Customer data in a plumbing sale: limit data-room access and map the buyer permitted uses

Which diligence question requires customer data?

Start with the question rather than the full customer export. The buyer may need to understand concentration, repeat work, service areas, or open commitments. Those questions can require different evidence and different levels of detail.

Use the buying hub to connect each request to a deal decision. Ask whether a summary, coded sample, or named record can answer it. The easiest export is not always the most useful or proportionate evidence.

A data-access purpose map links each diligence question to the fields needed, authorized reviewers, proposed use, access stage, and handling terms. It helps the parties make an informed access decision without assuming that every customer record belongs in the room.

Why should access be staged?

Early review often concerns the shape of the business. A buyer may be able to assess repeat revenue or concentration from summaries that omit direct identifiers. More detailed review should follow a defined need and the relevant approvals.

Staging does not mean hiding a material issue. It means presenting useful evidence at the level required to assess it. If a summary cannot resolve a specific concern, explain why a controlled sample or broader access is needed.

Use the acquisition diligence guide to place those requests within the wider process. Record dependencies so unresolved access questions do not disappear when the financial review moves forward.

What does the FTC guidance support?

The FTC's personal-information guide describes understanding the data held, reducing unnecessary information, controlling access, and protecting needed records. Those principles support a more deliberate diligence process.

The guidance does not grant permission to sell a customer file or decide which privacy laws apply to a plumbing company. Counsel needs the actual contracts, notices, data categories, transaction structure, and proposed uses.

Keep those questions distinct. A secure transfer can still involve a use that needs further review. Conversely, an approved purpose does not remove the need for suitable security. The buyer needs evidence for both parts of the handoff.

Which fields should be excluded from an early request?

Review the actual export fields before making a request. Direct contact details, access notes, payment-related fields, and other private information may not serve an early concentration question. Some files can contain information beyond the report's headline purpose.

Ask the seller to describe the fields and any sensitive free-text areas. Use the least detail that answers the task. Do not assume that deleting a name makes all other information anonymous or safe for unrestricted sharing.

If a field is needed later, state the reason and approved handling. This gives the seller a clear request and gives the buyer a defensible record of why the information entered the diligence process.

How can report controls reduce unnecessary disclosure?

ServiceTitan's report instructions describe filters, column choices, and export options. The actual account and report determine what can be selected. A reviewer should verify the resulting file rather than assume a column choice removed every related detail.

Record report settings so reduced-field evidence remains understandable. Dates, filters, and aggregate choices can also affect the financial conclusion. A smaller file is useful only if it still answers the question accurately.

When totals are compared with statements, use the P&L reading guide to assess the relevant period and basis. Privacy controls should not obscure an unexplained earnings difference or turn a report subtotal into proof of revenue quality.

What should a staged-access table show?

The following example assumes three diligence questions and different evidence choices. It illustrates how to design a request. It does not establish that any particular fields can lawfully be disclosed or that these stages suit every sale.

Suppose two questions can be answered with reduced evidence and one needs a controlled contract sample. Under those assumptions, only one of three requests moves to that next stage. This is a planning example, not a disclosure threshold.

Who should receive access?

Name the reviewers and their tasks. A finance reviewer, attorney, software provider, and buyer operator may need different information. Giving all of them the same complete folder can expand disclosure without improving the analysis.

The FTC's security guide supports limiting access to the business need and assessing service-provider security. Apply those principles to actual recipients and channels. A provider's role in migration does not authorize every unrelated use.

Define whether download, copying, onward sharing, and local storage are permitted. Keep practical access settings aligned with the actual handling agreement. A broad download permission can undermine a plan that assumes view-only review.

How should counsel assess permitted uses?

Describe the buyer's intended use before asking counsel to review it. Continuing service, honoring open work, importing history, and launching a new campaign can raise different questions. One broad label such as business purposes may hide those distinctions.

Provide the actual notices, agreements, relevant data categories, and proposed transfer terms. Counsel can then assess permissions and duties under the facts. Do not infer customer consent from silence, a software record, or a purchase-price allocation.

The sale documents should reflect the accepted result. They may need to identify included records, excluded fields, permitted purposes, and responsibilities. Technical staff should implement that decision rather than decide it by choosing the largest available export.

Which steps make the request reviewable?

Use a written request that connects the evidence to the decision. It should allow the seller to see what is needed and why, while preserving the buyer's ability to test the relevant claim.

1. State the diligence question and the decision it affects.
2. Identify necessary fields, periods, and report definitions.
3. Choose reduced evidence or a controlled sample where adequate.
4. Review actual permissions, recipients, and security arrangements.
5. Log granted access, findings, exceptions, and handling obligations.

Keep changes visible. If a new concern requires added fields, amend the request with its reason. An evolving review is normal; unexplained expansion makes it harder to assess whether the scope still fits the task.

What happens when an exception appears?

An exception might involve a contract restriction, an unexpected field, or a recipient needing more access. Record the actual issue and who can resolve it. Do not use a generic privacy note as a substitute for a decision.

Assess its effect on the buyer's analysis and operating plan. A limitation may require another way to test a claim, a revised handoff, or a commercial decision. The effect depends on the facts and should remain visible.

Pause the affected disclosure while its required approval is unresolved. Continue other review that does not depend on it. This keeps the deal moving without treating elapsed time or a folder invitation as permission.

What belongs in the final data handoff record?

Preserve the approved field list, recipients, uses, transfer method, retention terms, and open items. Confirm what the buyer actually received and which access should end. A completed sale does not automatically resolve every diligence-copy obligation.

The plumbing purchase guide connects this handoff to the broader closing decision. The practical aim is a usable record of purpose, authority, and handling, with the actual gaps identified for action.