Data processing agreement

Who this is between

This agreement is between Implevo, which runs Simplevo Pet as the processor, and the pet-care business that uses the service as the controller ("you").

It explains how we handle personal data on your behalf. This draft sets out the structure only and will be replaced when reviewed wording is ready.

Our roles

You are the controller. You decide what personal data to collect about your customers, their pets and your staff, and why.

We are the processor. We handle that personal data only on your instructions, to provide and support the service.

Both parties aim to meet their obligations under UK GDPR.

What we process

The personal data you enter about your customers, such as contact details, and about their pets, such as care records.

Booking, invoice and payment records, documents you upload, and details of your staff members.

This processing lasts for as long as your account is open, unless you ask us to delete data earlier.

Our instructions

We process personal data only to provide, secure and support the service, and for no other purpose.

We will tell you if an instruction appears to break data protection law, and we may stop until it is resolved.

Where the law requires us to process data, we will tell you unless we are not allowed to.

Security

We use appropriate technical and organisational measures: role-based access, separation between businesses, encryption in transit, backups, and an audit trail on sensitive changes.

We keep these measures under review and train the staff who can reach personal data.

Sub-processors

We use a small number of sub-processors, such as hosting and database, email delivery, and payment providers.

We tell you about a change of sub-processor and give you the chance to object. If you object and we cannot resolve it, you may close your account.

Our sub-processors are bound by terms no weaker than this agreement.

International transfers

The service and its data are hosted in the European Union, in Frankfurt, Germany. The UK recognises the European Union as giving personal data adequate protection.

Where a sub-processor transfers data outside the UK and the European Union, we put approved safeguards in place before the transfer.

Data subject requests

The service gives you tools to export, correct and delete your customers' data.

If someone contacts us directly about data you control, we pass the request to you. We help you answer it.

Personal data breaches

We tell you without undue delay if we become aware of a breach affecting your data, and give you the information you need to meet your own reporting duties.

Deletion and return

When your account closes, you can export your data.

We then delete it, except records we must keep by law. For example, financial records may be kept for six years and are anonymised where possible.

Audit and records

We give you the information you reasonably need to show that we are meeting this agreement, and allow an audit where the law requires one.

Contact

Speak to your usual Implevo contact if you have a question about this agreement.