Last Updated: October 2, 2026

Effective as of: October 2, 2026

This Data Processing Addendum ("DPA") forms part of our Terms of Service between Mateusz Peryt, trading as Peryt Digital ("Processor," "we," "us," or "our"), and the business using our Services ("Controller," "you," or "your"). It applies whenever we handle personal information on your behalf. It sits alongside our Terms and our Privacy Policy. If this DPA and the Terms conflict on data protection, this DPA wins.

1. Definitions

• Data Protection Laws — the laws that apply to the processing in this DPA, including the UK GDPR and Data Protection Act 2018, and US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA), where they apply.
• Personal Information — any information about an identified or identifiable person, as defined in the Data Protection Laws.
• Process / Processing — anything done with Personal Information, such as collecting, storing, using, sending, or deleting it.
• Services — the services we provide under our Terms, including your website, the system we set up for you, missed call text back, review requests, and related support.
• Security Incident — a breach of security that leads to Personal Information we process for you being lost, destroyed, changed, disclosed, or accessed without permission.

2. Roles

You are the controller (or "business") of the Personal Information you or your customers put into the Services. We are your processor (or "service provider") and will Process it only on your instructions, as set out in this DPA and our Terms, unless the law requires otherwise. If we think an instruction breaks the Data Protection Laws, we will tell you.

3. Details of the Processing

• What and why: to provide the Services, such as hosting your website, capturing enquiries, sending missed call text backs and review requests, and storing contacts and conversations in your system.
• How long: for as long as you use the Services, plus the period in Section 9.
• Whose data: your customers, leads, and website visitors, and your own staff who use the system.
• What data: names, phone numbers, email addresses, postal addresses, messages, call records, review responses, form submissions, and any other information you or your customers add.
• Sensitive data: none intended. Please do not put sensitive data (such as health information) into the Services.

4. What We Promise

• We will Process Personal Information only to provide the Services, to comply with the law, or as you agree in writing.
• We will not sell or share it, or use it for our own purposes or outside our business relationship with you.
• We will not combine it with Personal Information from other sources, except where needed to provide the Services, keep them secure, or as the law allows.
• We will comply with the Data Protection Laws that apply to us as your processor, and tell you if we can no longer meet them.

5. Confidentiality

Anyone we allow to Process Personal Information for you (including any contractor working for us) must keep it confidential.

6. Sub-processors

6.1 Approved sub-processors

You agree that we may use the sub-processors below to Process Personal Information on your behalf. We have contracts with them that protect the data, and we remain responsible to you for their work.

The current list is also on our Sub-processors page.

6.2 Changes

We will give you at least 30 days' notice before adding or replacing a sub-processor, unless we cannot for legal or security reasons (in which case we will tell you as soon as we can). If you object on reasonable data protection grounds, we will work with you to resolve it. If we cannot, you may cancel the Services as set out in our Terms.

7. Security

We take appropriate technical and organisational measures to protect Personal Information, taking into account the risks involved. These include using secure, encrypted tools, strong passwords and two-factor authentication, limiting access to people who need it, and choosing reputable providers.

8. Helping You

• Requests from people: we will help you respond to requests from individuals who want to access, correct, or delete their information. If someone contacts us directly, we will pass the request on to you.
• Security Incidents: we will tell you without undue delay, and where possible within 48 hours, after we become aware of a Security Incident affecting your data, and give you the information you reasonably need to deal with it.
• Other help: we will give you reasonable help with data protection impact assessments and with questions from regulators, where they relate to our Processing.

9. Deleting or Returning Data

When the Services end, we keep your data for 30 days so you can ask for a copy (as set out in our Terms). After that, or earlier if you ask in writing, we will delete it, unless the law requires us to keep it.

10. Checking Our Compliance

If you reasonably ask in writing, we will give you the information you need to show that we are meeting this DPA, such as a summary of our security practices or answers to a reasonable questionnaire. Any audit must be on reasonable notice, at your cost, and subject to confidentiality.

11. International Transfers

We are based in England, and our sub-processors store data in the United States. Where Data Protection Laws require it, transfers are protected by recognised safeguards, such as the UK International Data Transfer Addendum, standard contractual clauses, or the UK-US "data bridge".

12. Liability

Liability under this DPA is subject to the limits and exclusions in our Terms, except where the Data Protection Laws do not allow it.

13. Contact

For questions about this DPA or how we handle data for you, email perytdigital@gmail.com.