Overview
FESK.UK is built and run in the UK, and we take data protection seriously. This page explains how we meet the UK GDPR and the Data Protection Act 2018, and how you (and the people whose details you store) can exercise your rights.
The short version: your customer records are processed on your instructions and stored on our servers in the UK. Some services we use work outside the UK, and they’re listed below. You can access, export or delete personal data whenever you need to.
Controller or processor?
For your account details (your name, email, billing) we’re the data controller. For the customer data you put into FESK.UK, you’re the controller and we’re your processor — we only handle it to provide the service, on your instructions.
Your rights
Under UK GDPR you have the following rights. Most are self-serve in the app; for anything else, email us and we’ll act within one month.
| Right | What it means | How to use it |
|---|---|---|
| Access | Get a copy of your data | Export from the app, or ask us |
| Rectification | Correct anything wrong | Edit in the app, or ask us |
| Erasure | Have personal data deleted | Delete in the app, or ask us |
| Portability | Take your data elsewhere | Export to CSV |
| Restrict / Object | Limit or object to processing | Email us |
Lawful bases
We only process personal data where we have a lawful basis to do so:
- Contract: running your account, jobs and billing.
- Legitimate interest: keeping the service secure, reliable and improving.
- Consent: optional marketing emails, which you can opt out of at any time.
Where your data lives
Your data is stored on our servers in the United Kingdom. Some services we use work outside the UK. Anthropic runs the AI tools. Anthropic is a US company, and this processing happens outside the UK. Twilio (texts), Stripe (payments), Cloudflare (off-site backups), Google (web fonts) and Apple (push notifications) are US companies too, and may process data outside the UK. The list below says what each service receives.
Sub-processors
These services receive personal data so we can run FESK.UK. We’ll give notice before adding or changing one.
| Service | What it receives, and when |
|---|---|
| IONOS (Fasthosts Internet Ltd) | Hosts FESK.UK on servers in the United Kingdom: the app, the database, uploaded files and our nightly backups. |
| IONOS email | Sends the app’s email, such as invoices, quotes, reminders, notifications and password resets. It receives each recipient’s name and email address and the message. A copy of the database is also emailed to a backup mailbox each week. IONOS hosts that mailbox. |
| Cloudflare | Keeps a copy of the database and uploaded files, taken every night, which may be held outside the UK. It also runs our domain names, and visits to the fesk.uk website pass through its network, so it sees visitors’ IP addresses and what they send on those pages. |
| Anthropic (Claude API) | Runs the AI tools: Ask AI, Front Desk, Document Import, Write it up, the AI buttons for a job’s title, description and notes, and the support chat. When one is used, Anthropic receives what was typed or uploaded and the job, customer or staff details the tool looks up. For Front Desk, that includes what website visitors type, such as their name, email address and phone number. When a new customer looks like an existing one, their details and those of the similar customers are sent to check for a duplicate. You can switch this check off in Settings. The job buttons, the support chat and the duplicate check work without the AI add-on. We also use Anthropic for our own support and account admin. Anthropic is a US company, and this processing happens outside the UK. |
| Twilio | Sends texts if your business turns them on. Lone-worker alerts go by text even when texts are off. It receives each phone number and message. A message can include a customer’s name, job details, times and links, and an alert includes the engineer’s location. Twilio is a US company. |
| Stripe | Takes subscription payments. It receives the account holder’s name and email address, and card details go straight to Stripe. We never see the full card number. |
| Google Fonts | Our pages, and some of our emails, load their fonts from Google, which receives the viewer’s IP address and browser details. Google is a US company. |
| OpenStreetMap and OSRM | Used by Route Planner and On my way. Job addresses go to OpenStreetMap’s Nominatim service to place them on the map, and map positions go to the OSRM route server to work out driving routes and times. For On my way, that includes the engineer’s current position. The map images come from a public map server, which receives the viewer’s IP address. |
| postcodes.io and Open-Meteo | The weather on the dashboard’s Week ahead card. They receive your business postcode or the weather location you set. |
| Push services (Apple, Google, Mozilla) | Deliver notifications to phones and browsers that have allowed them. The message is encrypted, so the push service can’t read it. |
Some services are used only if your business connects them, under your own agreement with that provider: accounting software such as QuickBooks, your own Twilio account or mail server, and Stripe for taking payments from your customers.
Data Processing Agreement
If your business needs a signed Data Processing Agreement (DPA) covering the Article 28 terms, we’re happy to provide one — just ask.
Breach notification
If a personal data breach ever occurs that’s likely to put people at risk, we’ll notify the Information Commissioner’s Office within 72 hours where required, and tell affected customers without undue delay.
Contact us
To make a data request or ask a question, email support@fesk.uk. You can also complain to the Information Commissioner’s Office, though we’d like the chance to help first.