PestBase Privacy Policy
Last updated: 25 September 2026
Welcome to PestBase's Privacy Policy. PestBase is a trading name of Service Record Ltd.
1. Introduction
SERVICE RECORD LTD operates the public PestBase website available at https://pestbase.co.uk (the "Website") and the PestBase pest control management platform available at https://app.pestbase.co.uk (the "Platform").
This Privacy Policy explains how SERVICE RECORD LTD, trading as PestBase ("PestBase", "we", "us" or "our"), collects, uses, stores, shares and otherwise processes personal data when you visit the Website, create or use an account on the Platform, or interact with any related products, services, features or communications that we make available. The Website, Platform and those related offerings are collectively referred to in this Privacy Policy as the "Services".
We are committed to protecting your privacy and handling personal data responsibly. Please read this Privacy Policy carefully. If you have questions about this Privacy Policy or our handling of your information, please use our Contact Us form.
2. Data Controller
The controller responsible for your personal data is:
- SERVICE RECORD LTD
- Trading as: PestBase
- Company number: 17410451
- Registered in England and Wales
Our current registered office address is shown in the footer of this website.
For privacy questions, rights requests or data-protection complaints, please use our Contact Us form.
PestBase acts as controller for personal data processed for its own account, billing, security, website, communications and business-administration purposes. PestBase is used by pest control businesses (each a "Customer") to manage their own customers, sites, staff, jobs and records. Where a Customer uses the Platform to process personal data for its own purposes, the Customer is the controller and PestBase processes that personal data on the Customer's documented instructions in accordance with the data-processing terms in our Terms and Conditions. If your details were entered into PestBase by a pest control business you deal with, please contact that business first about how your data is used.
This Privacy Policy is intended to comply with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations ("PECR") and any other applicable UK privacy and data-protection legislation.
3. Applicable Legal Framework
Depending on where you are located and how you use our Services, we may process your personal data in accordance with:
- the UK GDPR;
- the Data Protection Act 2018;
- the Privacy and Electronic Communications Regulations 2003 ("PECR"); and
- other applicable privacy and data protection laws.
Nothing in this Privacy Policy is intended to limit any mandatory rights you may have under applicable law.
4. Information We Collect
The personal data we collect depends on how you interact with us and the Services. The categories of personal data we may collect and process are set out below:
| Category | Personal Data We May Collect | How We Collect or Receive It |
|---|---|---|
| Information you provide directly | Name, business or organisation name, email address, optional business telephone number, role/position, account details, communications and correspondence with us, information included in enquiries or demo requests, and any other information you choose to provide. | Directly from you when you contact us (including through our Contact Us form, which also records the IP address and browser a message was sent from, to prevent abuse of the form), request a demonstration, are set up with an account, use the Services or otherwise provide information to us. Role/position and an optional business telephone number are used to identify the appropriate person within the Customer organisation and to communicate important account or service information. They do not, by themselves, constitute consent to promotional marketing. |
| Account and service information | Account profile information, user role and permissions, preferences and settings, company settings (including business name, logo, VAT and bank details shown on the Customer's documents), and the records created in the Services: customers and sites, quotes, bookings, jobs, inspection and treatment reports, photographs, signatures, products used, invoices and payments recorded, emails sent through the Services, notifications and audit logs. | From your use of your account and the Services. |
| Information about other individuals | Personal data relating to a Customer's own customers and site contacts (such as names, addresses, telephone numbers and email addresses), technicians and other staff, and individuals who sign or are named in reports. | From the Customer or another authorised user of the Services. The Customer must ensure that it has a valid legal basis and all necessary authority to provide such personal data and, where required, that appropriate privacy information has been provided to the relevant individuals. |
| Billing information | Subscription status, invoices, payment status and limited billing information necessary to administer the Customer's account. | From the Customer and, where we take card payments, from our payment service provider. We do not ordinarily receive or store full payment card details. |
| Technical and usage information | IP address, browser type and version, device type, operating system, pages or features accessed, dates and times of access, referring URLs, approximate location derived from IP address, log files, sign-in events and information about how you interact with the Website and Services. | Automatically when you visit our Website or access or use the Services. |
| Cookies and similar technologies | Session and authentication information, and preferences stored in your browser (such as your chosen theme and recent searches). | Automatically through the cookies and browser storage described in section 11. |
5. Account Authentication and Session Management
The PestBase Platform uses passwordless sign-in: when you ask to sign in, we email you a link and a six-digit code, and either one starts a session. Sign-in and session management are provided by authentication technology operated within PestBase's own production environment. Information processed may include email addresses, account and user identifiers, authentication and session information, the time of your last sign-in, and security-related login events such as repeated requests for a sign-in code.
We use this information to provide, secure and manage access to PestBase accounts, and to limit how often sign-in codes can be requested so that the sign-in form cannot be used to send unwanted email. We apply appropriate technical and organisational measures to protect authentication information and retain it only for as long as reasonably necessary for account management, security, legal compliance and related purposes. We do not currently use an externally hosted authentication service. If this changes and an external provider processes personal data on our behalf, we will update this Privacy Policy accordingly, including details of any applicable international transfers.
6. Emails Sent on Behalf of Customers
Customers can send quotes, invoices and inspection reports to their own customers from within the Platform, through the Customer's own Microsoft 365 account or mail server. When they do, we process the recipient's name and email address, the message and the attached document on the Customer's instructions, and keep a record of the email sent, including a copy of the attachment, so that the Customer has a history of what was sent and when. The credentials a Customer provides to connect its mail account are stored encrypted.
7. Support Access
PestBase support staff can access a Customer's records only during a time-limited support-access period. Normally the Customer opens that period from its settings and can close it at any time. In exceptional circumstances, such as a security incident or an urgent fault, PestBase may open emergency access for a limited period, with the reason recorded. Every access period, including emergency access, is visible to the Customer, and opening and closing access, and changes made by PestBase staff, are recorded in the Customer's audit trail.
8. How We Use Your Personal Data and Our Lawful Basis
We may use personal data for the purposes set out below, depending on the nature of your relationship with us and how you interact with the Website and Services.
| Purpose | Type of data | Lawful Basis |
|---|---|---|
| Providing and administering the Service and account communications | Name, work email, organisation, role/position, optional business telephone number, account details, user role and authentication information | Contract where necessary to perform our agreement with you; otherwise legitimate interests in providing and administering our business service, managing customer accounts and business relationships, and communicating important information concerning the Service |
| Processing Customer records on the Customer's instructions | The Customer's customer, site, job, report, photograph, signature, invoice and email records | Processed as processor on behalf of the Customer, who determines the lawful basis for that processing |
| Managing subscriptions and payments | Billing details, subscription information, payment status and transaction information | Contract; legal obligation where required for accounting and tax records; and legitimate interests in managing payments and recovering amounts properly due |
| Providing customer support and responding to enquiries | Name, contact details and information included in your enquiry | Contract where necessary to take steps at your request; otherwise legitimate interests in responding to business enquiries and managing customer relationships |
| Promotional marketing communications | Name, work email, organisation and marketing preferences | Consent where required by PECR and the UK GDPR; otherwise legitimate interests in promoting our business services where permitted by applicable law, subject to applicable opt-out rights |
| Security, fraud and abuse prevention | Account, device, technical and usage information | Legitimate interests in protecting the Service, preventing fraud and abuse, detecting unauthorised activity and maintaining service security |
| Service operation and security | Login activity, technical information, IP address, browser information, service events and audit information | Legitimate interests in maintaining security, reliability, accountability and the proper operation of the Service |
| Legal and regulatory compliance | Information necessary to meet applicable legal obligations | Legal obligation |
| Establishing, exercising or defending legal claims | Relevant account, transaction, communications and other records | Legitimate interests in establishing, exercising or defending legal rights and claims |
Certain account and authentication information is required to create or administer an account or provide the Service. If required information is not provided, we may be unable to create or administer the relevant account, provide the requested Service or respond to the relevant request.
Where we rely on legitimate interests, those interests generally include providing and protecting a secure business service, preventing fraud and misuse, managing customer and business relationships, maintaining service reliability, and establishing or defending legal claims. You may have the right to object to processing based on legitimate interests in accordance with section 13 of this Privacy Policy.
10. How Long We Keep Your Data (Data Retention)
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and processed. This may include providing and maintaining the Services, managing user accounts, complying with legal and regulatory obligations, resolving disputes and enforcing our agreements. The length of time for which we retain personal data depends on the category of information and the circumstances in which it is processed.
| Factor | How It Affects the Retention Period |
|---|---|
| Nature of the information | Different categories of personal data may require different retention periods depending on their sensitivity, importance and purpose. |
| Purpose of collection and processing | We retain personal data for as long as necessary to fulfil the specific purpose for which it was collected or processed. |
| Duration of our relationship with you or the relevant Customer | Account and service-related information may generally be retained for the duration of the relevant account, subscription, contract or business relationship and for an appropriate period afterwards where necessary. |
| Legal and regulatory requirements | We may retain certain information for longer periods where required to comply with applicable legal, regulatory, tax, accounting, audit or reporting obligations. |
| Applicable limitation periods | We may retain information for as long as reasonably necessary to establish, exercise or defend legal claims, taking into account applicable statutory limitation periods. |
| Disputes, investigations or enforcement | Where a dispute, complaint, investigation, suspected breach or legal claim arises, we may retain relevant information until the matter has been resolved and any applicable retention period has expired. |
| Ongoing business or operational need | We may retain information where reasonably necessary to maintain records, ensure security, prevent fraud or misuse, or protect and enforce our legal rights and agreements. |
Customer records are kept for as long as the Customer's account is active and are then deleted or returned in accordance with our Terms and Conditions. Deactivating a customer or user record inside the Platform hides it but keeps its history, so that past jobs, reports and invoices remain complete. In-app notifications are deleted automatically after 30 days.
When personal data is no longer required for the purposes described above, we will securely delete it, anonymise it so that it can no longer reasonably identify an individual, or securely archive it where appropriate and permitted or required by applicable law.
12. International Data Transfers
Where we transfer personal data outside the UK, we will comply with the applicable requirements of the UK GDPR.
Where the destination is not covered by UK adequacy regulations, we will use an appropriate lawful transfer mechanism, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, where applicable.
We may also implement supplementary safeguards where required by UK data-protection law. Further information about the safeguards applicable to a particular transfer may be requested through our Contact Us form.
13. Your Rights under UK GDPR
Under the UK GDPR and the Data Protection Act 2018, you have certain rights in relation to your personal data. You can exercise any of your rights through our Contact Us form. Where your data was entered into PestBase by a Customer, we will pass your request to that Customer or help them respond to it, as they control that data.
| Right | What It Means in Practice |
|---|---|
| Right of access | You can request a copy of the personal data we hold about you (a subject access request). We normally respond within one month. Where permitted by applicable law, this period may be extended for complex or numerous requests, and we will inform you where an extension applies. |
| Right to rectification | You can ask us to correct any personal data that is inaccurate or incomplete. |
| Right to erasure | You can ask us to delete your personal data where there is no compelling reason for us to continue processing it. Also known as the right to be forgotten. |
| Right to restriction | You can ask us to suspend processing of your personal data in certain circumstances, for example while accuracy is disputed. |
| Right to data portability | You can request certain personal data you have provided to us in a structured, commonly used and machine-readable format where the processing is automated and based on consent or contract. |
| Right to object | You can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests. |
| Right to withdraw consent | Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. |
| Right to complain | You have the right to lodge a complaint with the Information Commissioner's Office (see section 16). |
These rights are not absolute and may be subject to legal conditions and exemptions.
14. Data Security
We take the security of personal information seriously and implement reasonable and appropriate technical, organisational and administrative safeguards designed to protect personal information against unauthorised or unlawful access, disclosure, alteration, loss, destruction or misuse. These include passwordless sign-in, role-based access controls checked by our servers on every request, separation between Customers' data, encryption of stored mail-account credentials, a tamper-evident audit trail of important changes, time-limited support access that the Customer can see, and periodic review of our security practices.
15. Marketing Communications
We may send you promotional marketing communications in accordance with applicable UK GDPR and PECR requirements. Where consent is required, we will obtain it before sending the relevant promotional marketing communications.
You can opt out of marketing emails at any time by using the unsubscribe link in the email or through our Contact Us form.
Opting out of marketing communications will not prevent us from sending you important non-marketing communications, including sign-in emails and messages relating to your account, subscription, security, support, data export, account closure or the Services.
16. Data-Protection Complaints
If you have concerns about how PestBase processes your personal data, you can make a complaint through our Contact Us form. We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate and communicate the outcome of our investigation.
You also have the right to complain directly to the Information Commissioner's Office (ICO), which is the UK's independent supervisory authority for data protection: ico.org.uk/make-a-complaint. You are not required to contact PestBase before making a complaint to the ICO.
17. Children's Data
PestBase accounts are intended for business users and are not offered directly to children. A Customer may, however, record personal data relating to children, special-category data or criminal-offence data in its records. In those circumstances, the Customer is responsible for determining that the processing is lawful and for implementing any additional conditions, notices and safeguards required by applicable law. PestBase processes such Customer personal data on the Customer's documented instructions in accordance with the applicable data-processing terms.
18. Third-Party Services and Links
Our Website or Services may contain links to third-party websites or services, such as map directions to a site address. We are not responsible for the privacy practices, content or security of third-party websites or services. We encourage you to read their privacy policies.
19. Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date and, where appropriate, bring material changes to your attention through the Website, Service or other appropriate means. Where a change to our processing requires consent under applicable law, we will obtain the required consent before carrying out that processing.
20. Contact
If you have questions about this Privacy Policy or our processing of personal data, please use our Contact Us form. We accept privacy questions, rights requests and data-protection complaints through this route.
Our current registered office address and company details are shown in the footer of this website.