1. Parties and scope
This agreement is between the business identified in the company workspace (or the individual business operator using their own signed-in hosted workspace) and Sam Davey, trading as Sam Sam The Carpet Man (Cutting With Sam). Contact: samsamthecarpetman.est2006@gmail.com. The business controls its customer-job information; Cutting With Sam processes its hosted job records on its instructions. Our account, billing, security and support records are covered separately by our Privacy Policy.
2. What you instruct us to do
You instruct us to store, back up, synchronise, retrieve, export and delete your business job records to operate the service you select. This includes customer names and contact details, site addresses, measurements, fitting notes, product choices, plans, revisions, staff identifiers and membership records. People concerned include your staff, customers and site contacts. Processing lasts while we provide the company service and complete your return/deletion instructions. Do not enter unnecessary sensitive information. In a company workspace, your authorised members can create and edit shared Drafts and Completed jobs; the owner manages membership and job deletion. Joining does not transfer personal jobs into the company. An individual workspace is separate from staff sharing; if its business jobs are hosted, the same processing obligations apply to us and its individual business operator.
3. Your responsibilities
You decide why jobs are recorded, who may access them and how long you need them. Provide your customers with appropriate privacy information and have a lawful basis for their information. Keep membership and instructions accurate; protect staff devices and exported copies. Instructions are documented through authorised app controls or verified support requests. We will notify you if an instruction appears unlawful. We will not use your customer jobs for our advertising, sell them or use them for unrelated purposes. If law requires other processing, we will inform you unless prohibited.
4. Security and confidentiality
We will restrict access to authorised people under confidentiality duties, maintain risk-appropriate security and recovery measures, and assess those measures regularly. Company access requires verified identity and current membership. We will assist with your security obligations using information available to us. No service can guarantee uninterrupted operation or that every device or exported copy is secure. These statements do not exclude our responsibility for our own failures.
5. Providers and transfers
You authorise Google Firebase/Google Cloud as infrastructure subprocessors for authentication, protected services, storage and service security, and their applicable published subprocessors. These providers host Cutting With Sam; they do not connect customer jobs to a separate productivity service. The company-job database is configured in London; authentication and provider support may involve other countries, including the United States. We must maintain applicable processing terms and lawful UK transfer safeguards with our providers. We remain responsible for our subprocessors meeting their processing obligations. Ask support for the provider list, applicable safeguards and how to obtain a copy. We will notify the company owner before an intended subprocessor change takes effect and allow a reasonable opportunity to object on data-protection grounds. If an objection cannot be resolved, we will arrange a return/deletion and service-ending route without silently continuing the disputed processing.
6. Requests and incidents
We will assist with access, correction, deletion and other applicable rights requests, and with required impact assessments and regulator consultation, taking account of our processing and available information. Customer-job requests are referred to the business unless law requires otherwise. We will notify you of a personal-data breach without undue delay after becoming aware, give available details and provide updates so you can meet your obligations. Contact support promptly about an incident; do not send passwords or full payment-card details.
7. Return, deletion and service end
Subscription expiry alone does not delete company jobs. Authorised owners can request an export and company closure through support, with identity and ownership checks. At service end we will return or delete hosted company personal data as you choose and delete remaining copies unless UK law requires retention. Routine job deletion offers a 30-day restore window, not a promise that all backup copies vanish on day 30. Where backup deletion cannot be immediate, retained copies must be put beyond ordinary use and deleted through the applicable provider deletion cycle. We will explain the applicable completion times and any legal hold in the verified request. Do not delete your only export before checking it. You remain responsible for copies on your devices or sent to recipients.
8. Demonstrating compliance and changes
We will provide information needed to demonstrate compliance and allow and contribute to proportionate audits or inspections by you or your authorised auditor. Arrangements must protect other customers and service security without preventing your lawful rights. Neither party is relieved of its statutory responsibilities. This agreement supplements the Terms of Use and takes priority for company-job processing where they conflict. Material changes will be notified and versioned; acceptance records identify the authorised owner, company, version and server time. Each staff member separately acknowledges company-job visibility, not authority to sign this agreement for the company. For an individual business operator's own hosted workspace, this agreement is incorporated into the accepted Terms of Use. Company acceptance must still be recorded separately by the authorised company owner.
Updated 19 September 2026.