GroomSlot

Data Processing Agreement

Last Updated: 06/08/2026

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the GroomSlot Terms of Service between GroomSlot (operated by Alex Cox, a sole trader based in the United Kingdom) and the business or individual using the Service ("you"). It records the terms on which GroomSlot processes personal data on your behalf under Article 28 of the UK GDPR.

Where this DPA conflicts with the rest of the Terms of Service on the processing of personal data, this DPA prevails.

1. Definitions

The terms "controller", "processor", "data subject", "personal data", "processing", and "personal data breach" have the meanings given in UK Data Protection Laws.

  • "UK Data Protection Laws" means the UK GDPR and the Data Protection Act 2018, together with any other applicable data protection or privacy laws.
  • "Customer Personal Data" means personal data that GroomSlot processes on your behalf in providing the Service.
  • "Sub-processor" means any third party engaged by GroomSlot to process Customer Personal Data.

2. Roles of the Parties

For Customer Personal Data, you are the controller and GroomSlot is the processor. You are responsible for the lawfulness of the personal data you provide and of the instructions you give, including having a valid lawful basis for any marketing you send through the Service and for honouring opt-out requests.

GroomSlot acts as an independent controller for a limited set of data described in its Privacy Policy (such as account administration, billing, and its own marketing). That processing is governed by the Privacy Policy, not this DPA.

3. Details of Processing

  • Subject matter: GroomSlot's provision of the Service to you.
  • Duration: for the term of the Terms of Service, and until Customer Personal Data is deleted or returned in accordance with Section 11.
  • Nature and purpose: hosting, storing, and processing Customer Personal Data to operate the Service, including bookings, customer and pet records, payments, and communications you choose to send.
  • Types of personal data: names, contact details (email, phone, address), pet details, appointment and booking history, payment-related information, and the content of communications you send.
  • Categories of data subjects: your clients and their contacts.

4. Processing on Your Instructions

GroomSlot will process Customer Personal Data only on your documented instructions, including the instructions set out in the Terms of Service and this DPA and those you give through your use of the Service, unless required to do otherwise by law (in which case GroomSlot will inform you unless the law prohibits it). GroomSlot will inform you if, in its opinion, an instruction infringes UK Data Protection Laws.

5. Confidentiality

GroomSlot ensures that persons authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality.

6. Security

GroomSlot implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the state of the art and the nature of the data. A description of these measures is set out in the Privacy Policy and includes encryption in transit, access controls, authentication, monitoring, and regular backups.

7. Sub-processors

You provide general authorisation for GroomSlot to engage sub-processors to process Customer Personal Data. GroomSlot maintains a current list of its sub-processors in its Privacy Policy.

GroomSlot imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible for its sub-processors' performance. GroomSlot will give you reasonable notice of any intended addition or replacement of a sub-processor, giving you the opportunity to object on reasonable data protection grounds.

8. Assisting with Data Subject Rights

Taking into account the nature of the processing, GroomSlot will assist you by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights under UK Data Protection Laws. If GroomSlot receives such a request directly, it will refer the data subject to you and not respond on your behalf except on your instruction.

9. Personal Data Breaches

GroomSlot will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide reasonable information and assistance to help you meet your own breach notification obligations.

10. Data Protection Impact Assessments

GroomSlot will provide reasonable assistance with data protection impact assessments and prior consultation with the Information Commissioner's Office, where required and taking into account the nature of the processing and the information available to GroomSlot.

11. Return and Deletion

On termination of the Service, GroomSlot will delete or return Customer Personal Data in accordance with the retention periods set out in the Terms of Service and Privacy Policy, and delete existing copies unless UK law requires continued storage.

12. Audits and Information

GroomSlot will make available to you information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable notice, confidentiality, and frequency limits.

13. International Transfers

Where GroomSlot or its sub-processors transfer Customer Personal Data outside the United Kingdom, appropriate safeguards recognised under UK Data Protection Laws (such as UK adequacy regulations or the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses) are put in place, as described in the Privacy Policy.

14. Liability and Precedence

This DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. In the event of a conflict between this DPA and the rest of the Terms of Service regarding the processing of Customer Personal Data, this DPA prevails.

15. Governing Law

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction, consistent with the Terms of Service.