Data Processing Addendum
This Data Processing Addendum ("Addendum") forms part of the Terms of Service between PETSAppeal LLC ("PETSAppeal," "we," "us") and the business customer agreeing to those terms ("Customer," "you"). It applies where PETSAppeal processes personal data on your behalf in the course of providing the PETSAppeal platform (the "Service"), and where that processing is subject to the EU General Data Protection Regulation (GDPR), the UK GDPR, or comparable data-protection law.
1. Roles of the parties
For personal data you or your clients enter into the Service about your clients and their pets ("Customer Personal Data"), you are the data controller and PETSAppeal is the data processor. You determine the purposes and means of the processing; PETSAppeal processes Customer Personal Data only to provide the Service and only on your documented instructions, including as set out in this Addendum and the Terms of Service.
2. Your data is yours
Customer Personal Data belongs to you. PETSAppeal does not own it, does not sell or rent it, and does not use it for its own purposes. In particular, PETSAppeal will not market to, solicit, or contact your clients for PETSAppeal's own benefit or for the benefit of any other business on the platform, and will not disclose Customer Personal Data to any other business on the platform except where your client, acting on their own initiative, chooses to move their own records to another provider through the client portal.
3. Processing only on your instructions
PETSAppeal processes Customer Personal Data only to deliver and support the Service, to comply with law, and on your further documented instructions. If PETSAppeal is legally required to process Customer Personal Data for any other purpose, it will inform you first unless the law prohibits it.
4. Confidentiality
PETSAppeal ensures that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and access the data only as needed to provide the Service. Access is restricted and logged.
5. Security
PETSAppeal maintains appropriate technical and organizational measures designed to protect Customer Personal Data against unauthorized access, loss, or disclosure, taking account of the state of the art and the nature of the data. These measures include encryption of data in transit, access controls and role-based permissions, audit logging of access to sensitive data, and encryption of stored third-party credentials. A summary is set out in Annex II.
6. Sub-processors
You authorize PETSAppeal to engage the sub-processors listed in Annex III to process Customer Personal Data in connection with the Service. PETSAppeal imposes data-protection obligations on each sub-processor no less protective than those in this Addendum and remains responsible for their performance. PETSAppeal will give you notice before adding or replacing a sub-processor and a reasonable opportunity to object.
7. Assisting you
Taking into account the nature of the processing, PETSAppeal will assist you, so far as reasonably possible, in responding to requests from data subjects exercising their rights (such as access, correction, deletion, and portability), and in meeting your obligations around security, breach notification, and data-protection impact assessments. The Service includes tools that let you export and delete client data directly.
8. Personal data breaches
PETSAppeal will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably available to help you meet your own notification obligations.
9. Return or deletion
On termination of the Service, PETSAppeal will, at your choice, return or delete Customer Personal Data, except where retention is required by law or, in the case of records whose integrity must be preserved (such as verified veterinary records), as described in the Service's record-retention model.
10. Audits
PETSAppeal will make available information reasonably necessary to demonstrate compliance with this Addendum and will allow for and contribute to audits or inspections conducted by you or an auditor you mandate, subject to reasonable confidentiality and security conditions.
11. International transfers
Where Customer Personal Data is transferred out of the EEA or the UK to a country without an adequacy decision, the transfer is made under the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies, which are incorporated into this Addendum by reference.
12. Your responsibilities
You are responsible for ensuring you have a lawful basis to collect and process Customer Personal Data and to enter it into the Service, and that your instructions to PETSAppeal comply with applicable law.
13. General
This Addendum forms part of and is governed by the Terms of Service, including its governing-law provisions. If there is a conflict between this Addendum and the Terms of Service regarding the processing of Customer Personal Data, this Addendum controls.
Annex I — Details of processing
Subject matter: provision of the PETSAppeal platform. Duration: for the term of the Service. Nature and purpose: hosting, storing, and processing client and pet records to enable pet-care business management. Categories of data subjects: your clients (pet owners) and their designated contacts. Types of personal data: names, contact details, addresses, pet records and related notes, appointment and reservation history, and billing information.
Annex II — Security measures
Encryption of data in transit (enforced HTTPS); role-based access controls and per-business data isolation; audit logging of authentication and access to sensitive records; encryption at rest of stored third-party credentials; and restricted, logged administrative access.
Annex III — Sub-processors
- Cloud hosting infrastructure (Cloudways/DigitalOcean)