Data Processing Policy

Last updated: 22 October 2026

Gevu is a trading name of Seawolf Facilities Services Ltd. This policy describes how Seawolf Facilities Services Ltd (“Seawolf”, “we”) processes personal data on behalf of Gevu customers (“Customers”) in its role as a data processor under the UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025). It forms part of our Terms of Service and is the data processing agreement between Seawolf and each Customer required by Article 28 of the UK GDPR. If it conflicts with the Terms on how Customer personal data is processed, this policy wins.

1. Controller and processor roles

For personal data relating to a Customer’s staff, clients, and contacts held within their workspace, the Customer is the data controller and Seawolf acts as data processor. Customers are responsible for ensuring they have a lawful basis for collecting and sharing this data with Gevu, and for responding to data subject requests relating to it.

Details of the processing

• Subject matter and duration: providing the Gevu platform to the Customer, for as long as its subscription lasts plus the deletion period in section 8.
• Nature and purpose: storing, organising, displaying, transmitting and analysing data so the Customer can run its cleaning business: scheduling, clock-ins, timesheets and payroll, invoicing, compliance, messaging, client portals, CRM and reporting.
• Categories of data subjects: the Customer’s staff and contractors, its clients and their contacts, sales prospects, suppliers, and callers or website visitors who contact the Customer.
• Types of personal data: identity and contact details; employment, pay, hours and absence records; location data from clock-ins, journeys, lone-worker checks and SOS; photos and documents; messages, emails and call transcripts; audio recordings of site surveys and meetings, with their transcripts and summaries; and financial records. Special category data: health information (sickness absence, optional emergency medical details, TUPE health notes) and trade union membership (TUPE).

Our commitments as processor

• Instructions: we process Customer personal data only on the Customer’s documented instructions, which are this policy, the Terms of Service and the Customer’s use and configuration of the platform, unless UK law requires otherwise (in which case we will tell the Customer first, unless the law forbids it). We will tell the Customer if we believe an instruction breaks data protection law.
• Confidentiality: everyone at Seawolf who can access Customer personal data is bound by a duty of confidentiality and accesses it only where needed, for example to provide support the Customer has asked for.
• Assistance: taking into account the nature of the processing and the information available to us, we help the Customer meet its obligations on security, breach notification, data protection impact assessments and consultation with the ICO, including by providing information about how the platform works.

2. Processing scope

We process personal data only to the extent necessary to: provide contracted platform features (scheduling, timesheets, invoicing, compliance auditing, messaging, reporting); maintain security and prevent fraud; provide technical support; and meet legal obligations. We do not process Customer Data for our own commercial purposes or share it with third parties for advertising.

Where a Customer uses CRM email tracking, we process open and click events for the emails it sends (time, link clicked, and an email-app label; no IP address) on its instructions. The Customer decides whether tracking is used, and is responsible for transparency towards recipients and for any consent required under the Privacy and Electronic Communications Regulations 2003. Tracking events are deleted with the Customer’s copied CRM emails under its CRM email retention setting.

Where a Customer uses journey tracking, automatic journey detection, Smart lone-worker monitoring or SOS, we process its staff’s location data and, for staff assigned to a vehicle, whether automatic journeys and “all the time” location are switched on for them, on its instructions. Automatic journey detection is optional for staff in the app, which always offers logging a journey by hand. The Customer remains responsible for: having a lawful basis for this monitoring (consent is rarely a valid basis in employment unless refusing has no consequence for the worker); telling its staff what is collected and why, in its own staff privacy notice or monitoring policy; completing a data protection impact assessment where the monitoring is likely to be high risk; not using the journey setup status to pressure or penalise staff who decline an optional feature; and agreeing with staff any use of their own phone for work. The app shows staff, at the point they are asked, what is collected and that they can say no.

Where a Customer uses the survey or meeting recorder, we store the audio and, when one of its users asks, send it to Google’s Gemini API to transcribe and summarise it, on the Customer’s instructions. The Customer is responsible for: having a lawful basis for recording; telling everyone present before recording starts, and not recording anyone who objects; not recording special category data such as health or disciplinary conversations; and answering requests from people who were recorded. The audio is deleted 30 days after it is transcribed, or 90 days after recording if it is never transcribed; the transcript and summary are kept until the Customer deletes them. Copies its users save to their own devices are outside our systems.

3. Sub-processors

We engage the following sub-processors and require them to process data only on our documented instructions, under confidentiality obligations, and with appropriate technical and organisational security measures:

• Supabase Inc. — database hosting, authentication, and row-level security.
• Stripe Inc. — payment processing, including Job Exchange marketplace payment splits (payment card data is not transmitted to Gevu).
• Google LLC (Firebase) — push notification delivery.
• Postmark (ActiveCampaign, LLC) — transactional email delivery (invoices, MFA codes, portal invites, and other account notifications).
• Google LLC (Gemini API) — AI-assisted document generation, transcription and summaries of survey and meeting recordings, and the Cleaning Manager assistant, where enabled (prompts include operational data only where the Customer chooses to use the AI feature — see our AI Usage Policy).
• Vercel Inc. — web application hosting.
• Cloudflare, Inc. (R2) — encrypted off-site backups of the database and uploaded files, stored in the EU and kept for up to 90 days. Cloudflare holds only encrypted copies and cannot read them.
• PostHog Inc. — in-app product usage analytics, hosted in the EU.
• Sentry (Functional Software, Inc.) — error tracking and diagnostics.
• FreeAgent Central Ltd, Xero Ltd, and Sage Group plc — accounting sync, only where a Customer connects one of these to their workspace.
• Meta Platforms, Inc. (WhatsApp Business) — WhatsApp notification delivery, only where a Customer enables this.
• Microsoft Ireland Operations Ltd (Microsoft Graph / Microsoft 365 Calendar) — calendar sync for bookings and site visits, only where a Customer connects this.
• Google LLC (Sign in with Google and Google Calendar) — Google sign-in where a user chooses it, and calendar sync for bookings and site visits, only where a Customer connects this.
• ipapi.co (Kloudend, Inc.) and Open-Meteo — approximate location from the user’s IP address and the weather for it, shown on the dashboard and client portal; requested by the user’s browser and not stored by us.
• DVLA and DVSA (UK government) — vehicle tax and MOT history lookups by registration number for a Customer’s fleet.
• Google LLC (Maps & Places API) — address lookup, autocomplete, geocoding, and retrieval of a business’s own public Google reviews.
• UK Companies House — company search and officer/filing lookups used for CRM prospecting.
• Trustpilot A/S — retrieval of a company’s own public Trustpilot review data, where used.
• Komoot GmbH, the OpenStreetMap Foundation, postcodes.io, OpenRouteService (HeiGIT gGmbH), and OSRM (Open Source Routing Machine) — address geocoding, route calculation, and distance/time estimation between sites.
• Google LLC, Mozilla Corporation, and Apple Inc. (browser push services) — where Firebase is not used, delivery of browser push notifications directly through the relevant browser vendor’s own push infrastructure.
• Apple Inc. (Apple Push Notification service) — notification delivery to iPhones.
• Google LLC (Gmail API) and Microsoft (Outlook through Microsoft Graph) — copying and sending CRM emails, only where a Customer connects a mailbox.
• getAddress Ltd and Ideal Postcodes Ltd — the addresses for a UK postcode (they receive the postcode only).
• Ship24 — supplier delivery tracking (tracking number and carrier only).

Where a Customer connects its own account with a provider (for example Retell AI for an AI receptionist, an accounting package, a calendar, a mailbox, or its own AI provider key from Google, OpenAI or Anthropic), that provider acts on the Customer’s instructions under the Customer’s own agreement with it, and we pass data to it only as the Customer has set up. Such a provider is not our sub-processor: the Customer is responsible for having appropriate data processing and international transfer terms in place with it. When a Customer connects its own AI provider key, prompts for AI Features (which may include personal data, photos and documents) go to that provider instead of to our Gemini account, except for features only Gemini supports; see section 10A of our AI Usage Policy.

The Customer gives us general authorisation to use the sub-processors above. We impose data protection terms on each sub-processor that are no less protective than these, and we remain responsible to the Customer for their performance. We will give Customers at least 30 days’ notice by email or in-app notice before adding or replacing a sub-processor that will process Customer personal data. A Customer may object on reasonable data protection grounds within that period; we will then work with it in good faith on an alternative, and if none is possible it may end the affected part of its subscription and receive a pro-rata refund of any prepaid fees for the remaining period.

4. Security measures

We apply the following technical and organisational measures: encryption in transit (TLS 1.2+) and at rest; row-level security policies in the database to enforce data isolation between Customers; role-based access controls; multi-factor authentication for platform accounts; audit logging of data access and modifications; regular dependency and security reviews; and incident response procedures.

5. International data transfers

Customer Data is stored in the European Union (Ireland). Some processing takes place outside the UK and EU, notably on our application servers (Vercel), which run partly in the United States, and at sub-processors based there. These transfers rely on the UK–US data bridge where the provider is certified under it, or otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. Details of the mechanism for each sub-processor are available on request.

6. Data subject rights assistance

We will assist Customers in responding to data subject rights requests (access, rectification, erasure, restriction, portability, objection) as required by applicable law. Customers can use the platform’s built-in export and delete tools for most requests. Where technical assistance is needed, contact support@seawolfservices.co.uk.

7. Breach notification

We will notify affected Customers without undue delay (and within 72 hours where feasible) upon becoming aware of a personal data breach affecting their Customer Data, providing sufficient information to enable the Customer to meet their own notification obligations.

8. Retention and deletion

Customer Data is retained for the duration of the active subscription. Before ending its subscription, a Customer can export its data using the platform’s export tools, or ask us for a copy. Upon workspace deletion, Customer Data is permanently deleted within 30 days, unless UK law requires us to keep it; it then leaves our rolling backups as they expire. Anonymised or aggregated data derived from Customer Data may be retained for platform reliability purposes.

9. Audits

Customers may request confirmation that we are processing data in accordance with this policy. We will make available the information needed to show we meet these terms, usually through questionnaires, documentation and security evidence. Where that is not enough, or a regulator requires it, the Customer (or an independent auditor it appoints, bound by confidentiality) may audit us on at least 30 days’ written notice, no more than once a year unless there has been a breach, during business hours and at the Customer’s own cost.

10. Contact

For data processing enquiries: support@seawolfservices.co.uk
Seawolf Facilities Services Ltd, England & Wales (no. 15028189).

← Back to policies