secure and support WorkRound.

If you are a customer of a business that uses WorkRound, contact that business first about your information. We will assist the business with an appropriate request.

Information handled by WorkRound

• Account and business details: name, email address, password hash or social sign-in identifier, business name, business type, country, account identifiers and session records.
• Subscription details: the business identifier supplied to RevenueCat, selected product, store, trial/subscription status, renewal and expiry information. Apple or Google handles payment details; WorkRound does not receive full card or bank details.
• Customer and work records entered by the account holder: customer names, phone numbers, email addresses, addresses, notes and custom fields; services, service details, prices and frequencies; job dates, order, completion history, charges and whether a payment was unpaid, cash or bank.
• Communications: website enquiries, support messages and transactional email delivery records.
• Technical information: security and request logs such as IP address, device or browser information, request time and diagnostic events.

WorkRound records payment status and amounts, but does not process payments between the account holder and their customers.

How information is collected

We receive information directly when someone registers, sets up a business, enters work records, signs in, contacts us or changes settings. If someone chooses Apple or Google sign-in, we receive the provider identifier and account details needed to authenticate them. Technical information is created when the website, app and API are used. The mobile app also keeps an account-isolated copy of work records and credentials on the user’s device so supported field work can continue offline.

An account email, sign-in method and the required business setup details are needed to provide WorkRound; without them we cannot create and operate the account. Customer contact fields other than name, and free-text details, are optional. There is no statutory requirement to provide this information.

Why we use information

• To create accounts, authenticate users, provide WorkRound, synchronise offline work and deliver requested support. For account data, this is necessary to take steps before and perform our contract with the account holder.
• To send account, security and service emails. This supports our contract and our legitimate interest in operating the service.
• To keep the service secure, prevent misuse, diagnose faults and maintain reliable records. We rely on our legitimate interests and, where applicable, legal obligations.
• To respond to website enquiries, based on steps requested before a contract and our legitimate interest in answering genuine enquiries.

For customer and work records where we are a processor, we act on the account holder’s documented instructions rather than deciding the purpose ourselves. We do not sell personal information, use it for behavioural advertising or make solely automated decisions with legal or similarly significant effects.

Who receives information?

Information is available to the relevant account holder and to our personnel where needed to operate or support WorkRound. OVH Limited (OVHcloud) provides website, application and database hosting. Cloudflare, Inc. routes and protects website traffic. Plus Five Five, Inc. (Resend) provides transactional email delivery and uses Amazon Web Services, Inc. as a hosting and email-sending sub-processor. RevenueCat, Inc. receives the business identifier and subscription lifecycle information needed to manage entitlements. Apple or Google receives information when its sign-in or subscription service is used. We may also disclose information where required by law, to protect legal rights or in connection with a business reorganisation.

Some providers may process information outside the UK. Where UK law requires it, we use an applicable adequacy regulation or recognised contractual safeguards. Contact us for more information about the safeguard relevant to a transfer.

How long we keep information

We keep account and service information while the account is active and afterwards only for as long as reasonably needed to close the account, resolve disputes, meet legal or accounting duties and protect the service. Customer and work records are kept on the account holder’s instructions for the life of the account, then deleted or made inaccessible in line with our deletion and backup process, subject to any legal requirement to retain them. Enquiries and technical logs are kept only while they remain useful for the purpose collected. We periodically review information and securely delete or anonymise it when it is no longer needed.

Security and the user’s device

We use technical and organisational measures intended to protect information, including access controls, tenant separation, hashed passwords and refresh tokens, and secure credential storage on supported devices. No internet service is completely secure. Account holders should protect their device, sign-in details and access to customer information, and should allow pending offline work to synchronise before changing or disposing of a device.

Your data protection rights

Depending on the circumstances, a person may ask for access to their personal information, correction, deletion, restriction, portability or withdrawal of consent where consent is used.

You also have the right to object to processing based on legitimate interests. Tell us why you object and we will consider the circumstances and applicable law.

Account holders can contact us to exercise a right. A customer whose details were entered by an account holder should contact that business as controller; we will support it as processor. You may complain to the Information Commissioner’s Office, although we would welcome the chance to address the concern first.

Website cookies and changes

The marketing website does not intentionally set analytics or advertising cookies. If that changes, we will update this notice and request consent where required. We may update this notice when WorkRound or our legal obligations change and will bring material changes to account holders’ attention where appropriate. The date above shows the latest version.