Data processing agreement

This is the agreement under which we process personal data on your behalf. It is the contract that Article 28 of the UK GDPR requires between a controller and a processor, and it is written to be read. If a sentence here and a sentence in our terms disagree about personal data, this agreement wins.

1. Who this is between, and how it applies

The processor is PromptWorks AI Ltd (“we”), a private limited company registered in England and Wales under company number 17305850, registered office 66 Paul Street, London, England, EC2A 4NA, ICO registration ZC229196. The controller is the business that holds a DogBoarder organisation account (“you”).

This agreement forms part of our terms of service and applies to every organisation account automatically from the moment the account is created. There is nothing to sign and nothing to request. If you need a countersigned copy for your own records, ask at hello@dogboarder.uk and we will provide one.

“UK GDPR” means the UK General Data Protection Regulation as it forms part of the law of England and Wales, read with the Data Protection Act 2018. “Personal data”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings the UK GDPR gives them.

2. What we process, for how long, and why

Subject matter. The personal data you enter into DogBoarder, or that your clients enter through the owner portal, in the course of running a dog boarding, day care or walking business.

Duration. For as long as you hold an account, and afterwards for as long as we hold any of your data under clause 12.

Nature. Storing, organising, retrieving, displaying, exporting and backing up the data; deriving the statutory register and the inspection pack from it; sending the transactional emails the service needs to send; and deleting or anonymising it when this agreement says so.

Purpose. To provide DogBoarder to you, and nothing else. We do not use your data for our own purposes, do not sell it, and do not use it to train machine-learning models.

3. Whose data, and what data

Categories of data subject: your clients (dog owners), their emergency contacts, the vets they name, and your own staff and other users of your organisation account.

Categories of personal data: names; contact details; postal addresses; key-safe codes and access instructions; dog records that identify an owner, including vaccination, medication and behaviour notes; consent records; booking and payment records; care logs and incident records; and the uploaded files that go with any of them, such as vaccination cards and photographs.

We do not ask you to record special category data about people. If a dog's record or a care note happens to reveal something about its owner's health, you are the controller of that and should record only what you need.

4. Your instructions

We process personal data only on your documented instructions. Using the service is that instruction: when you or your staff create, edit, export or delete a record, or turn on a feature such as booking reminders, you are instructing us to do the processing that feature involves. This agreement and the terms are the rest of the written instructions.

We will not process your data for anything else unless the law of the United Kingdom requires us to, in which case we will tell you before we do it, unless that law prohibits us from telling you.

If we think an instruction of yours would break the UK GDPR or other data protection law, we will tell you straight away rather than quietly carry it out.

5. Confidentiality of our people

Everyone who works for us and could see your data is bound by a written duty of confidentiality, and has access only to what their work needs. Access to production systems is limited to the people who operate them, and revealing a key-safe code or access instruction is logged against the person who did it, whoever they work for.

6. Security

We take the technical and organisational measures the UK GDPR requires, and the security and data residency page describes them as they run today. The ones we commit to under this agreement are:

• Tenant isolation by row-level security enforced by the database itself, with an application role that is not permitted to bypass it and a check at start-up that refuses to run if that ever changes.
• Field-level AES-256-GCM encryption of key-safe codes and access instructions, with every read of one written to the audit trail, and both excluded from every export.
• An append-only audit trail written by the database, which the application cannot update or delete; soft deletion first, always; care logs and incidents that cannot be edited in place.
• Sessions held in http-only cookies, never in browser storage, and no passwords stored because none are used.
• Personal data scrubbed from error reports before they leave the server, and a logging layer that redacts personal fields as a backstop.
• Encryption in transit (TLS) and at rest for the database and for uploaded files, which are served only through short-lived signed links.
• Continuous backup with point-in-time restore for the database, in the same London region as the database itself.

We will not weaken any of these without telling you first. We may add to them at any time.

7. Subprocessors

You authorise us to use the subprocessors on our subprocessor list, which says what each one does, where it does it, and under what transfer safeguard. We put each of them under written terms that impose data protection obligations at least as protective as the ones in this agreement, and we remain fully responsible to you for what they do.

Before we add a subprocessor or replace one, we will give you at least 14 days' notice by email to the administrators of your organisation. If you object on reasonable data protection grounds and we cannot resolve it, you may terminate your account without penalty before the change takes effect, and clauses 12 and 13 apply to what happens to your data.

8. International transfers

Your records, your uploaded files and the application itself stay in the United Kingdom and the European Economic Area, and we will not move them outside it without your prior written agreement.

There is one transfer to a third country, and we name it rather than bury it. Transactional email — sign-in links, booking reminders, inspector access grants, waitlist offers — is sent through Resend, which dispatches it from Ireland but stores message content, metadata and delivery logs in the United States. That transfer is made under the UK Addendum to the EU Standard Contractual Clauses incorporated in Resend's data processing agreement, and under Resend's certification to the EU-U.S. Data Privacy Framework with its UK extension. If either safeguard ceases to be valid, we will tell you and put an alternative in place or stop the transfer.

9. Helping you with people's rights

If a data subject contacts us directly about data you control, we will pass the request to you without answering it ourselves, unless the law requires us to answer. If you receive a request — for access, rectification, erasure, restriction, portability or objection — we will give you the help you need to respond within 5 working days of you asking us.

For most requests you will not need to ask. An administrator can download everything the organisation holds from Settings at any time, as CSV and JSON in one zip, including while the account is read-only, and can correct or delete records in the app.

Erasure has one limit set by law rather than by us. Records of licensed animal activities must be kept for three years, and an erasure request therefore purges everything except the minimum statutory register fields. When we carry one out we will tell you exactly what remained and why, so you can tell the person asking.

10. Personal data breaches

If we become aware of a personal data breach affecting your data, we will notify the administrators of your organisation by email without undue delay, and in any event within 48 hours of becoming aware. The notice will say what we know at that point — what happened, which data and roughly how many people are affected, what we are doing about it and what we suggest you do — and we will keep updating it as we learn more. We will not wait until we have a complete picture before telling you.

We will give you the information you need to notify the Information Commissioner's Office and affected people if you have to, and we will not tell a supervisory authority or the affected people about a breach of your data ourselves unless the law requires us to.

11. Impact assessments and consultations

Taking into account the nature of the processing and what we know, we will help you meet your own obligations on security, on data protection impact assessments, and on prior consultation with the Information Commissioner's Office, where you need information about how we process your data to do so.

12. Deletion and return

You can export everything at any time under clause 9, so you never have to ask us to return your data. When your account ends, for whatever reason, we do not delete your records and we do not lock you out of them: the account becomes read-only and you keep full ability to open, print and export, including the statutory register.

If, after your account has ended, you ask us in writing to delete your data, we will delete it within 30 days of the request, subject to one exception: the minimum statutory register fields, which the law requires to be kept for three years from their creation and which we retain for that period and no longer. We will confirm the deletion in writing and tell you what was retained and until when. Backup history expires on its normal cycle rather than being edited, and a backup is restored only to recover from a failure or to test that recovery works.

13. Audits and information

We will make available to you the information you need to demonstrate that we are meeting our obligations as your processor under Article 28. The security page, the subprocessor list and this agreement are the starting point; ask for anything they do not cover.

You, or an auditor you appoint who is not a competitor of ours, may audit our compliance with this agreement on at least 30 days' written notice, no more than once in any 12-month period unless a supervisory authority requires otherwise or a breach of your data has occurred. Audits are at your cost, during normal business hours, conducted so as not to disrupt the service or expose other customers' data, and everything you learn is confidential. We will tell you straight away if an audit request would, in our view, infringe the UK GDPR.

14. Liability

Liability under this agreement is subject to clause 8 of our terms, which caps our total liability to you and excludes lost profits and lost business, and which does not limit anything that cannot lawfully be limited. Nothing in this clause reduces either party's responsibility to data subjects or to a supervisory authority under the UK GDPR.

15. Term, changes and law

This agreement starts when your organisation account is created and continues for as long as we process personal data on your behalf, including under clause 12 after the account has ended. If we change it, we will give the administrators of your organisation at least 30 days' notice by email, and you may terminate before the change takes effect if you do not agree. The version number at the top changes when the substance does.

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over it.

Contact

Anything about this agreement, a breach, a request, or a subprocessor objection: hello@dogboarder.uk. A real person reads it.