Data Processing Agreement

1. Introduction and roles

This Data Processing Agreement (“DPA”) applies wherever Where Beagles Dare Ltd (“WBD”, “we”, “us”) processes personal data on behalf of a customer through Vidual Inbox (“the Service”).

In respect of that personal data, the customer is the controller and WBD is the processor. Vidual Inbox is a shared team inbox, so the personal data WBD processes on the customer’s behalf includes the customer’s own end-customers’ emails, Instagram Direct Messages and live-chat conversations.

This DPA forms part of, and is governed by, the Terms of Service. It takes effect when the customer uses the Service to process personal data. A countersigned copy is available on request to hello@vidualapp.com.

2. Definitions

In this DPA:

• Controller, processor, personal data, processing, data subject and personal data breach have the meanings given in applicable data protection law.
• Sub-processor means any third party engaged by WBD to process personal data in the course of providing the Service.
• UK GDPR means the United Kingdom General Data Protection Regulation as it forms part of UK law.
• Data Protection Act 2018 means the UK statute of that name.
• Applicable data protection law means the UK GDPR, the Data Protection Act 2018, and any other data protection or privacy law that applies to WBD’s processing under this DPA.

3. Scope and roles of processing

WBD processes personal data only to provide the Service, and only on the customer’s documented instructions. Those instructions are the Terms of Service, this DPA, and the customer’s use of the Service, together with any further written instructions the customer gives that are consistent with them.

WBD will not process the personal data for any other purpose unless required to do so by law, in which case WBD will inform the customer of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest.

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

4. Processor obligations

WBD will:

1. Documented instructions. Process the personal data only on the customer’s documented instructions, as described in section 3.
2. Confidentiality. Ensure that persons authorised to process the personal data are bound by an appropriate duty of confidentiality.
3. Security. Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex 2.
4. Sub-processors. Respect the conditions for engaging sub-processors set out in section 6.
5. Data-subject requests. Taking into account the nature of the processing, assist the customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects exercising their rights.
6. Assistance. Assist the customer in ensuring compliance with its obligations relating to security of processing, personal data breach notification, data protection impact assessments and prior consultation with the supervisory authority, taking into account the nature of processing and the information available to WBD.
7. Deletion or return. At the customer’s choice, delete or return all personal data to the customer after the end of the provision of the Service, and delete existing copies unless storage is required by law. The customer may also direct deletion of personal data at any time during the term.
8. Audits. Make available to the customer the information necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by the customer or an auditor it mandates. Audits are subject to reasonable advance notice, appropriate confidentiality obligations, and the customer’s cost beyond a standard information request, and must not unreasonably disrupt WBD’s operations or compromise the security of other customers’ data.

5. Personal data breach

WBD will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer’s personal data. The notification will include the detail then available to WBD, and WBD will provide further information as it becomes available. WBD will cooperate with the customer and take reasonable steps to assist the customer in its own notifications to its supervisory authority and to affected data subjects.

6. Sub-processors

The customer gives general authorisation for WBD to engage the sub-processors listed on the sub-processors page. WBD imposes data-protection obligations on each sub-processor that are equivalent to those set out in this DPA, and remains responsible for each sub-processor’s performance of those obligations.

WBD will give the customer at least 30 days’ notice of any intended addition or replacement of a sub-processor, via the sub-processors page and/or by email. The customer may object on reasonable data-protection grounds within that notice period. If the matter is not resolved, the customer may terminate the affected part of the Service.

7. International transfers

Where personal data is transferred outside the United Kingdom, WBD ensures an appropriate safeguard is in place under the UK GDPR. Depending on the destination and sub-processor, this is the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or reliance on a UK adequacy decision or the UK extension to the EU–US Data Privacy Framework where applicable. The transfer safeguard for each sub-processor is identified on the sub-processors page.

8. Liability

Each party’s liability under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

9. Term and termination

This DPA takes effect as set out in section 1 and continues for as long as WBD processes personal data on the customer’s behalf; it is coterminous with the Terms of Service. On termination, the deletion-or-return obligations in section 4(g) apply.

10. Governing law

This DPA is governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

Annex 1 — Details of processing

Subject matter: the provision of the Service to the customer.

Duration: the term of the agreement between the customer and WBD.

Nature and purpose of processing: providing a shared team inbox across email, Instagram Direct Messages and live chat — receiving, displaying, organising, storing and enabling replies to inbound customer conversations, and the related features described in the Privacy Policy and Terms of Service.

Types of personal data: end-customers’ names, email addresses, message content, Instagram usernames, Instagram-scoped user IDs and profile data, attachment references, phone numbers where provided, and conversation metadata (such as status, assignment, tags and internal notes).

Categories of data subjects: the customer’s end-customers and correspondents, and the customer’s own team members.

Annex 2 — Technical and organisational measures

WBD maintains technical and organisational security measures including:

• Encryption of personal data in transit using HTTPS/TLS.
• Encryption of personal data at rest, including AES-256-GCM encryption of OAuth tokens for connected integrations.
• Passwordless authentication using passkeys and magic links; passwords are never stored.
• Least-privilege, restricted access controls for production systems and data.
• Encrypted backups.
• Regular review of security controls and infrastructure.
• Due-diligence assessment of sub-processors before engagement.

Annex 3 — Sub-processors

The current list of sub-processors engaged by WBD, with their purpose, location and transfer safeguard, is maintained on the sub-processors page.