Data processing terms

These terms are part of the agreement between Dealn, a trading name of Buildshield LTD (company number 17063657) and each group that uses Dealn Squares or Dealn Events (“the customer”). They set out how Dealn processes personal data for the customer, as UK GDPR Article 28 requires. If anything here conflicts with the rest of the agreement, these terms win on data protection.

1. Who is who

The customer is the controller of the personal data it puts into the service, or that its staff put in. Dealn is the processor: it processes that data only to provide the service. The details of the processing (what, whose, why and for how long) are in Annex 1.

2. Dealn will

1. Follow the customer’s instructions. Dealn processes the personal data only on the customer’s documented instructions, which are the agreement, these terms, and what the customer does in its console (adding people, approving sales, setting retention and privacy settings, exporting or erasing data). If the law requires other processing, Dealn will tell the customer first, unless the law forbids that. Dealn will tell the customer if it believes an instruction breaks data protection law.
2. Keep it confidential. Everyone at Dealn who can reach the data is bound by confidentiality, and only reaches it to provide or support the service.
3. Keep it secure, with the measures in Annex 2, reviewed as the service changes.
4. Use sub-processors only as set out here. The customer authorises the sub-processors listed at /sub-processors. Dealn will give at least 30 days’ notice by email to the customer’s group admins and its data protection contact before adding or replacing one; the customer may object on reasonable data protection grounds, and if that cannot be resolved, may end the affected service without penalty. Dealn puts each sub-processor under data protection terms at least as protective as these, and remains responsible for them.
5. Help with people’s rights. The console lets the customer export, correct and erase a person’s data itself (for staff, in Squares; for the customer’s own customers in Dealn Events, Admin › Customer requests, which finds a customer by email or mobile, downloads everything held about them and erases it). Dealn will help with anything the tools cannot do, promptly and without charge for reasonable requests.
6. Help with the customer’s other duties: security, breach notification, data protection impact assessments and consulting the ICO, taking into account what Dealn can know about the processing.
7. Report a personal data breach to the customer (its group admins and data protection contact) without undue delay, and within 48 hours of becoming aware of it, with what is known at the time and updates as more is learned, and take reasonable steps to contain it.
8. Delete it when the service ends. Ninety days after the customer’s group is closed, Dealn deletes all personal data about its people and customers (sooner on request, or later if the customer asks in writing). Before that, the customer can export what it needs. When it is done, Dealn emails the customer’s data protection contact (or, if it has not named one, its group admins) a certificate of deletion. Dealn keeps its contract, invoices and signed agreement as its own accounting records.
9. Keep data in the UK, or protect it properly. The data is stored and processed in the UK. A sub-processor that reaches it from outside the UK may do so only under UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses.
10. Show it is complying. Dealn will give the customer the information it reasonably needs to show compliance with Article 28, and will answer a reasonable written security questionnaire once a year. Where that is not enough, the customer (or an auditor bound by confidentiality) may audit Dealn on 30 days’ notice, at the customer’s cost, at most once a year unless the ICO requires more.
11. Prove deletion. The clean-up runs every night. The console’s Data protection page shows, night by night, what it removed from the customer’s data (how many of what, never the data itself), and a certificate for each Dealn Events event whose customers it deleted. The data protection pack, a PDF from the same page, includes both. Deleted data leaves the database provider’s restore history within 30 days.

3. The customer will

1. Have a lawful basis for the processing, and tell its staff about it (the staff privacy notice on the customer’s own Squares address, /privacy, is provided for that).
2. Put in only what the service needs: in particular, an order number rather than a customer’s name where it can.
3. For Dealn Events, upload or enter only customers it may lawfully contact for the purpose: with their consent to offers by email and by text, or within the soft opt-in, and declare in the upload only the permissions it really holds; screen numbers against the Telephone Preference Service (or hold consent) before making marketing calls; and give its customers the notice at /privacy?for=customers on its address.
4. Keep management PINs and the console to the people they were issued to, and remove people who leave.
5. Give Dealn only lawful instructions.

4. Liability

Each party’s liability under these terms is as limited in the agreement, except where the law does not allow it to be.

Annex 1: the processing

• Subject matter and duration: running Dealn Squares (and Dealn Events, if the customer uses it) for the customer, for as long as the agreement lasts and then until the data is deleted as above.
• Nature and purpose: storing and displaying a staff sales incentive game: logging and approving sales, awarding and recording picks and prizes, emailing staff their links, and the console’s records; for Dealn Events, sending event invitations and reminders to the customer’s customers and recording bookings.
• Whose data: the customer’s staff (sales executives, service staff, managers, administrators, finance contacts); the customer’s customers, only as an order number or surname on a sale (a sale from Dealn Events carries only its booking reference), and for Dealn Events, as contacts invited to events.
• What data: names, work email addresses, brand, site, role and department, optional photos, hashed PINs, sales logged (vehicle, stock or job number, dates, order number or surname, number plate), game activity and prizes, the email log (no message bodies), and the console activity log. For Dealn Events: customers’ names, contact details, marketing preferences and bookings, as imported or entered by the customer.
• Special category data: none is needed, and the customer must not enter any.

Annex 2: security measures

• Everything is encrypted in transit (HTTPS with HSTS) and at rest.
• Each group’s data is separated by row-level security in the database itself, enforced for the application’s database role, so a fault in one query cannot show one group another’s data.
• Management PINs are hashed with scrypt and a server-side secret; the one-time keys in links are stored only as hashes; the authenticator secrets for Dealn’s own administrators are encrypted. A Dealn Events customer’s own links are long random codes, looked up by a hash and never shown on staff screens; addresses in the message log are kept only as keyed hashes.
• The console needs a PIN, with waits that grow after wrong tries and an email to the person after 20; sessions end at once when someone is removed, changes role or chooses a new PIN. Dealn’s platform console needs a password and an authenticator code, each code usable once.
• Pages refuse to be framed by other sites, refuse requests sent from other sites, and run only their own scripts (a content security policy).
• Personal data is minimised (order numbers before names) and deleted on the schedule in Annex 4, automatically every night.
• Access to production systems is limited to named Dealn staff, with two-factor authentication on the hosting and database accounts.
• Backups are the database provider’s restore history, kept no longer than 30 days.
• Personal data stays in the production systems in Annex 3: development and testing use made-up data, and Dealn looks at the customer’s data only to keep the service running or when the customer asks for help.

Annex 3: sub-processors

• Vercel: Runs the application: the web pages and the code behind them. London (UK) region for all processing. Vercel is a US company. Vercel’s data processing addendum, with the UK International Data Transfer Addendum for any access from outside the UK. Certified: SOC 2 Type 2 and ISO 27001.
• Neon: The database where everything is stored. AWS London (UK). Neon is a US company. Neon’s data processing agreement, with the UK Addendum for any access from outside the UK. Certified: SOC 2 Type 2, ISO 27001 and ISO 27701.
• Resend: Sends the emails (pick links, approvals, invites, invoices, and Dealn Events invitations and booking emails). Dealn’s sending domains are set up in Resend’s Ireland (EU) region, which sends through Amazon SES in Ireland. Resend is a US company. Resend’s data processing agreement. The EU has UK adequacy; the UK International Data Transfer Addendum covers any access from the US. Certified: SOC 2 Type 2.
• Twilio: Sends text messages, only for groups that use text messages in Dealn Events: the mobile number, the sender name and the text. Twilio processes the messages in the United States and delivers them over UK mobile networks. Twilio is a US company. Twilio’s data protection addendum, with the UK International Data Transfer Addendum for the transfer to the United States. Certified: ISO 27001 and SOC 2 Type 2.
• Zoho: Dealn’s support and privacy mailboxes: what people write to Dealn’s support and privacy addresses (a customer asking about their details, say), and Dealn’s replies. The service itself sends nothing there. Zoho’s UK data centre. Zoho is an Indian company. Zoho’s data processing agreement, with the UK Addendum to the EU standard contractual clauses for any access from outside the UK. Certified: ISO 27001 and SOC 2 Type 2. Added 14 October 2026.

Annex 4: retention

• The email log (who was emailed, about what, and whether it arrived): 90 days. The emails themselves are never kept.
• A customer’s name or order number, and the number plate, on a logged sale: 90 days after the board it was on ends, once any prize on it has been settled; 12 months at the most.
• The same on a prize result: 90 days after the prize is settled; 12 months at the most.
• A person removed from the game: Their email address, photo and PIN are deleted 90 days after removal. Their name stays on the boards and prizes they played, which are the group’s records, until those boards are deleted.
• Finished boards, with their sales, picks and prizes: 6 years after the board ends (prizes can be taxable, and these are the records of them). After that only anonymous totals are kept.
• The console’s activity log: 12 months.
• Fair-play flags once dealt with: 6 months.
• One-time links and sign-in counters: A link works for between 2 hours and 30 days depending on what it is for; dead links and counters are deleted within 30 days.
• Dealn Events: an event’s customers (their invitations, bookings, calls, follow-ups and personal links): 90 days after the event’s last day once none of its follow-ups is still open, and 12 months after it at the most, counted from the event’s dates. The event keeps its totals (how many were invited, booked, came and bought), with nobody’s name in them. A customer no remaining event needs is deleted with it. A group’s admin can also erase one customer at any time (Admin › Customer requests).
• Dealn Events: the “stop invitations” link in an invitation, once the event’s customers are deleted: 13 months, so an old email’s link still works. It then holds only a keyed code made from the address it was sent to (a hash with a secret key), nothing readable.
• Dealn Events: a customer list uploaded to an event that never launched: 30 days after it was uploaded. A launched event’s list is deleted as soon as its invitations are made.
• Dealn Events: the do-not-contact list: Kept, so that people who opted out stay opted out. Names are removed after 90 days; the email address or mobile number alone does the job. Someone erased on request who asked not to be contacted again is kept only as a keyed code.
• Dealn Events: the log of texts and emails sent to customers: 13 months (it is how texts are billed). The address is kept only as a keyed code, never the message, and which customer and booking each message was for is forgotten when the event’s customers are deleted.
• Dealn Events: the console’s activity log: 12 months. It names bookings by their reference, not customers by name.
• A group that closes: Everything about its people, customers and boards is deleted 90 days after it closes (sooner on request). Dealn keeps its contract, invoices and signed agreement for 6 years, as accounting records.
• Backups: The database provider keeps a short restore history. Anything deleted is gone from it once that window has passed (no more than 30 days).

Version 2026-10-v4. Questions: privacy@dealn.co.uk.