Terms of Service

Last updated: 10 July 2026

Summary

These Terms are the agreement between you and Pherox Technologies Ltd ("Pherox") for using the Pherox service. They cover:

What Pherox is and what we promise to do
What you can and cannot do with the service
How much it costs, how the free trial works, how you pay, and how to cancel
Who owns what, who is responsible for what, and what happens if something goes wrong
The legal bits: liability limits, governing law, how we handle changes

The Data Processing Agreement, the Acceptable Use Policy, and the Service Level Description form part of these Terms as Schedules A, B, and C at the end.

If anything in these Terms is unclear, email us at team@pherox.co.uk before you accept them.

1. Who these Terms are between

These Terms are a contract between:

Pherox Technologies Ltd, a company registered in England and Wales (company no. 17181975), registered office 195 Manchester Road, London E14 3DR ("Pherox", "we", "us", "our"); and
You, the person or business creating an account to use the Pherox service ("you", "your").

By creating an account or using Pherox, you agree to these Terms. If you are creating an account on behalf of a business, you confirm you have authority to bind that business, and "you" in these Terms means both you personally and the business.

You must be at least 18 years old to use Pherox.

2. The service

Pherox is a mobile-first quoting and job-management platform for UK tradespeople. It is available at pherox.co.uk and app.pherox.co.uk.

The service includes everything we make available through our websites and apps, including:

Quoting and job-management features
Per-trade pricing knowledge for decorators (live at launch) and, in due course, plasterers, tilers, flooring specialists, plumbers and heating engineers, electricians, and carpenters and joiners
Customer-facing PDF generation
Support, documentation, and any other features we add over time

We add features, change features, and retire features from time to time. We will give you reasonable notice of any change that materially reduces the service. If we materially reduce the service in a way that affects your paid tier, you can cancel under section 16 and we will refund any prepaid amounts covering the period after the change.

3. Your account

Creating an account. You sign up at pherox.co.uk with an email address. We log you in by sending a one-time link to that email ("magic-link"). We do not use passwords.

Account accuracy. You must give us accurate, current, and complete information. You must keep it up to date.

Account security. You are responsible for the security of the email account you use to sign in. If someone else has access to your email, they can sign in to Pherox as you. Tell us at team@pherox.co.uk if you think your account has been used by someone else without your permission.

One account per user. A Pherox account is for one user. You cannot share your account or your sign-in link with anyone else.

Suspending or closing your account. You can close your account at any time from your account settings, or by emailing team@pherox.co.uk. We can suspend or close your account under sections 15 and 16.

4. Pricing and billing

Pherox is offered to UK tradespeople under a paid subscription model. At launch, a single tier is available:

Tradesman. £27 per month. Unlimited quotes, your branding on PDFs, quote tracking from sent to won.

Additional tiers (Multi-Trade and Builder) will be added in the future. We will tell you before they become available and will update these Terms with the relevant detail.

Prices are in pounds sterling. We are not currently VAT-registered. If we register for VAT in the future, we will add VAT at the prevailing UK rate from the date of registration.

Free trial. When you create a Tradesman account, you get a 14-day free trial. No card is required to start. We will email you 48 hours before the trial ends. If you add a card before the trial ends, the £27/mo subscription begins on the day after the trial ends. If you do not add a card, your account stays open but you cannot create new quotes until you add one. Past quotes remain visible.

Founding 100. A founding rate of £13.50/mo (50% of the standard Tradesman price) is available to the first 100 sole-trader Tradesman sign-ups. Once 100 founding subscriptions are active, the offer closes. The founding rate is locked for the life of your continuous Tradesman subscription. If your subscription lapses (through cancellation or non-payment), the founding rate ends; if you choose to resubscribe afterwards, you do so at the then-standard Tradesman price.

Billing. When you add a card, you are billed monthly in advance. The first charge happens on the day after the trial ends. We then automatically take payment on the same day of each month until you cancel.

Payment processing. Payments are processed by Stripe. We never see or store your card details. Stripe's own terms govern your relationship with them as a payment processor.

Failed payments. If a monthly payment fails, we will retry up to three times over a week and email you each time. If we still cannot take payment, your account is suspended: you keep access to view past quotes but cannot create new ones until you provide a working payment method. After 30 days of continuous non-payment, the account is closed and our standard retention applies (see section 16).

Price changes. We can change the standard Tradesman price. We will give you at least 30 days' notice by email before any price change affects you. The founding rate, where it applies, is not subject to standard price changes. You can cancel before any new price takes effect under section 16. If you do not cancel, the new price applies from your next billing date.

Refunds. We do not offer refunds for partial months. If you cancel, you keep access to the paid features until the end of the period you have already paid for. Your statutory rights are not affected.

5. Using Pherox properly

When you use Pherox, you must:

Use it lawfully, and only for legitimate trades-business purposes
Follow our Acceptable Use Policy (Schedule B to these Terms)
Not share your account or your sign-in link with anyone else
Not try to access parts of the service you are not paid for, or work around tier restrictions
Not scrape, reverse-engineer, decompile, or copy the service except where UK law specifically allows it
Not use automated tools to access the service in a way that disrupts it or other users
Not upload anything illegal, infringing, defamatory, abusive, or otherwise prohibited under the Acceptable Use Policy
Not use Pherox to misrepresent your trade qualifications, certifications, or insurance status to your customers

We can suspend or close your account if you break these rules. We will tell you why and give you a chance to put it right where it is reasonable to do so.

6. Your customers' data

When you use Pherox to quote a job, you enter personal data about your customer (typically a homeowner): their name, address, the work you are doing, and the price you are quoting.

For that data:

You are the data controller under UK data protection law.
We are your data processor. We process your customers' data only on your instructions and only to provide the service to you.

Our Data Processing Agreement (Schedule A to these Terms) sets out the detailed terms for that relationship, including the technical and organisational measures we use, the sub-processors we engage, and what happens when your customer asks about their data. By agreeing to these Terms, you also agree to the DPA.

The way we handle data about you (your account, your billing, your usage of Pherox) is governed by our Privacy Policy at pherox.co.uk/privacy. By agreeing to these Terms, you confirm that you have read the Privacy Policy.

You confirm that you have a lawful basis to process the personal data of your customers that you enter into Pherox, and that you will give your customers any privacy information they are entitled to under UK data protection law.

7. Your content and your responsibility for it

Your content. Anything you enter into Pherox (job descriptions, customer details, pricing, notes, attachments) is your content. You keep ownership of it.

Licence to us. You grant us a worldwide, royalty-free, non-exclusive licence to host, store, copy, transmit, display and process your content for the purpose of providing the service to you. This licence ends when your content is deleted from our systems under the retention periods in our Privacy Policy.

Your responsibility. You are responsible for what you enter into Pherox. You confirm that:

You have the right to enter the content you upload
The content is accurate to the best of your knowledge
You have the lawful basis to enter personal data about your customers
The content does not break the law and does not infringe anyone else's rights

If we receive a complaint or legal notice about your content (for example a copyright takedown), we may remove the content and tell you why.

8. AI features

Pherox does not use AI features in the Tradesman tier, which is the only tier available at launch.

The Builder tier, which is not yet generally available, will include an AI-assisted feature. Full terms governing the AI feature, including your verification responsibility and limits on AI output reliability, will be added to these Terms before that tier ships.

9. Intellectual property

Pherox is ours. Pherox, the service, the software, the trade marks, the design, the documentation, the pricing knowledge base and assemblies, and everything we have built (other than your content) belongs to us or to our licensors. We grant you a limited, non-exclusive, non-transferable, revocable licence to use the service in accordance with these Terms and for the duration of your subscription.

Trade marks. "Pherox" and our logo are trade marks of Pherox Technologies Ltd. You may not use them without our written permission, except to refer to the service factually.

Feedback. If you give us feedback, suggestions, ideas, or bug reports about Pherox, we can use them in any way without restriction or obligation to you. You assign to us any rights you have in feedback.

10. Confidentiality

We may share confidential information with each other from time to time. Each of us agrees to:

Use the other's confidential information only for the purpose of these Terms
Protect it with at least the same care as our own confidential information
Not disclose it except to people who need to know and who are under similar confidentiality obligations

This does not apply to information that is public, already known, independently developed, or required to be disclosed by law.

11. Service availability

We aim to keep Pherox available 24 hours a day, seven days a week. In practice, things can go wrong: planned maintenance, third-party outages, unexpected bugs, denial-of-service attacks, internet routing problems.

Our Service Level Description (Schedule C to these Terms) sets out our availability targets and how we communicate planned maintenance.

We do not offer service credits at launch. If we materially fail to deliver the service over an extended period, your remedy is to cancel under section 16 and not pay for the period of unavailability.

12. Warranties and what we do not promise

Mutual warranties. Each of us warrants to the other that we have the legal authority to enter into these Terms.

What we promise. We will provide the service with reasonable care and skill, as required by section 49 of the Consumer Rights Act 2015. We will use commercially reasonable efforts to keep the service secure, accurate, and available.

What we do not promise. Subject to your statutory rights and to section 13, we make no other promises about the service. In particular:

The service is not error-free, will not always work uninterrupted, and may contain bugs
We do not warrant that Pherox will be fit for any particular purpose you have not explicitly told us about
We do not warrant the accuracy of the pricing knowledge base or the assemblies; these are guides, and you decide what to send to your customer

To the maximum extent permitted by law, all warranties, conditions, and other terms implied by statute or common law are excluded from these Terms (except section 49 of the Consumer Rights Act 2015 where it applies).

13. Limitation of liability

Read this section carefully. It limits what we are liable for and how much.

13.1 What we never exclude. Nothing in these Terms limits or excludes our liability for:

Death or personal injury caused by our negligence
Fraud or fraudulent misrepresentation
Anything that cannot be limited or excluded under UK law (including section 49 of the Consumer Rights Act 2015 to the extent it applies)

13.2 Types of loss we are not liable for. Subject to section 13.1, we are not liable to you for any of the following, whether in contract, tort (including negligence), under statute, or on any other basis:

Loss of profits or revenue
Loss of business, business opportunity, or anticipated savings
Loss of goodwill or reputation
Wasted time or wasted expenditure
Loss or corruption of data (although we make commercially reasonable efforts to back it up)
Any indirect, consequential, special, or incidental loss

13.3 Liability cap. Subject to section 13.1, our total aggregate liability to you for all claims arising out of or in connection with these Terms in any 12-month period is limited to the greater of:

£100; or
The fees you have actually paid to us for the service in the 12 months immediately before the event giving rise to the claim.

13.4 You acknowledge. You acknowledge that these limits are reasonable in the circumstances, including the fact that the service is offered at the prices set out in section 4, that the service is offered to many customers on the same terms, and that you have the opportunity to take out your own insurance against losses we exclude.

14. Your indemnity to us

You will indemnify us against any loss, damage, cost, or expense (including reasonable legal costs) we suffer as a result of any third-party claim arising out of:

Your breach of these Terms
Your breach of the law
Your content, including any claim that your content infringes a third party's rights
Your contract with your customer (which Pherox is not a party to)
Anything you do or fail to do that causes harm to a third party

We will tell you promptly if we receive such a claim, give you reasonable control of the defence (subject to our right to participate at our cost), and reasonably cooperate at your cost.

15. Suspension

We can suspend your access to all or part of the service, without notice if necessary, if:

We reasonably believe you are using Pherox in breach of these Terms or the Acceptable Use Policy
We reasonably believe you are using Pherox to break the law or harm others
A payment for the service has failed and remains unpaid after our retry process (see section 4)
We have a legal obligation to suspend the service
There is a security threat to the service or to other users that we need to contain

Where it is reasonable, we will tell you why and give you a chance to put things right. Where the suspension is not your fault, your remedy is set out in section 11.

16. Term, cancellation, and termination

Term. These Terms apply from the moment you create an account, and continue until your account is closed.

You cancelling. You can cancel at any time from your account settings, or by emailing team@pherox.co.uk. Cancellation takes effect at the end of your current paid period. You keep access until then. We do not refund partial months (your statutory rights are not affected).

Us cancelling. We can close your account on 30 days' written notice for any reason. We can close your account immediately for material or repeated breach of these Terms, for non-payment, or for the reasons listed in section 15.

What happens to your data. When your account is closed:

We will keep your data for 30 days so you can ask us to restore it. After 30 days, we delete or anonymise it.
Some records are kept longer where the law requires (for example billing and tax records for 6 years).
You can ask for an export of your data before the 30 days are up, and we will provide it in a machine-readable format where we reasonably can.
The Privacy Policy section 8 lists the full retention regime.

Survival. Sections that by their nature should survive termination do so. These include sections 6 (customers' data), 7 (your content and responsibility), 9 (intellectual property), 10 (confidentiality), 12 (warranties), 13 (liability), 14 (indemnity), and 18 to 21 (general clauses).

17. Changes to these Terms

We can change these Terms from time to time. We will tell you about changes by email and by posting the new Terms at pherox.co.uk/terms.

Material changes (for example a change to fees, a change to how the AI feature works when it ships, a change to the liability provisions) take effect 30 days after we notify you. If you do not agree, cancel under section 16 before the change takes effect; otherwise, you are deemed to accept the change by continuing to use Pherox.

Non-material changes (for example fixing a typo, clarifying a sentence, restructuring a section) take effect immediately. We will still tell you they have happened.

We always keep a copy of previous versions of the Terms. Email team@pherox.co.uk for one.

18. Notices

From us to you. Notices from us to you are valid if sent by email to the email address on your account, or if posted prominently in the service.

From you to us. Notices from you to us are valid if sent by email to team@pherox.co.uk, or by post to Pherox Technologies Ltd, 195 Manchester Road, London E14 3DR.

Email notices are deemed received on the day they are sent.

19. Force majeure

Neither of us is liable for failure to perform under these Terms (other than payment obligations) to the extent the failure is caused by events outside our reasonable control, including:

Acts of God, fires, floods, earthquakes, severe weather
War, terrorism, civil unrest
Strikes, labour disputes (other than those involving our own staff)
Pandemics or public health restrictions
Failures of the public internet, of third-party hosting, or of utilities
Cyber attacks despite reasonable security measures
Changes in law

We will tell each other as soon as we reasonably can and use reasonable efforts to mitigate. If the event continues for more than 30 days, either of us can cancel under section 16.

20. General

Entire agreement. These Terms, including the Schedules attached (Schedule A: Data Processing Agreement; Schedule B: Acceptable Use Policy; Schedule C: Service Level Description), together with the Privacy Policy and the Cookie Policy referenced in them, are the entire agreement between us about the service. They replace anything we have said or written before.

Severability. If any part of these Terms is found unenforceable, the rest stays in force. We will replace the unenforceable part with the closest enforceable equivalent.

Waiver. If we do not enforce a right under these Terms, that is not a waiver of the right. We can still enforce it later.

Assignment. You cannot assign or transfer these Terms without our written permission. We can assign or transfer these Terms to a successor business (for example if Pherox is sold or restructured), and we will tell you if we do.

Third-party rights. No one other than you and us has any rights under these Terms. The Contracts (Rights of Third Parties) Act 1999 does not apply.

Relationship. Nothing in these Terms makes either of us a partner, agent, employee, or joint-venturer of the other. We act as independent contractors.

21. Governing law and disputes

These Terms are governed by the law of England and Wales.

If we have a dispute we cannot resolve through good-faith discussion, the courts of England and Wales have exclusive jurisdiction.

Before bringing a court claim, please contact us at team@pherox.co.uk. We would like the chance to put things right.

22. How to contact us

Email: team@pherox.co.uk

Post: Pherox Technologies Ltd, 195 Manchester Road, London E14 3DR

Schedules

The following Schedules form part of these Terms:

Schedule A: Data Processing Agreement
Schedule B: Acceptable Use Policy
Schedule C: Service Level Description

Schedule A: Data Processing Agreement

This Schedule forms part of the Terms of Service between you and Pherox Technologies Ltd. The effective date of this Schedule is the same as the effective date of the Terms.

Summary

When you use Pherox to quote a job for one of your customers (a homeowner or a commercial counterparty), you enter their personal data into Pherox.

Under UK data protection law:

You are the Controller of that data. You decide why and how it is used.
We are the Processor. We process that data only on your instructions, only to provide Pherox to you.

This Data Processing Agreement (DPA) sets out the terms of that arrangement. It is required by Article 28 of the UK GDPR and forms part of the Terms of Service (these Terms) as Schedule A.

If anything here is unclear, email us at team@pherox.co.uk before you accept it.

1. Parties

This DPA is between:

Pherox Technologies Ltd, a company registered in England and Wales (company no. 17181975), registered office 195 Manchester Road, London E14 3DR ("we", "us", "our", or "the Processor"); and
You, the customer named on your Pherox account ("you", "your", or "the Controller").

Together we are "the parties".

2. Definitions

In this DPA, unless the context requires otherwise:

"Applicable Data Protection Law" means the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), and any other law applying to the processing of personal data in the United Kingdom.
"Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "Processing", "Special Category Data", "Sub-processor" have the meanings given to them in the UK GDPR.
"Customer Personal Data" means Personal Data that we Process on your behalf as your Processor under this DPA. The categories of Customer Personal Data, the categories of Data Subjects, and the nature and purpose of Processing are set out in Annex 1.
"Services" means the Pherox service provided to you under the Terms of Service.
"Sub-processor" means any third party we engage to Process Customer Personal Data on our behalf.

Other capitalised terms are defined where they first appear.

3. Scope and purpose

This DPA applies to all Processing of Customer Personal Data that we carry out on your behalf in providing the Services. It does not cover:

Personal Data we Process about you as our customer (which we Process as a Controller; see our Privacy Policy at pherox.co.uk/privacy).
Personal Data Processed by you for your own business purposes outside Pherox.
Personal Data your customers provide directly to you outside Pherox.

This DPA forms part of, and is incorporated by reference into, the Terms of Service. If there is a conflict between this DPA and the main body of the Terms in relation to the Processing of Customer Personal Data, this DPA wins.

4. Roles of the parties

You are the Controller of Customer Personal Data. You decide the purposes and means of Processing it. You are responsible for:

Having a lawful basis under Applicable Data Protection Law to Process Customer Personal Data
Giving the Data Subjects (your customers) the privacy information they are entitled to
Responding to Data Subject rights requests (with our reasonable assistance as set out in section 9)
Not entering into Pherox any Personal Data you are not entitled to Process

We are the Processor of Customer Personal Data. We Process it only on your documented instructions, only for the purposes set out in this DPA and in Annex 1, and only as needed to provide the Services to you.

You acknowledge that we do not make decisions about the Customer Personal Data on your behalf. We do not determine who you quote, what you quote them for, what price you quote, or whether to send any output to anyone. Those decisions are yours.

5. Processing instructions

We will Process Customer Personal Data only on your documented instructions. Your instructions are:

The instructions set out in this DPA, including Annex 1
The instructions implied by your use of the Services (for example, when you create a quote in Pherox, you are instructing us to store it, transmit it, generate a PDF from it, and make it available to you)
Any other written instructions you give us at team@pherox.co.uk

We may Process Customer Personal Data outside your instructions only where we are required to by UK or EU law. If we are required to do this, we will tell you before Processing where the law allows.

If we believe an instruction from you breaches Applicable Data Protection Law, we will tell you and we may refuse to follow it.

6. Confidentiality

We will ensure that any person we authorise to Process Customer Personal Data:

Has committed to keep the data confidential, or is under an appropriate statutory duty of confidentiality
Is given access only to the data they need to do their job
Has been given suitable training in data protection

7. Security

We will implement appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

The measures we have in place are described in Annex 2.

We may update these measures from time to time, provided that the level of protection is not reduced below the standard required by Applicable Data Protection Law.

8. Sub-processors

Your general authorisation. You generally authorise us to engage Sub-processors to Process Customer Personal Data, subject to the conditions in this section.

Current Sub-processors. Our current Sub-processors are listed at pherox.co.uk/sub-processors. A snapshot is set out in Annex 3.

Notice of changes. We will give you at least 30 days' notice before adding a new Sub-processor or replacing an existing one, by:

Updating the page at pherox.co.uk/sub-processors, and
Notifying you by email or in-app

Your right to object. If you reasonably object to a new Sub-processor on data protection grounds, tell us within the 30-day notice period at team@pherox.co.uk. We will discuss in good faith. If we cannot agree, you can cancel the affected part of the Services under section 16 of the Terms, with no further charge for the unaffected paid period.

Our responsibility. We remain fully liable to you for the acts and omissions of each Sub-processor as if they were our own. We will impose contractual obligations on each Sub-processor that are equivalent in substance to the obligations in this DPA.

9. Data Subject requests

If a Data Subject (typically one of your customers) contacts you to exercise their rights under Applicable Data Protection Law (right of access, right to rectification, right to erasure, right to restrict processing, right to data portability, right to object, right to withdraw consent), you handle the request as the Controller.

We will:

Not respond to Data Subject requests addressed to us, except to direct the Data Subject to you and to tell you about the request
Provide reasonable assistance to help you respond, taking into account the nature of the Processing and the information available to us
Make available, on your reasonable request, the tools we have to help you respond (for example, the ability to export, correct, or delete Customer Personal Data from within Pherox)

If responding to a request requires us to do work beyond reasonable assistance, we may charge you our reasonable costs, agreed in advance.

10. Other assistance to you

We will provide you with reasonable assistance to help you comply with your obligations under Articles 32 to 36 of the UK GDPR (security, breach notification to the ICO, breach notification to Data Subjects, Data Protection Impact Assessments, and prior consultation with the ICO), taking into account the nature of the Processing and the information available to us.

In particular, where you carry out a Data Protection Impact Assessment in relation to the Services or a feature of them, we will, on reasonable request:

Provide you with information about the Processing
Cooperate with you in good faith
Where appropriate, share with you any Data Protection Impact Assessment we have already carried out for the same Processing

If responding to a request requires us to do work beyond reasonable assistance, we may charge you our reasonable costs, agreed in advance.

11. Personal Data Breaches

If we become aware of a Personal Data Breach affecting Customer Personal Data, we will:

Notify you without undue delay, and in any event within 72 hours of our becoming aware
Give you, as soon as we reasonably can, all the information you need to meet your obligations under Articles 33 and 34 of the UK GDPR, including:
- The nature of the breach
- The categories and approximate number of Data Subjects affected
- The categories and approximate number of records affected
- The likely consequences
- The measures we have taken or propose to take to address the breach and mitigate its effects
Cooperate with you to investigate, contain, and remediate the breach
Keep a record of the breach and our response

12. International data transfers

You authorise us to transfer Customer Personal Data outside the United Kingdom where reasonably necessary to provide the Services, subject to appropriate safeguards.

We will only transfer Customer Personal Data outside the UK where one of the following applies:

The recipient is in a country covered by a UK adequacy decision (currently including the European Economic Area)
The recipient is certified under the UK Extension to the EU-US Data Privacy Framework, and the transfer is within scope of that certification
The transfer is subject to the UK International Data Transfer Agreement (UK IDTA) or the EU Standard Contractual Clauses with the UK Addendum, with a Transfer Risk Assessment on file
Another valid Article 46 UK GDPR transfer safeguard applies
A derogation under Article 49 of the UK GDPR applies

The transfer mechanism for each Sub-processor is set out at pherox.co.uk/sub-processors (Annex 3).

If a transfer mechanism is invalidated (for example by a court decision or regulator action), we will switch to an alternative valid mechanism as soon as reasonably practicable, or stop the transfer.

13. Audits and information

You have the right to audit our compliance with this DPA. We satisfy that right as follows:

Written information. On your reasonable written request (no more than once in any 12-month period, unless required by a regulator or following a Personal Data Breach), we will provide you with information necessary to demonstrate our compliance with this DPA. That information may include:

A summary of our technical and organisational measures
The results of any third-party security audits or certifications we hold
A summary of our Sub-processor due diligence
A summary of any Personal Data Breaches affecting your Customer Personal Data

Third-party reports. Where we hold third-party security audits or certifications, we will share the relevant reports with you, subject to your reasonable confidentiality undertakings.

On-site audits. You may carry out an on-site audit only where:

A regulator (including the ICO) specifically requires it
A material Personal Data Breach has occurred affecting your Customer Personal Data, and written information is reasonably insufficient
We agree in advance to an on-site audit on reasonable terms

For any on-site audit, you will give us at least 30 days' written notice (or such shorter notice as a regulator requires), conduct the audit during business hours, minimise disruption, and bear your own costs and ours.

14. Deletion or return of Customer Personal Data

When the Services end, or when you ask us to (whichever is sooner), we will:

Make Customer Personal Data available to you for export for 30 days, in a structured, commonly used and machine-readable format where reasonably possible
After 30 days, delete or anonymise Customer Personal Data from our active systems, except as set out below
Delete Customer Personal Data from our backups in line with our backup rotation cycle (currently a rolling cycle of up to 7 days)

We may retain Customer Personal Data after the end of the Services where:

We are required by law to do so (for example for tax or accounting records)
It is necessary for us to establish, exercise, or defend legal claims

We will keep retained data subject to the same security measures and process it only for the retention purpose.

On your reasonable written request after the Services end, we will certify in writing that we have complied with our deletion obligations.

15. Liability

The limitations and exclusions of liability set out in section 13 of the Terms apply to this DPA, including the cap on total aggregate liability. They apply once across the Terms and this DPA combined, not separately for each.

Nothing in this DPA limits or excludes either party's liability where the law does not permit such a limit or exclusion, including for death or personal injury caused by negligence, fraud, or fraudulent misrepresentation.

16. Term

This DPA takes effect when you accept the Terms (or when you start using the Services, whichever is earlier) and continues until the Services end. The obligations that by their nature should survive (including sections 11, 13, 14, and 15) do so.

17. Changes

We may change this DPA from time to time. We will tell you about changes by email and by posting the new version at pherox.co.uk/terms, in line with section 17 of the Terms.

We will not make a change that would materially reduce the protection of Customer Personal Data below the standard required by Applicable Data Protection Law.

If you reasonably object to a material change on data protection grounds, the same right-to-object and cancellation process applies as for Sub-processor changes (section 8).

18. General

Governing law and jurisdiction. Section 21 of the Terms applies: England and Wales, exclusive jurisdiction of the English courts.
Notices. Section 18 of the Terms applies.
Severability, waiver, assignment. Section 20 of the Terms applies.
Conflicts. Where this DPA conflicts with the main body of the Terms in relation to the Processing of Customer Personal Data, this DPA wins.
Order of precedence within this DPA. Where the main body of this DPA conflicts with an Annex, the Annex wins for matters specific to it; otherwise the main body wins.

19. How to contact us

Data Protection queries: team@pherox.co.uk (with "DPA" in the subject line)

Post: Data Protection Lead, Pherox Technologies Ltd, 195 Manchester Road, London E14 3DR

Annex 1: Details of Processing

Subject matter of the Processing
Provision of the Pherox service: a mobile-first quoting and job-management platform for UK tradespeople.

Duration of the Processing
For the term of the Services (while you have an active Pherox account), plus the retention periods set out in section 14 of this DPA.

Nature of the Processing
Collection, storage, transmission, organisation, structuring, alteration, retrieval, use, disclosure (to Sub-processors), restriction, erasure, and destruction.

Purpose of the Processing
To enable you to use Pherox to quote, manage, and document jobs for your customers, including:

Storing details of your jobs and customers
Generating customer-facing PDF quotes
Sending PDF quotes from your account to your customers
Tracking job status, communications, and invoicing

Types of Personal Data

Customer name (typically the homeowner or commercial counterparty)
Customer contact details (email, phone, where you enter them)
Property address or job-site address
Job descriptions, including any descriptions of the customer's premises or requirements
Pricing information associated with the customer
Any other Personal Data you choose to enter into a job record

Categories of Data Subjects

Your customers (typically homeowners, but also commercial counterparties where you sub-contract under a main contractor)
Any other individuals whose Personal Data you choose to enter into Pherox (for example, additional contacts at a customer property)

No Special Category Data or criminal-offence data. Pherox is not designed to process Special Category Data or data relating to criminal convictions and offences. You will not enter such data into Pherox.

Annex 2: Technical and Organisational Measures

This Annex describes the technical and organisational security measures we implement to protect Customer Personal Data, as required by Article 32 of the UK GDPR. We review and update these measures from time to time.

Encryption

All Customer Personal Data is encrypted in transit using current industry-standard TLS (HTTPS).
Customer Personal Data at rest in our application database is encrypted using current industry-standard encryption (AES-256 or equivalent).
Backups are encrypted at rest.

Access controls

Access to production systems is restricted to a small number of authorised personnel on a need-to-know basis.
All administrative access requires multi-factor authentication.
User access to the Services is via passwordless magic-link authentication (one-time link to a verified email address).
Access to Customer Personal Data is logged.
Access is revoked promptly when personnel leave or no longer require it.

Network security

Production infrastructure is protected by firewalls, web application firewalls, and bot/abuse protection at the edge.
Production is segregated from development and staging environments.
Public endpoints are rate-limited.

Application security

The Pherox application is developed with secure-coding practices.
Dependencies are kept current; known vulnerabilities are patched on a risk-based schedule.
Security review is built into the development lifecycle.
Public reporting of vulnerabilities is supported via our Responsible Disclosure policy at pherox.co.uk/security.

Backups and resilience

Customer Personal Data is backed up daily and retained on a rolling basis for up to 7 days; we do not currently operate point-in-time recovery.
Backups are encrypted at rest and stored separately from production.
Recovery procedures are documented and tested.

Sub-processors

All Sub-processors are subject to due-diligence review before engagement.
Sub-processors are subject to contractual obligations equivalent in substance to this DPA.
International transfers to Sub-processors are subject to the safeguards set out in section 12.

Incident response

We maintain a documented incident-response process covering detection, containment, eradication, recovery, and post-incident review.
Personal Data Breaches affecting Customer Personal Data are notified to the affected Controller within 72 hours of our becoming aware, as set out in section 11.

Personnel

All personnel with access to Customer Personal Data are bound by confidentiality obligations.
Personnel receive data protection training appropriate to their role.

Physical security

We do not operate our own physical data centres. All hosting is via Sub-processors who maintain industry-standard physical security at their facilities.

Governance

A senior Data Protection Lead is accountable for compliance with Applicable Data Protection Law and this DPA.
We maintain a Record of Processing Activities under Article 30 of the UK GDPR.

Annex 3: Approved Sub-processors

The current list of approved Sub-processors is published at pherox.co.uk/sub-processors, which is updated whenever a Sub-processor is added, changed, or removed, with at least 30 days' prior notice as set out in section 8.

A snapshot at the date of this DPA is set out below. The live page takes precedence.

Sub-processor	Purpose	Location	Transfer mechanism (if outside UK)
Supabase Pte. Ltd. (Singapore)	Database and backend hosting; stores account data and all Customer Personal Data	London, eu-west-2 (UK)	EU Standard Contractual Clauses with the UK Addendum (ICO Approved Addendum B.1.0)
Fly.io, Inc.	Application hosting; runs the Pherox backend	London (LHR)	UK Extension to EU-US Data Privacy Framework (DPF-certified)
Cloudflare, Inc.	Frontend and marketing-site hosting; CDN, WAF, and edge protection; does not host the application database or backend code	Global edge	UK Extension to EU-US Data Privacy Framework
Stripe Payments Europe Ltd / Stripe, Inc.	Subscription billing, payment processing	Ireland and United States	UK adequacy (Ireland); UK Extension to EU-US DPF (US)
Resend, Inc.	Transactional email delivery	United States	UK Extension to EU-US Data Privacy Framework
Twilio Ireland Limited (Twilio Verify)	Phone verification at sign-up (anti-abuse one-time-passcode gate)	Ireland	UK adequacy decision (EEA)
Google LLC (Google Workspace)	team@pherox.co.uk mailbox and support correspondence	United States	UK Extension to EU-US Data Privacy Framework
Functional Software, Inc. (Sentry)	Error monitoring and crash reporting	European Union (Frankfurt)	UK Extension to EU-US Data Privacy Framework (DPF-certified)

Planned (not yet active): analytics and A/B testing are not active at launch. Plausible (EU), Google GA4 (US), Microsoft Clarity (US), and GrowthBook (US) are planned post-launch and will be added with notice when activated. The live page at pherox.co.uk/sub-processors takes precedence.

For each Sub-processor we maintain (and provide on reasonable request):

The contractual data protection terms in place
The transfer mechanism (where outside the UK)
A Transfer Risk Assessment (where applicable)
A description of the security measures and certifications the Sub-processor holds

Schedule B: Acceptable Use Policy

This Schedule forms part of the Terms of Service between you and Pherox Technologies Ltd. The effective date of this Schedule is the same as the effective date of the Terms.

Summary

This Acceptable Use Policy ("AUP") sets out what you can and cannot do with Pherox. It applies to everyone who uses the service, on every paid tier and during the free trial.

The short version:

Use Pherox to run your trades business honestly
Do not break the law with it
Do not misrepresent your trade credentials to customers
Do not interfere with our security or with other users
Treat your customers' data responsibly; you are the controller of it

If you break these rules, we can suspend or close your account under sections 15 and 16 of the Terms, and we may report serious breaches to the police or relevant regulators.

If you see someone else breaking these rules, tell us at team@pherox.co.uk with "Abuse" in the subject line.

1. Who this AUP applies to

This AUP forms part of, and is incorporated into, the Terms of Service. It applies to:

Every user of Pherox, on every paid tier and during the free trial
Everyone who visits our websites or uses our apps
Anyone using your Pherox account, whether or not you have authorised them

You are responsible for making sure everyone who uses your account complies with this AUP.

2. What you must not do

You must not use Pherox, our websites, or our apps to do any of the things in this section. The lists are examples and are not exhaustive; we apply this AUP using reasonable judgment.

2.1 You must not break the law

You must not use Pherox to:

Do anything illegal under UK law
Commit fraud, theft, or other dishonesty offences
Launder money or evade tax
Conduct work without the licences, certifications, or insurance required for that work
Breach health and safety law
Breach UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, or any other applicable data protection law
Breach the Consumer Rights Act 2015, the Consumer Protection from Unfair Trading Regulations 2008, or other consumer protection law
Infringe anyone else's intellectual property rights

2.2 You must not misrepresent yourself or your trade

This is the rule we take most seriously, because misrepresenting your trade credentials directly harms your customer.

You must not:

Display a Gas Safe registration number, NICEIC registration, FENSA / CERTASS registration, MCS certification, or any other trade registration on a Pherox-generated quote unless you genuinely hold that registration and it is current
Display a UK Trustmark, TrustATrader badge, Checkatrade rating, Which? Trusted Trader status, or any other trust mark unless you genuinely hold it
Display professional indemnity, public liability, or other insurance details unless the cover is genuinely in force
Claim qualifications, training, or certifications you do not hold
Impersonate another tradesperson or trading name
Trade through Pherox under a business name you have no right to use
Make any representation in a Pherox-generated quote that is materially false or misleading to your customer

If we have a reasonable basis to believe you have misrepresented your credentials, we will suspend your account and we may report you to the relevant regulator (Gas Safe, the NICEIC, Trading Standards, the relevant insurer, the police) and to any customer affected.

2.3 You must not misuse other people's data

Your customers' personal data is theirs. You are the data controller of it under our Data Processing Agreement (Schedule A to the Terms).

You must not use Pherox to:

Enter personal data about anyone unless you have a lawful basis under UK GDPR to process it
Enter special category data (health, religion, biometric data and the like) that Pherox is not designed to handle
Send Pherox-generated quotes to people who have asked you to stop contacting them
Sell, share, or otherwise transfer your customers' personal data through Pherox to anyone who does not need it
Use Pherox to harass, intimidate, or stalk anyone

2.4 You must not interfere with the service or our security

You must not:

Try to access parts of the service you are not paid for, or work around tier limits, rate limits, or feature gates
Try to gain unauthorised access to anyone else's account
Use automated tools (bots, scrapers, crawlers) to access the service in a way that disrupts it or accesses data you should not have
Reverse-engineer, decompile, or copy the service, except where UK law specifically allows it
Probe, scan, or test the vulnerability of any Pherox system without permission (if you want to report a security issue, follow our Responsible Disclosure policy at pherox.co.uk/security)
Distribute malware, viruses, worms, or anything else designed to harm or disrupt the service
Conduct denial-of-service attacks, or anything that interferes with the service's availability or performance
Forge headers, sender details, or other identifiers to disguise the origin of any content sent through Pherox
Use the service in a way that imposes an unreasonable load on our infrastructure relative to the tier you are on

2.5 You must not abuse the account model

You must not:

Share your account, your sign-in link, or your magic-link email with anyone else
Operate multiple accounts to work around tier limits or pricing
Resell, sub-license, or otherwise commercialise access to your account to third parties without our written permission
Continue to use Pherox after we have closed your account for AUP breach, by signing up for a new account in a different name

2.6 You must not upload prohibited content

You must not upload, store, or send through Pherox any content that:

Is unlawful, defamatory, threatening, harassing, obscene, indecent, or hateful
Infringes someone else's intellectual property, privacy, publicity, or other rights
Promotes violence, terrorism, illegal activity, or self-harm
Contains malware or other harmful code
Contains content sexually involving anyone under 18
You do not have the right to upload, store, or send

3. Specific rules for Pherox-generated PDFs

Every PDF quote that Pherox generates carries our standard footer, including our trading disclosures.

You must not:

Remove, alter, hide, or obscure the Pherox-generated footer or any disclaimer it contains
Add content to a Pherox-generated PDF outside the spaces the service provides for your own content, in a way that could mislead a recipient about the source or status of the document
Forge or alter Pherox-generated PDFs to misrepresent prices, quantities, dates, parties, or other content after the PDF has been sent to your customer

If you want to make changes to a quote after sending it, generate a revised version in Pherox and send that. Do not edit the PDF outside Pherox.

4. What happens if you break this AUP

We apply this AUP using reasonable judgment, with a graduated response where appropriate.

Minor or first-time issues. We may contact you, explain what is wrong, and ask you to put it right within a reasonable time.

More serious or repeated issues. We may suspend your account under section 15 of the Terms while we investigate. We will tell you why, and give you a chance to respond, where it is reasonable to do so.

Serious or repeated breaches. We may close your account under section 16 of the Terms. We will tell you why.

Immediate suspension or termination, without prior warning, may follow:

A serious security threat to the service or to other users
A clear breach of section 2.1 (illegal use) or section 2.2 (trade misrepresentation) where customers are being or are about to be harmed
Any breach that exposes us to legal or regulatory liability if we do not act immediately
A court order, regulator direction, or legal obligation to suspend or terminate

When we suspend or terminate an account for AUP breach:

We do not refund any prepaid fees for the affected period
Section 16 of the Terms governs what happens to your data
We may report the breach to the police, to Trading Standards, to relevant trade regulators (Gas Safe, NICEIC, etc.), to relevant trust marks, and to any customer who has been harmed
We may cooperate with any legal process

For the avoidance of doubt, our right to enforce this AUP does not limit any of our other rights under the Terms or under the law.

5. Reporting abuse

If you think someone is using Pherox in a way that breaks this AUP, tell us at team@pherox.co.uk with the subject line "Abuse".

Include:

The Pherox account or business name you are reporting (if you know it)
What they have done, in plain English
Any evidence you can share (screenshots, PDFs, emails)
Your contact details, so we can ask follow-up questions

We will acknowledge your report within 5 business days. We will investigate and act where appropriate, but we cannot promise a specific outcome and we will not generally share the details of our investigation with you. If you reported the issue in your capacity as a victim, we will let you know the high-level outcome where we reasonably can.

If you are reporting suspected criminal activity, please also contact the police or Action Fraud (actionfraud.police.uk).

6. Changes to this AUP

We may update this AUP from time to time. Changes are governed by section 17 of the Terms.

In particular:

Material changes (for example a new prohibition that affects what you can do) take effect 30 days after we notify you
Non-material changes (for example clarifying language, adding examples) take effect immediately
We always keep previous versions on request

7. How to contact us

Reporting abuse: team@pherox.co.uk (subject "Abuse")

General questions: team@pherox.co.uk

Security issues: see our Responsible Disclosure policy at pherox.co.uk/security

Post: Pherox Technologies Ltd, 195 Manchester Road, London E14 3DR

Schedule C: Service Level Description

This Schedule forms part of the Terms of Service between you and Pherox Technologies Ltd. The effective date of this Schedule is the same as the effective date of the Terms.

Applies to: the Tradesman tier (the only paid tier at launch). Multi-Trade and Builder tiers will be added in future. Service levels for those tiers will be added to this document before they ship.

Summary

This Schedule describes the service levels we aim to provide on Pherox. It covers:

Uptime targets (how often Pherox is available)
Support response times (how quickly we get back to you)
Planned maintenance (when we take the service down on purpose)
Incident communication (how we tell you when something is wrong)

This is a service-level description, not a service-level agreement with credits. We do not pay you back when we miss a target at launch. If we materially fail to deliver the service over an extended period, your remedy is to cancel under section 16 of the Terms and stop paying for the period of unavailability. Your statutory rights are not affected.

1. Scope

This Service Level Description applies to:

The Pherox application at app.pherox.co.uk
The Pherox marketing site at pherox.co.uk (informational; counted within the targets below)
Paid Tradesman features

It does not apply to:

The 14-day free trial (provided "as-is")
Beta or preview features that are explicitly labelled as such
Third-party services Pherox connects to (Stripe billing pages, your email client, your browser's behaviour)
Anything caused by your own infrastructure, network, or device

2. Availability target

We aim to make Pherox available 24 hours a day, 7 days a week. In practice things go wrong from time to time. The target below is what we aim for on the Tradesman tier, measured as a monthly average.

Tier	Monthly uptime target
Tradesman (£27/mo)	99.5%

For context:

99.5% allows up to about 3 hours 39 minutes of unavailability in a 30-day month

This is a target, not a contractual commitment. We track it, and we will tell you honestly when we have missed it. (A public status page where we publish uptime is planned; until it is live, we report by email.)

3. How we measure availability

We measure availability as the percentage of time in a calendar month that the Pherox application responds to a healthy request from our monitoring service. The monitoring service runs checks at least every minute from multiple UK locations.

The service is "available" when:

A user can sign in
A user can load the application
A user can read, create and edit jobs and quotes
A user can generate a PDF

The service is "unavailable" when one or more of the above is materially broken for users across regions, not just for a single account or a small subset.

Degraded performance (the service is slow but working) does not count as unavailability for the purposes of this document, but we track it separately and treat sustained degradation as a serious incident.

4. What does not count as downtime

Time during the following situations does not count against our uptime target:

Planned maintenance within the notice period in section 5
Emergency maintenance required to address a security incident or material risk to the service, with the shortest possible notice we can reasonably give
Events outside our reasonable control (force majeure, as set out in section 19 of the Terms): third-party outages of Supabase, Fly.io, Cloudflare, Stripe, or other sub-processors; internet routing failures; large-scale DDoS attacks despite reasonable defences; acts of God; government actions
Your own issues: your internet connection, your device, your browser, our service being unreachable from your specific network for reasons not on our side
Breach by you: time during which your account is suspended under section 15 of the Terms or the Acceptable Use Policy (Schedule B to the Terms)
Beta features that are explicitly labelled as such

5. Planned maintenance

We schedule planned maintenance outside UK business hours where reasonably possible: typically early Saturday or Sunday mornings (UK time).

We give at least 24 hours' notice before planned maintenance, by:

Emailing you at the address on your account (for maintenance windows expected to last more than 30 minutes)
Showing an in-app notice where appropriate

A public status page (status.pherox.co.uk) is planned; until it is live, we give maintenance notice by the channels above.

If we need emergency maintenance to address a security issue or material risk, we give whatever notice we can reasonably manage and explain in the incident communication afterwards.

6. Support response targets

We aim to respond to support requests within the timescales below, measured during UK business hours (Monday to Friday, 9am to 5pm UK time, excluding UK bank holidays).

Tier	First response target	Severity 1 (service down) target
Tradesman (£27/mo)	2 business days	1 business day

"First response" means a human at Pherox has read your message and replied to it. It does not necessarily mean we have fixed your issue; complex issues take longer to investigate and resolve.

"Severity 1" means the service is unavailable, you cannot sign in, you cannot generate a quote, or another problem is preventing you from running your trade. If you have a Severity 1 issue, email us at team@pherox.co.uk with "URGENT" at the start of the subject line.

If we are going to miss a target, we tell you we are going to miss it before we miss it, and we tell you why.

7. Support channels and hours

At launch we offer email-only support at team@pherox.co.uk, during UK business hours.

We do not offer:

A phone line at launch (we cannot guarantee picking up consistently with a small team; email is honest while we are this size)
Live chat
24/7 support
Dedicated account managers

We expect to add phone support and other channels as the team grows. When we do, the targets in section 6 will be updated.

8. Incident communication

When something goes wrong, here is how we tell you.

Status page (planned). A public status page at status.pherox.co.uk is planned but not yet live; until it is live, we communicate incidents by email and in-app banner (below). When the status page is live, we will update it in real time during incidents, classifying them as:

Investigating (we have noticed a problem and are looking into it)
Identified (we know what is wrong)
Monitoring (we have applied a fix and are watching it)
Resolved (the issue is over)

Email. For incidents that affect the service and last more than 30 minutes, we email all affected users with:

What is happening
What we are doing about it
When we will next update you

In-app banner. Where the service is partially available, we show an in-app banner so you know not to expect normal performance.

Post-incident report. For incidents that affect users for more than 1 hour, we publish a brief post-incident report within 5 business days (by email, and on the status page once it is live), covering:

What happened
The impact
The root cause (where we have established it)
What we are doing to prevent recurrence

9. What happens if we miss a target

We do not offer service credits at launch. This is honest pricing: the £27/mo Tradesman fee is set on the basis that we are not running an enterprise-grade credit-bearing SLA. We may introduce credits in future for one or more tiers; we will update this document and tell you if we do.

Where we materially fail to deliver the service over an extended period, your remedies are:

Cancel under section 16 of the Terms. You stop paying for the affected period. We will pro-rate the refund where appropriate.
Statutory remedies. Nothing in this document limits any rights you have under UK law, including under the Consumer Rights Act 2015 (where it applies to you) for services not provided with reasonable care and skill.

10. Service evolution

This is launch-stage Pherox. We expect to:

Tighten the uptime target as our infrastructure matures
Add phone support during UK business hours
Add 24/7 support coverage for higher tiers when those tiers ship
Introduce service credits for one or more paid tiers
Add more granular incident categorisation
Add live chat as the team grows

When we make these changes, we will update this document. Material improvements take effect immediately (you do not need to opt in to a better service). Material reductions follow the 30-day notice process in section 17 of the Terms.

11. Changes to this document

Material changes to this document (for example a reduction in an uptime target, or a change to support hours) follow the 30-day notice process in section 17 of the Terms.

Material improvements (tighter targets, faster response, longer hours, new channels) take effect immediately on publication.

Non-material changes (typos, clarifications) take effect immediately.

12. How to contact us

Support: team@pherox.co.uk (with "URGENT" at the start of the subject for Severity 1)

Status updates: by email and in-app banner at launch; a public status page (status.pherox.co.uk) is planned.

Post: Pherox Technologies Ltd, 195 Manchester Road, London E14 3DR