Toolie Data Processing Agreement.

Words such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in the UK GDPR. “Data Protection Law” means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any law that replaces them. “Customer Personal Data” means personal data you put into Toolie, or that Toolie collects for you, such as your contacts, conversations and bookings.

You are the controller of Customer Personal Data and we are your processor.

The details of the processing (subject matter, duration, purpose, types of data and data subjects) are set out in Annex 1.

You’re responsible for having a lawful basis for the processing, including any consent needed to send marketing, and for the accuracy of the data you upload.

We will:

• process Customer Personal Data only on your documented instructions, which are these Terms, this DPA and your use of Toolie’s settings and features, unless the law requires otherwise (and if so, we’ll tell you first unless the law prevents it)
• tell you straight away if we think an instruction breaks Data Protection Law
• make sure everyone authorised to process Customer Personal Data is bound by confidentiality
• keep appropriate technical and organisational security measures in place, as described in Annex 3
• help you, taking into account the nature of the processing, to respond to data subject requests such as access, correction and deletion. Most of these can be handled directly in Toolie, and we’ll forward any request we receive straight to you
• help you with security, breach notifications, data protection impact assessments and consultations with the ICO, where these relate to our processing
• give you the information reasonably needed to show we’re meeting this DPA, and allow audits as set out in section 7

You give us general authorisation to use the sub-processors listed in Annex 2.

We’ll give you at least 30 days’ notice by email before adding or replacing a sub-processor. If you have a reasonable data protection objection, tell us within that time. If we can’t resolve it, you may cancel your subscription before the change takes effect.

We’ll put a written contract in place with each sub-processor giving the same level of protection as this DPA, and we remain responsible to you for their performance.

Services you connect to Toolie under your own account, such as your Meta (WhatsApp, Facebook, Instagram), Google, Microsoft or Stripe accounts, are your own providers and are not our sub-processors.

Toolie is hosted in the United States. We’ll only transfer Customer Personal Data outside the UK where a lawful transfer mechanism is in place. This includes UK adequacy regulations (such as the UK-US Data Bridge for certified organisations), the ICO’s International Data Transfer Agreement, or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

If we become aware of a personal data breach affecting Customer Personal Data, we’ll tell you without undue delay, and within 48 hours where possible. We’ll share what we know about the breach, the likely impact and the steps we’re taking, and update you as we learn more. This helps you meet your own 72-hour deadline for reporting to the ICO.

We’ll answer reasonable written questions about our data protection practices and share relevant information, including our sub-processors’ security certifications where available. If that isn’t enough to show we’re meeting this DPA, you may carry out an audit once a year, on 30 days’ notice, at your own cost and in a way that doesn’t disrupt our business or other customers’ data.

When your Toolie account closes, you can export your data for 30 days. After that, we’ll delete Customer Personal Data, unless the law requires us to keep it. Backups are deleted in their normal cycle.

Each party’s liability under this DPA is subject to the limits in the Terms of Service.

If this DPA and the Terms of Service conflict about personal data, this DPA wins.

This DPA is governed by the law of England and Wales, and lasts for as long as we process Customer Personal Data for you.

Contact us about this DPA at team@struth.uk.