Data Processing Agreement

This Agreement forms part of the Terms of Service between Aarti Intelmann Ltd, which operates FindPetGroomers.co.uk ("we", "us", "the Processor"), and you, the groomer ("you", "the Controller"). It applies whenever we process personal data on your behalf, for example the details of customers who book with you through our booking system.

Aarti Intelmann Ltd is registered in England and Wales (company number 16950051) and registered with the Information Commissioner's Office (registration number ZC056967).

"UK GDPR", "personal data", "data subject", "controller", "processor", "processing" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018.

1. Roles

You are the controller of the personal data of your customers and enquirers. We are your processor for that data.

We are a separate controller for: your own account and business data; data we hold about you as our customer; and the directory listing information we compile about grooming businesses. How we handle that data is described in our Privacy Policy, not in this Agreement.

Stripe processes payment card data as an independent controller. We do not receive or store card numbers.

2. Subject matter, duration, nature and purpose

Subject matter: providing booking, customer management, notification and Textback (call forwarding) services through the FindPetGroomers platform.

Duration: for as long as you use those services, plus the retention period in clause 9.

Nature and purpose: collecting, storing, organising, retrieving, transmitting and deleting personal data so that you can take and manage appointments, communicate with your customers and keep records of your business.

Types of personal data: names, telephone numbers, email addresses, postal addresses, appointment history, notes you record about a customer or their pet, photographs uploaded by you or your customers, marketing preferences, and records of calls forwarded and messages sent through Textback.

Categories of data subject: your customers and prospective customers, and any staff members you add to your account.

Pet data is not personal data in itself, but is treated under this Agreement where it is linked to an identifiable owner.

3. Our obligations

We will:

process personal data only on your documented instructions, including about transfers outside the UK, unless the law requires us to do otherwise, in which case we will tell you first unless the law forbids it. Your use of the platform, and the settings you choose in it, are your documented instructions;
tell you if, in our opinion, an instruction infringes data protection law;
ensure that everyone authorised to process the data is under a duty of confidentiality;
take appropriate technical and organisational measures under Article 32, as set out in Annex 1;
meet the conditions in clause 5 for engaging sub-processors;
taking into account the nature of the processing, help you by appropriate technical and organisational measures, so far as possible, to respond to requests from people exercising their rights under Chapter III of the UK GDPR, mainly through the tools in your dashboard;
help you meet your obligations under Articles 32 to 36 (security, breach notification and data protection impact assessments), taking into account the nature of the processing and the information available to us;
at your choice, delete or return all personal data when we stop providing the services, and delete existing copies unless the law requires us to keep them; and
make available to you the information needed to show that we meet Article 28, and allow for and contribute to audits and inspections by you or an auditor you appoint. We will normally meet this by providing written information. Any audit or inspection is on reasonable notice, at your cost, and no more than once a year unless a breach or a regulator requires otherwise.

4. Your obligations

You will:

make sure you have a lawful basis for the personal data you put into the platform and for any use you make of it;
give your customers the information required by Articles 13 and 14, including that we process their data on your behalf. A sample privacy notice is available in your dashboard under Settings, Privacy & GDPR;
only send marketing through the platform to customers who have opted in to receive it;
keep secure any records you hold outside the platform; and
only enter personal data you are entitled to enter, and not enter special category data.

5. Sub-processors

You give us general authorisation to engage the sub-processors listed in Annex 2.

We will tell you in advance before adding or replacing a sub-processor, by email or by updating Annex 2 on this page. If you object on reasonable data protection grounds, you may cancel your subscription.

Each sub-processor is bound by data protection terms that give the same level of protection as this Agreement. We remain fully liable to you for each sub-processor's performance of its obligations.

6. Personal data breaches

We will tell you without undue delay after becoming aware of a personal data breach affecting personal data we process for you. We will give you the information you need to meet your own notification obligations, and keep you updated as we learn more.

As controller, reporting a breach to the ICO and telling affected individuals is your responsibility. We will help you do so.

7. Requests from your customers

If one of your customers contacts us to exercise their data protection rights, we will not answer the request ourselves beyond acknowledging it and directing them to you. We will pass it to you promptly.

Your dashboard lets you export your customer records and delete a customer, so that you can respond within the statutory one month. Where a request cannot be met with those tools, contact us at [email protected] and we will help. Help beyond what the platform provides may be charged at a reasonable cost.

8. International transfers

Some of our sub-processors process data outside the UK, as shown in Annex 2. Where that happens, the transfer is covered by an appropriate safeguard under the UK GDPR, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations, as set out in each sub-processor's own data processing terms.

9. Retention and deletion

Your booking and customer records are kept while your account is active. If your account closes, they are kept for six years, to meet UK business record-keeping requirements, and then permanently deleted. This matches section 14.1 of our Terms of Service.

You can delete individual customers from your dashboard at any time. If you want us to delete or return all of your customer data sooner, tell us in writing and we will do so, unless the law requires us to keep it.

10. General

Our liability under this Agreement is subject to the limits in the Terms of Service, except where the law does not allow it to be limited.

This Agreement is governed by the law of England and Wales. If this Agreement and the Terms of Service conflict, this Agreement takes priority on data protection matters.

Annex 1: Security measures

Data is held in a managed PostgreSQL database with row-level security enabled on every table. The database is not publicly accessible; all access goes through our application, which checks the groomer's login on every request so that each groomer can reach only their own records.
Dashboard access is by a private login link unique to each groomer, which expires after 30 days.
All traffic to and from the platform is encrypted in transit using TLS. Data is encrypted at rest by our infrastructure providers.
Administrative access to the platform is limited to the people who need it to run the service.
A daily backup of the database is kept in private storage with our hosting provider.
Insurance and qualification certificates submitted for verification are deleted once a verification decision is made.
We review these measures periodically and may improve them, provided the level of security is not reduced.

Annex 2: Sub-processors

Sub-processor	Purpose	Location
Supabase	Database, file storage and backups	Ireland (EU). Service logs are held in the EU.
Cloudflare	Hosting, application servers, content delivery and backup storage	Global network
Resend	Booking and account emails	United States
Twilio	Textback call forwarding and text messages	United States
Cloudinary	Image hosting, including photos uploaded by groomers and customers	United States

Stripe is not listed because it acts as an independent controller for payment data.