Draft for solicitor review. Structured on UK GDPR Article 28. A solicitor must confirm the transfer mechanism for US sub-processors (clause 8), the breach timing (clause 9) and the audit clause (clause 11) before a health business signs. Not legal advice.

Data processing agreement

Last updated 13 October 2026. Version 0.1 (draft). Forms part of the terms of service.

1. Parties and roles

This agreement is between the business that has accepted the terms of service (the "Controller") and [Company name] trading as Popagain (the "Processor"). The Controller determines the purposes and means of processing its customers' personal data; the Processor processes that data only on the Controller's documented instructions as set out here and in the service's settings.

2. Definitions

"Customer Data" means personal data about the Controller's customers that the Controller or its systems give to the Processor, and data derived from it in the course of the service. "UK GDPR", "personal data", "processing", "controller", "processor", "sub-processor" and "personal data breach" have the meanings in the Data Protection Act 2018 and the UK GDPR.

3. Details of processing (Annex 1)

4. Processor's obligations

The Processor shall:

1. process Customer Data only on the Controller's documented instructions, including transfers outside the UK, unless required by law, in which case it will tell the Controller first where the law allows;
2. tell the Controller immediately if, in its opinion, an instruction infringes data protection law;
3. ensure that people authorised to process Customer Data are bound by confidentiality;
4. implement the technical and organisational measures in Annex 2 and keep them under review;
5. engage sub-processors only under clause 7;
6. assist the Controller, by appropriate technical and organisational measures, in responding to data subject rights requests (clause 10);
7. assist the Controller with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to the Processor;
8. at the end of the service, delete Customer Data in accordance with clause 12;
9. make available the information needed to demonstrate compliance and allow audits under clause 11.

5. Controller's obligations

The Controller shall ensure it has a lawful basis for the processing, including for contacting its customers by SMS or email in accordance with the Privacy and Electronic Communications Regulations; provide only the Customer Data described in Annex 1; not send special-category data beyond what is inherent in a visit having happened; complete a data protection impact assessment before onboarding where the processing is a health setting; and give instructions that comply with the law.

6. What the Processor will never do with Customer Data

• Send more than two messages per visit, or any message other than the request and reminder.
• Contact a customer who has opted out, from any business using the service.
• Route customers to different destinations based on sentiment, or offer anything in connection with a review.
• Attempt to identify which customer left which public review.
• Use Customer Data to train a model, for its own marketing, or for any purpose of its own.
• Log names, contact details or message text.

7. Sub-processors

The Controller gives general authorisation to the sub-processors listed in Annex 3. The Processor will give the Controller at least 30 days' notice by email of any intended addition or replacement, during which the Controller may object on reasonable data protection grounds; if the objection cannot be resolved the Controller may terminate the service and receive a pro-rata refund. The Processor imposes on each sub-processor data protection obligations no less protective than this agreement and remains liable for their performance.

8. International transfers

Customer Data is stored and processed in [the United Kingdom]. Three sub-processors (Twilio, Resend, Anthropic) are established in the United States and may process data there. Transfers to them are made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision where one applies [solicitor to confirm the mechanism for each and the transfer risk assessment]. The data sent to each is limited to what Annex 3 states.

9. Personal data breach

The Processor will notify the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data, by email to the alert address on the account, giving the information the Controller needs to meet its own notification duties, and will cooperate with the Controller's response. [Solicitor: confirm 48 hours is acceptable to health-sector controllers; some will ask for 24.]

10. Data subject rights

If a customer contacts the Processor directly, the Processor will pass the request to the Controller within two working days and will not respond substantively without instruction. The dashboard lets the Controller see and delete a customer's request record itself; for anything else the Processor will assist within five working days.

11. Audit

On written request, no more than once a year unless following a breach or at a regulator's requirement, the Processor will provide the Controller with the information reasonably needed to demonstrate compliance with Article 28, including this agreement, Annex 2, the current sub-processor list and a summary of its security testing. Where that is not sufficient, the Controller or an independent auditor bound by confidentiality may audit on 30 days' notice, during business hours, at the Controller's cost, without disturbing other controllers' data.

12. Deletion and return

During the service, Customer Data is removed on the retention schedule in Annex 1 of the privacy notice. Within 90 days of termination the Processor deletes all Customer Data, except (a) the keyed hash of opted-out contacts, which is retained to honour opt-outs and cannot identify a person on its own, and (b) anything the law requires it to keep. Before deletion the Controller may export its request records from the dashboard.

13. Liability and precedence

Liability under this agreement is subject to the limits in the terms of service. If this agreement conflicts with the terms of service on a data protection matter, this agreement prevails.

Annex 2: technical and organisational measures

As implemented at the date above. These describe what the software does, not aspirations.

Annex 3: sub-processors

Stripe processes the Controller's own billing details and is a controller in its own right for payments; it receives no Customer Data.