When you store details of your clients, their pets and your staff in Pet Sitter Plus, you are the controller of that personal data and Pet Software Limited ("PSL", "we", "us") is your processor. These Data Processing Terms set out how we handle that data on your behalf.
These terms are Schedule 1 of the Pet Sitter Plus Subscriber Terms and Conditions (the "Agreement"). You agree to them when you accept the Agreement; there is nothing separate to sign. They are published here so they are easy to find and share with your own clients or auditors. If this page and the Agreement ever differ, the Agreement prevails.
Words with capital letters, and references to clauses, have the meanings given in the Agreement.
Our role as controller. We are also a controller of the personal data we hold about you and your Authorised Users to run your account, billing, security and fraud prevention. That is covered by our Privacy Policy, not by these terms.
Details of processing
This Schedule applies where PSL processes personal data as your processor under clause 9.3. It is intended to meet Article 28 of the UK GDPR and, where it applies, the EU GDPR.
Subject matter and duration: Providing the Services for the term of the Agreement and the export period in clause 19.2
Nature and purpose: Hosting, storing, organising, displaying and transmitting data so you can schedule visits, manage clients and staff, invoice and take payments
Data subjects: End Customers, their contacts, and your staff and contractors
Personal data: Names, addresses, contact details, key and access instructions, pet details, booking history, invoices and payment records (card and PayPal account details are held by Stripe or PayPal, not PSL), staff schedules, GPS and visit records [if used]
Special category data: None intended. You must not enter health or other special category data about people unless it is necessary and lawful
PSL's obligations
-
PSL will process the personal data only on your documented instructions. This Agreement and your use of the Services are your instructions. If PSL is required by law to process it otherwise, PSL will tell you first unless the law forbids it.
-
PSL will ensure that people authorised to process the personal data are bound by confidentiality.
-
PSL will maintain appropriate technical and organisational security measures under Article 32, including encryption in transit, role-based access controls, multi-factor authentication for PSL staff, logging and regular backups.
-
Sub-processors. You authorise PSL to use the sub-processors listed under "Sub-processors" below, as updated on the Website from time to time. PSL will give you at least 14 days' notice of any new sub-processor. If you object on reasonable data protection grounds, you may end the Agreement before the change takes effect. PSL will impose equivalent data protection terms on each sub-processor and remain responsible for them.
-
PSL will help you, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights.
-
PSL will help you meet your obligations on security, personal data breach notification, data protection impact assessments and prior consultation.
-
Breaches. PSL will notify you without undue delay, and in any event within [48] hours, after becoming aware of a personal data breach affecting your personal data. PSL will give you the information it reasonably can to help you meet your own obligations.
-
End of processing. At the end of the Agreement, PSL will return or delete the personal data as set out in clause 19.2, unless the law requires PSL to keep it.
-
Audit. PSL will make available the information needed to show compliance with this Schedule, and will allow and contribute to reasonable audits by you or your auditor. Audits require at least 30 days' notice, may take place no more than once a year unless there has been a breach, and are at your cost.
International transfers
PSL hosts Subscriber Data in the AWS region for your location, as shown in the sub-processor list below. PSL staff in the UK may access it to provide and support the Services, and sub-processors may process it in the locations shown. Where Data Protection Law requires it, PSL will use an appropriate safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses.
Your obligations
You confirm that you have a lawful basis for the processing and have given data subjects the information Data Protection Law requires. You will comply with the privacy laws of your own country, such as the Australian Privacy Act 1988 or US state privacy laws, where they apply to you.
Sub-processors
PSL uses these sub-processors at the date of this Agreement. The current list is always on our Sub-processors page.
Sub-processor | Purpose | Data location |
|---|---|---|
Amazon Web Services | Hosting, database and backups for the Pet Sitter Plus platform | Depends on where you are based: UK, Ireland and UAE — EU (Ireland); US and Canada — US East (N. Virginia); Australia and New Zealand — Asia Pacific (Sydney) |
Microsoft 365 | Our staff email and documents, including support emails that may contain subscriber data | United Kingdom |
Freshdesk (Freshworks) | Customer support tickets, which may contain subscriber data | European Economic Area |
Where a sub-processor holds data outside the UK, the transfer safeguards in paragraph 10 apply.
PSL also uses Zoho CRM, QuickBooks Online and Freshdesk to manage its relationship with you and its own accounts. For that data PSL is a controller, as described in its Privacy Policy, so those uses are not sub-processing under this Schedule.
Services you connect yourself. Stripe, PayPal, QuickBooks Online, and Microsoft, Google or SMTP email accounts that you link to Pet Sitter Plus are your suppliers, not PSL's sub-processors (clause 11.7).
Questions and objections
To ask about these terms, or to object to a new sub-processor, email support@petsitterplus.com with "Data processing" in the subject line.