Business data-processing terms
Effective 3 October 2026 · Contact info@marshalos.co.uk
Registered address, company number and VAT status are awaiting confirmation. Paid orders and subscriptions are not open while these details are incomplete.
Roles and instructions
For customer and employee records entered in your workspace, your business is controller and Marshalos Ltd is processor. These terms form part of the workspace agreement. We process this information to host, store, display, export, update and delete records on your documented instructions through the service, unless law requires otherwise.
Scope and duration
Processing lasts for the account’s use of the service and relevant deletion or backup periods. Data subjects may include your customers, prospects, team members and suppliers. Data may include names, business contact details, service records, task notes and administrative information that you submit. The service is not designed for special-category data, identity-document storage or detailed payroll records.
Confidentiality and security
People authorised to process workspace information must be subject to appropriate confidentiality obligations. We use account authentication and database policies that restrict access to each account’s records. You remain responsible for your devices, credentials, chosen document destinations and appropriate minimisation of the information stored.
Subprocessors and international transfers
Supabase provides account and database infrastructure and Netlify provides hosting and functions. These are authorised subprocessors for the service. We remain responsible for appropriate processor terms and safeguards. We will notify affected customers before a material new subprocessor is used, allowing a reasonable opportunity to object on data-protection grounds. Restricted international transfers must use an applicable legal transfer mechanism.
Assistance and incidents
Taking into account the nature of processing, we provide reasonable assistance with data-subject requests, security obligations, breach reporting, impact assessments and regulator enquiries. Notify us at info@marshalos.co.uk about requests or incidents. We notify the controller without undue delay after becoming aware of a personal-data breach affecting its workspace records and share available information needed for the controller’s response.
Return, deletion and evidence
You can export workspace records from Business profile. On account deletion, active workspace records are removed, subject to lawful retention and provider backup cycles. On reasonable request we provide information needed to demonstrate compliance and cooperate with proportionate audits, subject to confidentiality, security and reasonable arrangements. Tell us if an instruction would violate data-protection law.
Official guidance: Online selling · Returns & refunds · Data protection