Skip to content
Kennelworks
Join the waitlist
Legal

Data processing agreement

Last updated

Kennelworks is a trading name of Kennelworks Ltd, a company registered in England and Wales, company number 16889272, registered office 128 City Road, London, EC1V 2NX.

This agreement forms part of our terms of service and applies where Kennelworks processes personal data on behalf of a business customer under UK GDPR and the EU GDPR.

Roles and scope

  • The customer is the controller of personal data about its staff, clients, owners, buyers and their dogs.
  • Kennelworks is the processor and processes that data only to provide the service and on the customer’s documented instructions, which are these terms and the customer’s use of the product.

Data and subjects

  • Subjects: the customer’s staff, clients, dog owners, buyers and enquirers.
  • Data: contact details, addresses, dog and training records, bookings, messages, forms and waivers, invoices and payment status, photos and videos.
  • Duration: the length of the subscription plus the deletion period below.

Our commitments

  • Staff with access are bound by confidentiality. A small number of our staff can access all customer data for support, debugging, safety and legal reasons, as described in our privacy policy.
  • Appropriate technical and organisational security, including encryption in transit and at rest, access controls and audit logging.
  • We help the customer respond to data subject requests and with impact assessments where needed.
  • We notify the customer without undue delay, and within 48 hours, after becoming aware of a personal data breach.
  • We make information available to demonstrate compliance and allow reasonable audits.

Sub-processors

The customer authorises the sub-processors listed in our privacy policy. We’ll give at least 30 days’ notice of a new sub-processor, and the customer may object on reasonable data protection grounds.

International transfers

Data is hosted in Microsoft Azure’s UK South region. Any transfer outside the UK or EEA relies on adequacy regulations or standard contractual clauses with the UK addendum.

Deletion

After an account closes, the customer can export its data for 30 days. We then delete it from live systems, and it leaves our backups within a further 35 days, unless the law requires us to keep it.