PlantDown Privacy Policy

This privacy policy explains how Josh Downer trading as PlantDown ("PlantDown", "we", "us" or "our") handles personal information in connection with the PlantDown tools, equipment and plant management service.

Privacy enquiries and data protection requests can be sent to jdownerservices@hotmail.com.

1. Our role and your organisation's role

Where an organisation uses PlantDown to manage its own users, tools, equipment, plant, locations, movements, faults, repairs and related operational records, that organisation will generally decide why that information is processed. In those circumstances the organisation is generally the data controller and PlantDown processes personal data on its behalf to provide the service.

PlantDown may separately act as a controller for information we use for our own business purposes, such as administering customer accounts, managing subscriptions, communicating with customers, maintaining security and meeting legal or accounting obligations.

2. Information we may process

Depending on how PlantDown is used, we may process:

• Account information, such as email address, user identifier, company membership and access role.
• Company information, such as company name, branding and workspace settings.
• Operational activity, such as tool or equipment movements, locations, assignments and activity-history entries associated with a user account.
• Fault and repair information, including fault descriptions, repair records and the user associated with an action.
• Subscription and billing information when paid subscriptions are introduced. Payment-card details will be handled by the payment provider rather than stored directly by PlantDown.
• Technical and security information reasonably required to operate, secure, diagnose and protect the service.
• Communications sent to us for support, privacy, billing or other business enquiries.

3. Why information is used

Information may be used to provide and secure PlantDown, authenticate users, keep company workspaces separate, record equipment activity, support fault and repair workflows, administer customer accounts and subscriptions, provide customer support, investigate technical or security issues, improve service reliability, comply with legal obligations and establish or defend legal claims where necessary.

4. Lawful bases

Where PlantDown acts as a controller, the lawful basis will depend on the processing involved. This may include processing necessary to perform a contract or take steps requested before entering a contract, compliance with a legal obligation, and our legitimate interests in operating, securing, supporting and improving the service where those interests are not overridden by individuals' rights.

Where we act only as a processor for a customer organisation, the customer is responsible for determining the appropriate lawful basis for its processing and for providing required privacy information to its users.

5. Service providers and subprocessors

PlantDown uses third-party infrastructure and service providers to operate the service. These may include Supabase for database, authentication and related backend services, and Netlify for application hosting and delivery. When subscription payments are enabled, a specialist payment provider such as Stripe may process payment and billing information.

We may also disclose information where required by law, to protect legal rights or security, or in connection with a legitimate business transfer, subject to applicable data-protection requirements.

6. International transfers

Some service providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, we will rely on an appropriate lawful transfer mechanism and applicable contractual safeguards provided by the relevant service provider.

7. How long information is kept

We keep personal information only for as long as reasonably necessary for the purpose for which it is processed, including providing the service, maintaining security and audit records, resolving disputes, and meeting legal, tax or accounting obligations. Customer-controlled workspace data will be handled in accordance with the applicable customer agreement and data-processing terms. More specific retention and deletion arrangements may be introduced as the service develops.

8. Security

We use reasonable technical and organisational measures designed to protect information. PlantDown uses authenticated accounts and company-based access controls intended to separate customer workspaces. No internet service can guarantee absolute security, and customers are responsible for protecting their account credentials and managing user access appropriately.

9. Your data-protection rights

Depending on the circumstances, UK data-protection law may give individuals rights concerning their personal information, including rights of access, correction, erasure, restriction, objection and data portability.

If the information is held in a PlantDown workspace on behalf of your employer or another customer organisation, you should normally contact that organisation first because it is generally the controller. We will assist our customer with applicable requests where required. For information PlantDown controls directly, contact us at jdownerservices@hotmail.com.

10. Complaints

Please contact us first if you have a concern about how PlantDown handles personal information. Individuals also have the right to complain to the UK Information Commissioner's Office (ICO).

11. Children

PlantDown is a business service intended for organisations and their authorised workforce. It is not designed as a consumer service for children.

12. Changes to this policy

We may update this policy when PlantDown, our suppliers or applicable legal requirements change. The latest version will be made available through the PlantDown service and will show its last-updated date.

13. Contact

Josh Downer trading as PlantDown
Privacy and data-protection enquiries: jdownerservices@hotmail.com

PlantDown Terms of Service

These Terms of Service ("Terms") govern business use of the PlantDown tools, equipment and plant management service operated by Josh Downer trading as PlantDown ("PlantDown", "we", "us" or "our"). By creating or using a company workspace, the customer agrees to these Terms.

1. Business service

PlantDown is intended for businesses and organisations managing tools, equipment, plant, locations, faults, repairs and related operational records. The person creating or administering a workspace confirms that they have authority to act for the relevant organisation.

2. Accounts and authorised users

Customers are responsible for their workspace, the users they invite, the roles and permissions they assign, and keeping account credentials secure. Accounts must not be shared in a way that defeats individual access controls or activity records. Customers should remove access promptly when a user no longer requires it.

3. Customer data

The customer retains its rights in information it enters into PlantDown. The customer gives PlantDown permission to host, process, transmit, back up and otherwise handle that information only as reasonably required to provide, secure, support and maintain the service and as otherwise set out in our agreements.

The customer is responsible for ensuring that it has the right and an appropriate lawful basis to enter and use personal information within PlantDown. Where PlantDown processes personal data on the customer's behalf, the parties' data-processing terms will apply.

4. Acceptable use

PlantDown must not be used unlawfully, fraudulently, to infringe another person's rights, to introduce malicious code, to attempt unauthorised access, to interfere with the service or another customer's data, or to circumvent security, account, subscription or usage controls.

5. Operational responsibility

PlantDown is an administrative tracking and record-management tool. It does not replace legally required inspections, maintenance procedures, risk assessments, competent-person decisions, manufacturer instructions or other safety systems. Customers remain responsible for the safe condition, inspection, operation and legal compliance of their tools, equipment and plant and for checking that records used for operational decisions are accurate and current.

6. Service availability and changes

We aim to provide a reliable service but do not promise uninterrupted or error-free availability. Access can be affected by maintenance, internet connectivity and third-party infrastructure. We may make reasonable changes to PlantDown to maintain security, comply with law, improve functionality or develop the service. Where a material change significantly affects paid customers, we will aim to provide reasonable notice where practicable.

7. Trials, subscriptions and payment

Where PlantDown offers a free trial, the applicable trial period will be shown when the customer signs up or subscribes. Paid features may require an active subscription after the trial. Prices, billing intervals and applicable taxes will be shown before a paid subscription is started.

When paid subscriptions are enabled, payments may be handled by a third-party payment provider. Unless otherwise stated at purchase, subscriptions will renew for the stated billing period until cancelled. Customers will be able to cancel in accordance with the cancellation method made available with the subscription. Cancellation stops future renewal but does not normally create a refund for a billing period already started, except where required by law or expressly agreed.

8. Suspension and termination

We may suspend or restrict access where reasonably necessary for security, suspected unlawful or abusive use, material breach of these Terms, non-payment, or to protect PlantDown, its customers or third parties. Where appropriate, we will aim to give the customer an opportunity to remedy a breach.

A customer may stop using PlantDown and cancel a paid subscription using the available account or billing process. Following termination, access to workspace data may be restricted. Data export, return and deletion will be handled in accordance with the applicable service and data-processing arrangements and legal retention requirements.

9. Intellectual property

PlantDown and its software, design, branding and service materials are owned by or licensed to PlantDown. These Terms give the customer a limited, non-exclusive, non-transferable right to use the service for its internal business purposes while its account is authorised and, where applicable, its subscription is active. These Terms do not transfer ownership of PlantDown intellectual property to the customer.

10. Confidentiality

Each party should protect confidential information received from the other and use it only for the purposes of the service, except where disclosure is authorised or required by law. This does not apply to information that is lawfully public, independently developed or lawfully received without a duty of confidence.

11. Liability

Nothing in these Terms excludes or limits liability where it would be unlawful to do so, including liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any other liability that cannot lawfully be excluded or limited.

Subject to the paragraph above, PlantDown is not responsible for losses caused by inaccurate customer-entered data, misuse of the service, failure to follow safety or legal requirements, or events outside our reasonable control. PlantDown is not intended to be the customer's sole record or safety control where independent records or procedures are legally or operationally required.

Any further financial liability cap for the paid commercial service should be set in the final commercial terms before launch. This draft intentionally does not invent a cap before the subscription model and legal review are finalised.

12. Third-party services

PlantDown relies on third-party infrastructure and services, which may include Supabase, Netlify and, when enabled, Stripe or another payment provider. Their availability and processing can affect parts of PlantDown. Use of those providers by PlantDown does not give the customer a direct right to control those providers except where their own terms expressly provide otherwise.

13. Data protection

Our Privacy Policy explains how PlantDown handles personal information for its own purposes. Where PlantDown acts as a processor for customer-controlled personal data, a separate Data Processing Agreement will form part of the commercial agreement. Customers remain responsible for their obligations as controllers where applicable.

14. Changes to these Terms

We may update these Terms where reasonably necessary for legal, security, operational or service changes. The latest version will show its last-updated date. For material changes affecting an active paid service, we will aim to give reasonable notice where practicable.

15. Governing law

These Terms are governed by the laws of England and Wales. The courts of England and Wales will have jurisdiction, subject to any mandatory legal rights that apply and cannot lawfully be excluded.

16. Contact

Josh Downer trading as PlantDown
Email: jdownerservices@hotmail.com

PlantDown Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the customer organisation ("Customer") and Josh Downer trading as PlantDown ("PlantDown") where PlantDown processes personal data on the Customer's behalf in providing the PlantDown service.

1. Roles

For Customer Personal Data processed through the Customer's PlantDown workspace, the Customer is the controller (or a processor acting for another controller, where applicable) and PlantDown is the processor or subprocessor as applicable. Each party will comply with the data-protection laws applicable to its role.

2. Customer instructions

PlantDown will process Customer Personal Data only on documented instructions from the Customer, including as necessary to provide, secure, support and maintain the PlantDown service and as set out in the Customer's use of the service, the Terms of Service and this DPA, unless processing is required by applicable law.

3. Details of processing

Subject matter and purpose: provision of the PlantDown business service for managing tools, equipment, plant, users, locations, movements, faults, repairs and associated records.

Duration: for the duration of the Customer's use of the service and any limited period afterwards required for return, deletion, backup lifecycle, security, dispute resolution or legal obligations.

Types of personal data: account email addresses and identifiers, company membership and roles, activity records associated with users, tool/equipment movement actions, fault and repair actions, and other information the Customer chooses to enter that identifies or relates to an individual.

Categories of data subjects: Customer employees, workers, contractors, administrators and other authorised users or persons whose information the Customer lawfully records in the service.

4. Confidentiality

PlantDown will ensure that persons authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality.

5. Security

Taking account of the nature of the processing and available technology, PlantDown will maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include authenticated user access, role-based and company-based access controls, transport encryption provided by the service infrastructure, access restriction and appropriate provider security controls.

6. Subprocessors

The Customer gives PlantDown general authorisation to use subprocessors required to operate the service. Current or anticipated core providers include Supabase for database, authentication and backend infrastructure and Netlify for application hosting and delivery. When subscription payments are enabled, payment services such as Stripe may process relevant billing information, although payment processing may involve separate controller relationships depending on the processing concerned.

PlantDown will require subprocessors that process Customer Personal Data on PlantDown's behalf to provide data-protection obligations appropriate to the processing. PlantDown will remain responsible for its obligations under this DPA where required by applicable law.

7. International transfers

Where Customer Personal Data is transferred outside the United Kingdom and UK data-protection law requires transfer safeguards, PlantDown will use an appropriate lawful transfer mechanism, which may include applicable adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another legally recognised safeguard.

8. Data-subject requests

Taking account of the nature of the processing, PlantDown will provide reasonable assistance to the Customer, where required by law and reasonably possible, in responding to requests by individuals exercising applicable data-protection rights. If PlantDown receives a request relating primarily to Customer-controlled workspace data, PlantDown may direct the individual to the Customer unless prohibited by law.

9. Security incidents

PlantDown will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data where notification is required under applicable data-protection law. PlantDown will provide information reasonably available to it to assist the Customer with its own breach assessment and notification obligations.

10. Compliance assistance

Taking account of the nature of processing and information available to PlantDown, PlantDown will provide reasonable assistance with the Customer's applicable obligations concerning security, personal-data breaches, data-protection impact assessments and prior consultation with a supervisory authority where required by law.

11. Return and deletion

At the end of the relevant services, PlantDown will, at the Customer's choice and subject to the technical capabilities made available by the service, return or delete Customer Personal Data and delete existing copies unless applicable law requires storage. Data may remain temporarily in secure backups until overwritten or deleted through the applicable backup lifecycle.

12. Audit and information

PlantDown will make available information reasonably necessary to demonstrate compliance with the processor obligations applicable to PlantDown and will allow for and contribute to reasonable audits or inspections where required by applicable law. Audits must be proportionate, protect other customers' confidentiality and security, and, except following a qualifying security incident or where a regulator requires otherwise, be arranged with reasonable advance notice.

13. Customer responsibilities

The Customer is responsible for the lawfulness, accuracy and quality of Customer Personal Data, providing appropriate privacy information to its personnel, establishing a lawful basis for its processing, configuring authorised users and permissions appropriately, and issuing lawful instructions to PlantDown.

14. Priority

If there is a conflict between this DPA and the general Terms of Service concerning the processing of Customer Personal Data, this DPA will take priority to the extent of that conflict.

15. Contact

Data-protection enquiries concerning this DPA may be sent to:
Josh Downer trading as PlantDown
jdownerservices@hotmail.com

PlantDown Cookies & Browser Storage Notice

PlantDown uses browser storage and related technologies that are necessary to provide the service you request, particularly to keep authorised users signed in and maintain secure access to the application.

What we currently use

The current PlantDown application does not include advertising trackers or analytics trackers. Authentication is provided through Supabase. Its browser authentication client may store session information on the user's device so that an authorised login can persist between page loads and visits.

Why this storage is used

This storage is used for core account authentication and service security. Without the required authentication/session functionality, signed-in users could not reliably access their PlantDown workspace.

Consent

PlantDown currently intends to use only storage/access technologies that are necessary for the requested service. We therefore do not currently display a marketing or analytics cookie-consent banner. We still provide this notice so users can understand the storage used by the service.

If this changes

If PlantDown later introduces non-essential analytics, advertising, tracking or similar technologies that require consent, those technologies will not be activated for a user until an appropriate consent mechanism has been provided where required.

Browser controls

Users can remove site data through their browser settings. Removing essential authentication data may sign the user out and require them to log in again.

Contact

Questions about PlantDown's use of browser storage can be sent to jdownerservices@hotmail.com.

PlantDown Data Retention & Deletion Policy

1. Purpose

This policy explains PlantDown's approach to retaining, exporting and deleting information. It should be read with the Privacy Policy, Terms of Service and Data Processing Agreement.

2. Active customer accounts

While a customer workspace is active, PlantDown retains information reasonably required to provide the service, maintain the customer's records, support security and administration, and meet applicable legal obligations.

3. Cancellation and inactive workspaces

Cancellation of a paid subscription does not necessarily mean that workspace data is deleted immediately. PlantDown may place an expired or cancelled workspace into a restricted or read-only state so that accidental loss can be avoided and the customer can be given an opportunity to reactivate, export or request deletion.

The precise standard post-cancellation retention period will be confirmed before commercial launch and reflected in the service and customer documentation. PlantDown will not retain personal data indefinitely merely because an account is inactive.

4. Customer-requested deletion

An authorised customer administrator may request deletion of the customer workspace by contacting jdownerservices@hotmail.com. PlantDown may take reasonable steps to verify the requester's identity and authority before carrying out an irreversible deletion.

Where deletion is appropriate, active copies of customer data will be deleted or anonymised as applicable, subject to information that must be retained for legal, accounting, fraud-prevention, dispute-resolution or security purposes.

5. Backups

Deleted information may remain temporarily in protected backups until those backups are overwritten or deleted through the normal backup lifecycle. Information retained only in backups will not ordinarily be restored to active use except where necessary for disaster recovery, security or legal purposes.

6. Export and return of data

PlantDown intends to provide reasonable means for customers to obtain relevant business records before permanent deletion. Until automated export features cover all relevant workspace data, an authorised customer administrator may contact PlantDown to request reasonable assistance with an export.

7. Individual data-protection rights

Where an individual's request concerns data controlled by their employer or another PlantDown customer, the individual should normally contact that organisation first. PlantDown will provide reasonable assistance to the customer where required under applicable data-protection law.

Where PlantDown is itself the controller of the relevant personal data, requests concerning access, correction, deletion, restriction, objection or portability where applicable may be sent to jdownerservices@hotmail.com. PlantDown may request information reasonably necessary to verify identity before acting on a request.

8. Operational and legal records

Different categories of information may require different retention periods. PlantDown will base retention on the purpose for which information is held, customer requirements, security needs and applicable legal or accounting obligations rather than keeping all information for one arbitrary period.

9. Changes

This policy may be updated as PlantDown's subscription, export, deletion and backup processes are finalised. Material changes will be reflected in the published version.

10. Contact

Josh Downer trading as PlantDown
jdownerservices@hotmail.com