Legal

Data Processing Agreement

Last updated: 25 October 2026

Last updated: 31 October 2026

1. Parties and scope

This Data Processing Agreement (“DPA”) is between PBG POOLHEALTH LTD (reg. no. HE 497335, Georgiou Karaiskaki 7, 8560 Pegeia, Paphos, Cyprus — “Processor”, “we”) and the holder of an Owner, Specialist or Business account (“Customer”, “you”). It applies whenever we process personal data on your behalf to provide PoolHealth, and it forms part of the Terms of Service. You accept it when you create such an account or, for an existing account, by confirming it in the app; we record which version you accepted and when. Changes to this DPA follow section 13 of the Terms: we tell you about a material change at least 30 days ahead and ask you to confirm the new version in the app (if you do not agree, you can cancel before it applies); clarifications that do not reduce your rights apply when published.

You are the controller of the personal data about other people that you and your team enter: for a specialist or business, your clients, their pools and visits and enquiries received through your public page; for an Owner, for example household members, guests, staff or contractors. We are your processor for that data. If, as an Owner, you act purely for personal or household purposes, the GDPR may not apply to you for that data (Article 2(2)(c) GDPR); we still process it only as this DPA says. This DPA is meant to meet Article 28 of the GDPR.

2. Details of the processing

Subject matter and purpose: hosting, storing, displaying, sending and backing up your data so that you can use the Service (client records, pools, visits, reports, messages, documents, client portal, public page, notifications).
Duration: for as long as your account exists, and afterwards until deletion as described in section 9.
Categories of data subjects: your clients and their contacts, members of your team, visitors who send enquiries through your public page; for an Owner, the people the Owner records (for example household members, guests, staff or contractors).
Types of personal data: names, contact details, addresses and location links, pool and equipment details, water readings, visit reports, photos, notes, tasks, messages, quotes, contracts, invoices and payment status, sign-in data of client and team logins; and, where you use those features, team and employment records, working time, leave, remuneration and payroll-related information, and business expense records that identify individuals.
Special categories: none are needed for the Service. Do not enter health or other special-category data.

3. Instructions

We process the data only on your documented instructions. Your instructions are these Terms and this DPA and the way you use the features of the Service. We do not use your clients' data for our own purposes, including statistics or analysis. If EU or member-state law to which we are subject requires us to process the data in another way, we tell you about that legal requirement before processing, unless that law forbids telling you on important grounds of public interest. If an instruction appears to infringe data-protection law, we tell you.

4. Confidentiality and security

Everyone at our company who can access the data is bound by confidentiality. We maintain the technical and organisational measures in Annex 1 and may improve them, but will not reduce the overall level of protection.

5. Sub-processors

You give us general authorisation to use the sub-processors listed in Annex 2. We tell you at least 30 days in advance (by e-mail or in the app) before adding or replacing a sub-processor. You may object on reasonable data-protection grounds; if we cannot address the objection, you may end your subscription before the change applies and we refund any prepaid fees for the period after it. We impose data-protection obligations on each sub-processor that are no less protective than this DPA, and remain responsible for them.

6. International transfers

Where a sub-processor processes data outside the EU/EEA, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework) or the EU standard contractual clauses, as listed in Annex 2.

7. Assistance

The Service lets you view, correct, export and delete your clients' data yourself, which covers most data subject requests. If we receive a request from one of your clients, we pass it to you and do not answer it ourselves unless you ask us to. Taking into account the nature of the processing and the information available to us, we help you meet your obligations under Articles 32 to 36 of the GDPR: security of processing (Article 32); assessing a personal data breach, notifying the supervisory authority and, where needed, the people affected (Articles 33 and 34), including by giving you the information we have for those notifications; data protection impact assessments (Article 35); and prior consultation of the supervisory authority (Article 36). We also help you answer data subject requests (Articles 12 to 23) as far as the Service's own tools are not enough.

8. Personal data breaches

We notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data, with the information then available (what happened, data and people concerned, likely consequences, measures taken), and update you as we learn more.

9. End of the service: return or deletion

At the end of the service you choose whether your data is returned to you or deleted:

Return: you can download a copy at any time in My profile. It is a .zip file with: a spreadsheet of every record your account can see — clients, pools, visits and their readings, quotes, contracts, invoices and payments, additional work, tasks, income, expenses and payroll, holiday rentals, messages, stock, own chemicals, your public page and its enquiries, support messages and your subscription — and the photos from visits and messages as image files. Quotes, contracts and invoices are included as their data (you can create their PDFs in the app before deleting). If the photos are larger than about 300 MB in total, the file lists the ones left out and we send them without undue delay and at the latest within one month of your request. You can still do this after a subscription ends, during the 14 days after you ask to delete the account, and after the e-mails we send 30 and 7 days before an inactive account is deleted. If you cannot do it yourself, write to info@pool-health.com before the deletion date: we prepare the copy for you and postpone the deletion until you have received it, for up to 30 days.
Deletion: if you do not ask for a copy, we delete your data, including photos, when the account is deleted (14 days after you close it, within 24 hours if you choose “Delete at once”, or after 12 months of inactivity as set out in the Terms). That removes it from our live systems; database records disappear from our provider's backups within 30 days, and photos and files are not part of those backups (Annex 1). Ending a paid subscription alone does not delete anything: the account stays available read-only so that you can export.

Deleted database records disappear from our hosting provider's database backups within 30 days; photos and files are not part of these backups and are removed from storage when deleted. Where EU or member-state law requires us to keep some of the data, we keep only that data, only for as long as required, and use it for nothing else. On request, we confirm the deletion in writing.

10. Audits

We make available the information necessary to demonstrate compliance with this DPA, including on request a written description of our measures. We allow for and contribute to audits, including inspections, by you or an independent auditor you appoint who is bound by confidentiality. Normally an audit takes place at most once a year, with 30 days' notice, during business hours and at your own cost. These limits do not apply where there has been a personal data breach affecting your data, where you have reasonable grounds to suspect that we are not complying with this DPA, or where a supervisory authority requires the audit: then we cooperate with shorter notice. For sub-processors we first provide their own audit reports and certifications; where these are not enough, we use our audit rights against the sub-processor on your request and share the results with you. We will tell you immediately if, in our opinion, an instruction infringes data protection law.

11. Liability, term and law

Liability under this DPA follows the Terms of Service, except where the law does not allow it to be limited. This DPA lasts as long as we process personal data for you. If it conflicts with the Terms on the processing of personal data, this DPA prevails. It is governed by the laws of the Republic of Cyprus.

Annex 1. Technical and organisational measures

Encryption of data in transit (HTTPS/TLS) and at rest (AES-256, by the hosting provider).
Database access rules (row-level security) so that each account sees only its own data; separate roles for clients, specialists, office managers and businesses.
Passwords of at least 8 characters, stored only in hashed form by the sign-in provider; administrative access to the database and the providers' consoles limited to the company's authorised personnel.
Database backups made by the hosting provider are kept for a limited period (at most 30 days); files and photos are not part of these backups.
Server keys and secrets kept only on the server, never in the app.
Logs for security monitoring, kept for a limited period.
Data minimisation: e-mails and notifications carry only what the recipient needs.

Annex 2. Sub-processors

Supabase Pte. Ltd. (Singapore) — database, sign-in, storage, server functions; data hosted in Germany (EU); access from outside the EU possible for support and operations — EU standard contractual clauses (2021/914).
Netlify, Inc. (USA) — hosting of the app — EU–US Data Privacy Framework (certified); EU standard contractual clauses as a fallback.
Plus Five Five, Inc., trading as Resend (USA) — e-mail delivery — EU–US Data Privacy Framework (certified) and EU standard contractual clauses.
Push services of users' browsers (Google, Apple, Microsoft or Mozilla) — not sub-processors engaged by us: if a user switches notifications on, that user's browser chooses the push service, run by the browser maker for the user. We hand it each notification with the content encrypted end to end; it sees only delivery data (device address, time, size, our server's address). Details: Privacy Policy, section 4.
OpenStreetMap Foundation (UK) — not a sub-processor engaged by us: when a map is shown, the user's browser requests the map tiles from it directly; it receives the browser's IP address and the map area shown, and nothing else from us. Details: Privacy Policy, section 4.