Data-processing terms

Version 2026-10-13. These terms form part of the Simple & Tidy terms of service between the subscribing business (you) and Duck & Dough Ltd (us).

Scope and instructions

You are the controller of personal information entered into your business workspace, or an authorised processor acting for your own controller. We act as processor for that workspace information. The processing lasts while we provide the account and complete its deletion or return. It includes storing, organising, retrieving, exporting, sharing and deleting records, and sending documents when instructed.

The data concerns your customers, prospects, suppliers and business contacts: names, contact details, addresses, correspondence, order and service details, invoices, payment references, notes and uploaded images. The service is not designed for special-category information, criminal records or full payment-card details. You determine what is entered, keep your instructions lawful, provide appropriate notices and have the necessary rights to use it. Your use of the app and documented support requests are your instructions to us.

Confidentiality and security

We process workspace information only to follow your documented instructions, including for transfers, unless law requires otherwise; where lawful, we tell you before processing required by law. We inform you if an instruction appears to infringe data-protection law. Access is limited to people and providers who need it for the service and are bound by confidentiality obligations. Security measures include authenticated accounts, account-level separation, private file access, encrypted transport and encrypted mailbox credentials. Optional device copies are passphrase encrypted. These measures do not remove your responsibilities for devices, passwords, exports and recipients.

Providers

You authorise our use of the service providers described in the privacy notice for the stated purposes. Where a provider processes workspace information on our behalf, we require data-protection obligations appropriate to that processing and remain responsible for our obligations to you. We will give advance notice of a material new or replacement subprocessor and a reasonable opportunity to object on data-protection grounds. If we cannot resolve a justified objection, contact us to arrange export and termination of the affected service. Providers you independently choose or connect, including your email and speech services, also operate under your arrangements with them.

Requests, incidents and oversight

Taking account of the nature of processing and the information available to us, we assist you with individual-rights requests, security obligations, impact assessments and consultation with regulators. We notify you without undue delay after becoming aware of a personal-data breach affecting the workspace and provide available information and updates to support your response. We make information reasonably needed to demonstrate these obligations available and allow appropriate audits or inspections by you or an authorised auditor, subject to safeguards for other customers and service security.

End of service and transfers

You can export records and images while the account is retained. At your choice, return the information through export and delete the account, or ask us to help complete the return or deletion. We delete active workspace information and existing copies in accordance with our providers' deletion arrangements, unless law requires retention; any retained information remains protected and is used only for that legal purpose. Cancelling payment alone does not instruct account deletion. Transfers outside the UK use applicable legal safeguards described in the privacy notice.

Contact

Send instructions, audit enquiries or data-protection requests to simplendtidy@gmail.com. Our provider identity and postal address are in the terms of service. These processing terms take priority over conflicting general service terms for their subject matter.