Part 11: Legal Documents, Safety, Privacy, and Security

This part of the guide has 56 pages so far. Each page answers one question, shows what to do, and ends with an audit check you can use on your own business.

11.1 Prepare Customer Documents

• 11.1.1 Service Agreement: A service agreement sets the work, responsibilities, payment, changes, cancellation, and disputes in writing. Learn what to include and how to get it signed.
• 11.1.2 Estimate: A clear estimate states the scope, exclusions, assumptions, price, schedule, payment, warranty, and how to accept. Learn how to write one customers trust.
• 11.1.3 Proposal: A proposal recommends a solution and states the business terms. Learn what to include, how it differs from an estimate, and how to keep every claim truthful.
• 11.1.4 Scope of Work: A scope of work spells out exactly what is and isn’t included in a job. Learn what to put in it, how to word exclusions, and how it prevents disputes.
• 11.1.5 Change Order: A change order gets written approval before you do work outside the agreed scope. Learn how to spot changes, price them, record them, and avoid unpaid work.
• 11.1.6 Payment Terms: Payment terms tell customers what they owe, when, and how to pay. Learn what to include, how to set late fees, and how clear terms prevent disputes and bad reviews.
• 11.1.7 Cancellation Policy: A cancellation policy explains when customers and your business can cancel, what fees apply, and the federal 3-day rule for some in-home sales. Learn how to write one.
• 11.1.8 Refund Policy: A refund policy says who can get money back, how fast, and what isn’t covered. Learn what to include, where to post it, and how Google can show return policies.
• 11.1.9 Warranty: A warranty says what you’ll fix or replace, for how long, and under what conditions. Learn the federal rules for product warranties and how to write a service warranty.
• 11.1.10 Privacy Notice: A privacy notice explains what customer information you collect, why, who you share it with, and how long you keep it. Learn when you need one and what to include.
• 11.1.11 Website Terms: Website terms set the rules for using your site, protect your content, and limit your risk. Learn what to include and the review clauses federal law doesn’t allow.
• 11.1.12 Photo Permission: Get written permission before you post photos of customers, their homes, or their property. Learn what to ask for, before-and-after rules, and what Google allows.
• 11.1.13 Testimonial Permission: Get permission before you use a customer’s words, name, or review in your marketing. Learn the FTC rules, what to disclose, and how Google treats reviews on your site.

11.2 Prepare Vendor and Contractor Documents

• 11.2.1 Vendor Agreement: A vendor agreement spells out what a supplier or service provider delivers, the price, payment, and who owns what. Learn what to include and why account ownership matters.
• 11.2.2 Independent-Contractor Agreement: An independent contractor agreement sets the scope, pay, confidentiality, ownership, and insurance for outside workers. Learn what to include and why the contract alone isn’t enough.
• 11.2.3 Subcontractor Agreement: A subcontractor agreement splits the work, sets who talks to the customer, and covers safety, licenses, insurance, and fixing mistakes. Learn what to include and why.
• 11.2.6 Insurance Certificates from Vendors: A certificate of insurance shows a vendor or subcontractor has coverage. Learn when to ask for one, what to check, and how to track expiration dates.
• 11.2.7 Data-Processing Terms: Data-processing terms set how vendors use, protect, keep, and delete your customer data. Learn what to check in a vendor’s privacy terms and what to put in writing.
• 11.2.8 Termination Terms: Termination terms explain how to end a vendor or contractor deal, hand over work and records, and settle the final bill. Learn what to include, including account handover.

11.3 Establish Advertising Controls

• 11.3.1 Truthful Advertising Claims: Every claim in your ads, website, and Google profile must be true and provable. Learn the FTC rules, how to handle license and insurance claims, and what to avoid.
• 11.3.2 Pricing Disclosures: Learn how to show prices, fees, minimums, and conditions clearly in ads, on your website, and on Google so customers aren’t surprised and complaints don’t follow.
• 11.3.3 Guarantees: Learn how to write a business guarantee with clear conditions and exclusions, what “satisfaction guaranteed” and “lifetime” really require, and how to honor it.
• 11.3.5 Fake Review Rules: The FTC’s review rule bans fake reviews, paying for positive reviews, hidden employee reviews, and review suppression. Learn what’s banned and how to stay clean.
• 11.3.9 Comparative Claims: You can compare your business to competitors if the comparison is true and you can prove it. Learn the FTC rules, what proof to keep, and what to avoid saying.

11.4 Establish Safety Controls

• 11.4.1 Hazard Identification: Learn how to find and rank the safety risks in your business, from vehicles and tools to chemicals and job sites, using OSHA’s steps and a simple hazard list.
• 11.4.2 Safety Training: Learn who needs safety training, what OSHA expects it to cover, how to train in a language workers understand, and how to record it for employees and temps.
• 11.4.3 Personal Protective Equipment: Learn how to decide what safety gear your workers need, who pays for it under OSHA rules, how to train on it, and the written hazard assessment you must keep.
• 11.4.4 Equipment Inspection: Learn how to inspect, maintain, and record your tools, ladders, and equipment, what OSHA expects, and how to pull broken gear out of service before it hurts anyone.
• 11.4.5 Incident Reports: Learn how to record injuries, near misses, property damage, and complaints, when OSHA requires injury logs or a report within 8 or 24 hours, and what to keep.
• 11.4.7 Stop-Work Procedure: Learn how to write a stop-work policy so anyone can pause a job when it’s unsafe, what OSHA says about refusing dangerous work, and how to restart safely.
• 11.4.8 Hazard Communication and Safety Data Sheets: If your workers use hazardous chemicals, OSHA requires a written plan, labels, safety data sheets, and training. Learn what’s needed and how to set it up simply.
• 11.4.10 Driving Rules: Learn how to set driver rules for your business: license checks, seat belts, phone use, vehicle inspections, crash reporting, and when you need a USDOT number.

11.5 Create the Data Map

• 11.5 Data Map: A data map lists what personal information you collect, why, where it’s stored, who can see it, who you share it with, how long you keep it, and how you delete it.

11.6 Create Privacy Procedures

• 11.6.1 Data Minimization: Collect only the customer information you need for a clear purpose. Learn how to trim web forms, intake questions, and what you paste into AI tools, and why it matters.
• 11.6.2 Sensitive Information: Learn which customer data counts as sensitive, like ID numbers, card data, health details, children’s data, and biometrics, and how to limit and protect it.
• 11.6.5 Customer Privacy Requests: Learn how to handle customer requests to see, fix, or delete their data, or to opt out, which laws may apply, and how to log each request and your reply.
• 11.6.6 Breach Notification: Every state has a data breach notice law. Learn who in your business decides if a breach needs notice, who you may have to tell, and what records to keep.
• 11.6.7 Privacy Training: Learn what to teach staff and contractors about handling customer information, spotting scams, and reporting problems, how often to train, and what to record.

11.7 Control Business Accounts and Access

• 11.7.2 Password Manager: Learn why a business password manager beats sticky notes and spreadsheets, how to set one up, share logins safely, and keep the business in control of it.
• 11.7.3 Multi-Factor Authentication: Learn what multi-factor authentication is, which types are strongest, which business accounts to protect first, and why admins need their own protected logins.
• 11.7.4 Account Recovery Methods: Set business-controlled recovery emails, phone numbers, and backup codes for every key account, including your domain, so a lost phone never locks you out.
• 11.7.5 Access Inventory: Build one list of every business account, admin, user, permission, device, and key, so you always know who can get in and can remove access fast.
• 11.7.6 Least Privilege Access: Give each owner, employee, contractor, and AI tool only the access it needs. Learn how to set roles for customer data, money, your CRM, and Google Business Profile.
• 11.7.7 Removing Access When People Leave: Use a same-day checklist to remove logins, Google Business Profile roles, keys, codes, and devices when someone leaves or changes roles, and record each step.
• 11.7.8 Emergency Account Access: Make a written plan so a trusted person can reach your business accounts if you’re sick, hurt, or unreachable, without sharing passwords day to day.

11.8 Create Backups

• 11.8 Business Backups: A plain checklist for backing up legal, money, customer, website, domain, contract, and procedure records, plus CRM exports and shared files, kept offline.
• 11.8.8 Backup Recovery Test: Learn how to test your backups by restoring sample files and a copy of your website, how often to do it, and what to record so you know recovery works.

11.9 Create an Incident-Response Plan

• 11.9.1 Lost Device: A step by step plan for a lost or stolen work phone, tablet, or laptop: lock or erase it, cut off account access, change passwords, and decide if it’s a breach.
• 11.9.2 Account Takeover: A plan for a hacked business account: get back in, remove the intruder, check recovery details and forwarding rules, fix your listings, and report it.
• 11.9.3 Ransomware: A plain ransomware plan for small businesses: disconnect infected devices, report to the FBI and CISA, restore from offline backups, and tell the right people.
• 11.9.4 Data Breach Response: A step-by-step data breach plan for small businesses: contain it, investigate, keep records, and notify the right people under federal and state rules.
• 11.9.5 Payment Fraud: What to do when your business sends money to a scammer or gets hit by payment fraud: call the bank fast, alert your processor, report it, and tell customers.
• 11.9.6 Severe Injury: What to do when someone is badly hurt at work: get help first, report to OSHA on time, document what happened, and contact your insurers. Federal rules explained.
• 11.9.7 Vehicle Accident: A simple plan for crashes in a business vehicle: keep people safe, call police when needed, document the scene, tell your insurer, and update customers.
• 11.9.8 Severe Weather: Plan for storms and closures: when to close, how to keep staff safe, how to update Google, Bing, and Apple listings, and how to reopen and recover.
• 11.9.9 Platform Suspension Plan: Plan ahead for a suspended Google Business Profile, social account, or email: keep backup channels, your own website, current listings, and copies of your records.