Data Processing Agreement

2.1 Controller and Processor

The parties agree that:

• Controller is the data controller for Customer Personal Data
• Processor is the data processor, processing Customer Personal Data on Controller's behalf

2.2 Scope of Processing

This DPA applies to:

• Personal data of Controller's end-customers (people booking appointments)
• Personal data processed through the Platform on Controller's behalf

2.3 Processor's Role as Controller

Processor acts as an independent controller for:

• Controller's administrator and staff account data
• Billing and subscription data
• Platform usage analytics (anonymised)
• Communications with Controller's representatives
• Platform feedback requests to end-customers (see Section 2.4)

2.4 Platform Feedback Communications

Controller acknowledges that Processor may, as an independent controller, contact end-customers by email to request feedback about the Platform experience. This processing is based on Processor's legitimate interest in improving the Platform.

3.1 Subject Matter

Provision of online booking platform services, including appointment scheduling, customer management, and payment processing.

3.2 Duration

Processing continues for the duration of the Agreement, plus any retention period required by law or specified herein.

3.3 Nature and Purpose

3.4 Categories of Data Subjects

• Controller's end-customers (people booking appointments)
• Walk-in customers whose details are entered manually

3.5 Categories of Personal Data

3.6 Special Categories

Processor does not intentionally process special category data (health, religion, etc.). If Controller collects such data (e.g., in booking notes), Controller is solely responsible for ensuring a lawful basis.

4.1 Lawful Processing

• Controller has a lawful basis for collecting and sharing Personal Data with Processor
• Controller has provided appropriate privacy notices to Data Subjects
• Controller has obtained necessary consents where required

4.2 Instructions

• Controller's instructions to Processor are lawful under Applicable Data Protection Law
• Controller will not instruct Processor to process data in a manner that violates law

4.3 Data Accuracy

• Controller is responsible for the accuracy of Personal Data provided
• Controller will notify Processor of corrections as needed

4.4 Data Subject Rights

• Controller is responsible for responding to Data Subject requests
• Controller will instruct Processor to assist with such requests

4.5 Compliance

• Controller will comply with Applicable Data Protection Law
• Controller will maintain appropriate records of processing activities

5.1 Processing Instructions

Processor shall:

• Process Personal Data only on Controller's documented instructions
• Inform Controller if an instruction infringes Applicable Data Protection Law
• Not process Personal Data for any purpose other than providing the Services

Documented Instructions: The Agreement, this DPA, Controller's use of Platform features, and written instructions from Controller constitute documented instructions.

5.2 Confidentiality

Processor shall ensure that persons authorised to process Personal Data:

• Are subject to confidentiality obligations
• Process data only as instructed
• Receive appropriate data protection training

5.3 Security Measures

Processor shall implement appropriate technical and organisational measures, including:

5.5 Assistance with Data Subject Rights

Upon Controller's request, Processor shall assist with:

• Responding to Data Subject access requests
• Rectification, erasure, or restriction of processing
• Data portability requests
• Objections to processing

Processor may charge reasonable fees for assistance beyond standard Platform features.

5.7 Personal Data Breaches

In the event of a Personal Data Breach affecting Controller's data:

Processor will cooperate with Controller's breach response and notifications to supervisory authorities or Data Subjects.

5.8 Data Deletion

Upon termination of the Agreement:

• Processor will delete Controller's Personal Data within 90 days
• Controller may request data export before deletion (within 30 days of termination)
• Processor may retain data as required by law (with notice to Controller)
• Backup copies will be purged within 180 days

5.9 Audit and Inspection

Processor shall:

• Make available information necessary to demonstrate compliance
• Allow for and contribute to audits and inspections by Controller or Controller's auditor
• Provide audit reports, certifications, and security assessments upon request

6.1 Authorised Sub-Processors

Controller provides general authorisation for Processor to engage Sub-Processors listed in Annex B.

6.2 Sub-Processor Requirements

Processor shall:

• Enter into written agreements with Sub-Processors imposing equivalent obligations
• Remain liable for Sub-Processor compliance
• Conduct due diligence on Sub-Processor security

6.3 Changes to Sub-Processors

Before engaging a new Sub-Processor:

1. Processor will notify Controller at least 30 days in advance
2. Notification will include Sub-Processor name, location, and processing activities
3. Controller may object in writing within 14 days with reasonable grounds
4. If objection cannot be resolved, Controller may terminate affected Services

6.4 Current Sub-Processors

See Annex B for the current list of authorised Sub-Processors, or visit /subprocessors.

7.1 Transfer Restrictions

Processor shall not transfer Personal Data outside the UK/EEA unless:

• An adequacy decision applies to the destination country
• Appropriate safeguards are in place (Standard Contractual Clauses)
• A derogation applies under Applicable Data Protection Law

7.2 Current Transfers

7.3 Standard Contractual Clauses

Where required, the parties agree to the UK International Data Transfer Agreement (IDTA) or EU SCCs with UK Addendum, as applicable.

7.4 Additional Measures

Processor implements supplementary measures including:

• Encryption of data in transit and at rest
• Access controls and authentication
• Pseudonymisation where feasible
• Assessment of destination country laws

8.1 Liability Allocation

Each party is liable for its own breaches of Applicable Data Protection Law. Controller acknowledges that Processor processes Personal Data solely on Controller's instructions and Controller remains primarily responsible for compliance with data protection obligations relating to Customer Data.

8.2 Controller Indemnification

Controller shall indemnify Processor from claims, damages, losses, fines, and expenses arising from:

• Controller's breach of this DPA or the Agreement
• Controller's breach of Applicable Data Protection Law
• Controller's unlawful, inaccurate, or inadequate processing instructions
• Controller's failure to obtain valid consent or establish a lawful basis
• Controller's failure to provide adequate privacy notices to Data Subjects
• Controller's failure to respond to Data Subject requests in accordance with law
• Claims by Data Subjects arising from Controller's acts or omissions
• Fines or enforcement actions by the ICO arising from Controller's acts or omissions

8.3 Processor Indemnification

Processor shall indemnify Controller from claims, damages, losses, fines, and expenses arising from:

• Processor's breach of this DPA (where Processor acts outside Controller's documented instructions)
• Processor's breach of its security obligations under Section 5.3
• Processor's failure to notify Controller of a Personal Data Breach as required
• Fines imposed directly on Processor by a supervisory authority for Processor's own breach

8.5 Limitation

Subject to Sections 8.2 and 8.3, liability under this DPA is subject to the limitations in the Agreement, except:

• Controller's indemnification obligations under Section 8.2 are not subject to the liability cap
• Processor's liability for data protection breaches within Processor's control is capped at the greater of: (a) fees paid in the preceding 12 months, or (b) £50,000
• Liability for wilful misconduct, gross negligence, or fraud is not limited

9.1 Term

This DPA remains in effect for the duration of the Agreement and any period during which Processor retains Personal Data.

9.2 Termination

This DPA terminates automatically when:

• The Agreement terminates; and
• All Personal Data has been deleted or returned

9.3 Survival

Sections relating to confidentiality, liability, and data retention survive termination.

Annex A: Processing Details

Annex B: Authorised Sub-Processors

Controller will be notified of Sub-Processor changes via email. Current list is also available at trimlinea.co.uk/subprocessors.

Annex C: Technical and Organisational Measures