Data Processing Agreement

How we process personal data on your behalf

1. Scope and roles

1.1 This Data Processing Agreement ("DPA") applies when UPMYB processes personal data contained in Customer Data on behalf of the Customer. The Customer is the controller and UPMYB is the processor.

1.2 It forms part of the Terms of Service. If it conflicts with them on data protection matters, this DPA applies.

2. Instructions

2.1 UPMYB will process personal data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use of the product, unless the law requires otherwise.

2.2 UPMYB will tell the Customer if it believes an instruction breaks data protection law.

3. Details of processing

3.1 Purpose: providing UPMYB, including storing contacts, running Flows and sending messages the Customer asks for.

3.2 Duration: for as long as the Customer uses UPMYB, plus the deletion period in this DPA.

3.3 Data subjects: the Customer’s customers, leads, staff and other contacts.

3.4 Types of data: names, phone numbers, email addresses, message content, booking and payment status, and any other data the Customer chooses to add.

4. Confidentiality

4.1 UPMYB makes sure people who access personal data are bound by confidentiality and only access it as needed.

5. Security

5.1 UPMYB maintains technical and organisational measures appropriate to the risk, including encryption in transit, access controls, separation of customer data, secure credential storage and logging.

5.2 UPMYB will tell the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information it has to help the Customer meet its duties.

6. Subprocessors

6.1 The Customer allows UPMYB to use the subprocessors listed on the Subprocessors page. UPMYB will tell the Customer before adding or replacing one. The Customer may object on reasonable data protection grounds within 14 days.

6.2 UPMYB stays responsible for its subprocessors and uses written terms with them that give the same level of protection.

7. Help with requests and audits

7.1 UPMYB will reasonably help the Customer respond to requests from people exercising their data rights, and with impact assessments and consultations with authorities, taking the nature of processing into account.

7.2 UPMYB will provide information that shows it follows this DPA and will allow reasonable audits, no more than once a year, at the Customer’s cost and with advance notice.

8. International transfers

8.1 Where personal data is transferred to another country, UPMYB will make sure an appropriate transfer mechanism is in place as the applicable law requires.

9. Deletion and return

9.1 When the Customer’s account ends, UPMYB will make Customer Data available for export for 30 days and then delete it, unless the law requires it to be kept.