Back

Privacy Policy

Last updated: August 2026  ·  The Back Office Team Ltd

This Privacy Policy explains how The Back Office Team Ltd ("we", "us", "our") collects, uses, and protects personal data when you use The Back Office platform. We are committed to handling personal data responsibly and in accordance with UK GDPR and the Data Protection Act 2018.

1. Our Role: Controller and Processor

The Back Office serves businesses ("Customers") who use the platform to manage their teams. Our data protection role depends on whose data is involved:

• We are the data controller for the account and billing data of the Customers who sign up to use the platform — for example, the name, email, and login records of the account holder, and subscription details.
• We are a data processor for the personal data that a Customer uploads or generates about their own staff, agents, and reps — for example team members' names, contact details, pay figures, performance records, and signed agreements. For that data the Customer is the controller and decides how it is used; we process it only on the Customer's instructions to provide the platform.

If you are a team member, agent, or rep and want to exercise your data rights, please contact the Customer organisation that manages your account in the first instance. We will support them in responding. For any questions about our own processing, contact us at hello@the-backoffice.co.uk.

2. What Data We Collect

Depending on how the platform is used, we collect and store the following personal data:

• Account details — names and email addresses for admin, manager, team leader, and staff accounts
• Contact details — contact information entered for agents and reps during onboarding
• Work performance data — weekly reviews, submission and sales records, leaderboard standings, cancellation records, and activity logs
• Pay data — earnings figures entered by admins and managers relating to managers, agents, and reps
• Signed agreements and e-signatures — contractor agreements and other documents completed and electronically signed within the platform, including the drawn signature and a generated PDF record
• Profile pictures — uploaded voluntarily by users
• Login, access, and activity records — including presence and engagement signals, kept for security and audit purposes

We do not collect payment card details directly. Card payments are handled by our payment processor (see section 5).

3. How We Use Data and Our Legal Basis

We use personal data solely to provide and operate The Back Office platform. The lawful bases we rely on under UK GDPR are:

• Contract — to provide the platform to Customers, authenticate users, process subscriptions, and deliver the features they have signed up for
• Legitimate interests — to keep the platform secure, maintain audit logs, prevent misuse, and improve the service
• Legal obligation — to retain billing, invoice, and signed-agreement records where the law requires it

Where we act as a processor, the Customer is responsible for establishing the lawful basis for their own use of the data. We do not use personal data for advertising and we never sell it to any third party.

4. Data Isolation

Each Customer's data is stored in a separate, isolated database. It is not possible for one Customer's data to be accessed by another Customer through the platform. Within a Customer's own account, access is further restricted by role — for example, team leaders cannot see pay or dashboard data.

5. Who We Share Data With

We use a small number of trusted third-party sub-processors to operate the platform. Each is bound by a data processing agreement and may only process data on our instructions:

• Railway — cloud hosting and database storage
• Resend — transactional email delivery
• Stripe — payment and subscription processing (Stripe collects card details directly; we do not store them)
• Open Door — where a Customer uses it, sales and venue data is synced from their Open Door account to display performance within the platform

We do not otherwise share personal data with third parties except where required by law.

6. International Transfers

Some of our sub-processors store or process data on servers located outside the UK, including in the EU and the US. Where personal data is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses to ensure your data remains protected.

7. Data Retention

We retain personal data for as long as the relevant Customer subscription is active. Upon cancellation or termination of an account, data is retained for 30 days to allow for export, after which it is permanently deleted — except for records we are legally required to keep for longer, such as signed agreements, invoices, and billing records, which are retained for the period required by UK law (typically up to six years) and then deleted.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — ask us to correct inaccurate data
• Right to erasure — ask us to delete your data
• Right to restriction — ask us to limit how we use your data
• Right to portability — request your data in a portable format
• Right to object — object to processing of your data

To exercise any of these rights, contact us at hello@the-backoffice.co.uk, or contact the Customer organisation that manages your account where we act only as processor. We will respond within one month.

9. Security

We take reasonable technical and organisational measures to protect personal data, including encrypted password storage, token-based authentication, role-based access controls, and isolated per-Customer databases. However, no system is completely secure and we cannot guarantee absolute security.

10. Cookies

The Back Office does not use tracking or advertising cookies. We use browser localStorage to maintain your login session. As no tracking cookies are set, no cookie consent banner is required.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or the platform. The date at the top of this page indicates when it was last revised.

12. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK's data protection authority, the Information Commissioner's Office (ICO).

13. Contact

For any privacy-related queries, contact us at hello@the-backoffice.co.uk.

---