1. Parties and Purpose

This Data Processing Addendum ("DPA") forms part of the agreement between Squeez Ltd, company number NI734070, registered office Ground Floor, Gallery Building, 65-69 Dublin Road, Belfast BT2 7HG ("Processor", "Squeez") and the Client ("Controller") under the Squeez Terms and Conditions (the "Agreement"). It applies whenever Squeez processes personal data on the Client's behalf in providing the Platform and Services. Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR.

2. Roles

The Client is the controller. It decides why and how its customers' personal data is processed. That includes which customers receive messages, what the messages say, when and how often they are sent, which data is brought into the Platform and how long it is kept. The Client is responsible for having a lawful basis and any consent required under the UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

Squeez is the processor. It processes personal data only on the Client's documented instructions. Those instructions are given by the Agreement, this DPA, the choices the Client makes and approves during onboarding and when it approves a connection to its own software, the Client's configuration of the Platform, and any further written instructions. Squeez will tell the Client promptly if it believes an instruction breaches data protection law, and may pause the relevant processing until the Client confirms or corrects it.

3. Details of the Processing

Subject matter: providing the Squeez review management and customer messaging platform.

Duration: the term of the Agreement, plus the export and deletion periods in section 12.

Nature and purpose: storing contact details; receiving customer details the Client uploads or syncs from its own booking or practice software; sending review requests and follow-ups by WhatsApp, SMS and email; recording replies; generating and posting AI-assisted responses to reviews; displaying and publishing reviews (including on social media and website widgets) as configured by the Client; reporting.

Data subjects: the Client's customers and prospective customers; individuals who leave reviews for the Client; the Client's staff who use the Platform.

Categories of data: name, phone number, email address, the date of a visit, appointment or job and the staff member involved, message content and history, delivery and engagement data, review content, reviewer name and profile details, and any other data the Client chooses to upload.

Special category data: only the Health-Related Data described in section 4, and only where that section applies. The Client must not upload any other special category data unless agreed in writing.

4. Health and Care Providers

This section applies where the Client provides health, care or wellbeing services, for example a physiotherapy, osteopathy, chiropractic, dental, medical or aesthetics clinic. For such a Client, the fact that a person is its customer, and the details of their visits, can be data concerning health under the UK GDPR ("Health-Related Data").

The Client may use the Platform for Health-Related Data that is limited to what is needed to keep in contact with its customers, manage bookings and ask for reviews: identity and contact details, the date and time of a visit or appointment, the staff member seen, the name of the service booked, communication preferences and consent records, and message and review history.

The Client must not put clinical information into the Platform. Clinical information means diagnoses, conditions, symptoms, test results, medication, treatment or clinical notes, medical history, referral letters and clinical images. The Platform is not a clinical records system, and clinical information stays in the Client's own practice system. Where a customer includes details about their health in a reply or a review of their own accord, Squeez processes them only as part of the Services.

The Client is responsible for identifying its lawful basis under Article 6 of the UK GDPR and its condition under Article 9 (with any condition required by Schedule 1 to the Data Protection Act 2018) for Health-Related Data, including obtaining explicit consent where it relies on consent. The Client is also responsible for telling its customers how their data is used and for carrying out a data protection impact assessment where one is required. Squeez will give reasonable help with that assessment.

When Squeez connects to the Client's booking or practice software, it uses and stores only the fields the Client has approved for that connection. It does not request treatment notes or other clinical records, and it discards anything else the software returns without keeping it.

Squeez limits access to Health-Related Data to the people who need it to set up or support the Client's account, never copies it into demonstration or test accounts, and never uses it for case studies, marketing or training.

5. Squeez's Own Use of Data

Squeez does not use the Client's customers' personal data for its own purposes. It does not contact the Client's customers for itself, sell or share their data, or use it for its own marketing, case studies, benchmarking or the training of artificial intelligence models. It keeps the data only as set out in section 12 or as the law requires.

Squeez may refer to the Client's own results, such as the change in its review rating and its number of reviews over a period, as set out in clause 17 of the Terms and Conditions. That is information about the Client's business and never includes its customers' personal data.

6. Confidentiality

Squeez ensures that everyone authorised to process the personal data is bound by a duty of confidentiality.

7. Security

Squeez implements appropriate technical and organisational measures, including encryption in transit, role-based access, multi-factor authentication on administrative accounts, least-privilege access, and processes for detecting and responding to incidents.

8. Sub-processors

The Client gives general authorisation for Squeez to use the sub-processors listed at the end of this DPA (the "Sub-processor List"). Squeez will give at least 14 days' notice by email before adding or replacing a sub-processor. The Client may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Client may terminate the affected Services without a termination fee. Squeez imposes data protection obligations on each sub-processor equivalent to those in this DPA and remains responsible to the Client for each sub-processor's performance.

Software the Client connects to the Platform, such as its own booking or practice system, is the Client's own provider and not a Squeez sub-processor.

9. International Transfers

Some sub-processors process data outside the UK, including in the United States. Squeez ensures each restricted transfer is covered by a valid UK mechanism, such as the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

10. Assistance

Squeez will, taking into account the nature of the processing, assist the Client with: responding to data subject requests; security; personal data breach notification; data protection impact assessments; and consultation with the Information Commissioner's Office. Requests Squeez receives directly from data subjects will be passed to the Client without undue delay. Squeez will not respond itself except on the Client's instruction.

11. Personal Data Breaches

Squeez will notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Client's personal data. The notice will include the information then available to help the Client meet its own obligations.

12. Return and Deletion

Personal data is kept while the Agreement is in force. The Client may delete contacts at any time within the Platform. After termination, the Client may export its data for 30 days. Squeez will then delete the Client's personal data within a further 30 days, unless law requires it to be kept.

13. Records, Information and Audits

Squeez will make available the information reasonably needed to demonstrate compliance with this DPA and will allow and contribute to audits by the Client or an auditor it appoints, on at least 30 days' written notice, no more than once a year (unless following a personal data breach), during business hours, and subject to confidentiality.

14. Liability

Each party is liable for its own breaches of this DPA and of data protection law. The limitations and exclusions of liability in the Agreement apply, except for the Client's indemnity in clause 10.8 of the Terms and Conditions.

15. Governing Law

This DPA is governed by the laws of Northern Ireland, and the courts of Northern Ireland have exclusive jurisdiction.

Sub-processor List

HighLevel Inc. (LeadConnector) - hosts the Platform: contacts, messages, reviews, calendars, workflows, AI review responses - United States

Twilio Inc. - phone numbers and SMS delivery - United States

Mailgun Technologies Inc. (Sinch) - email delivery - United States

Meta Platforms Ireland Ltd (WhatsApp) - WhatsApp message delivery - EU and United States

Google LLC - Google Business Profile reviews and review replies - United States

n8n GmbH - automation of onboarding, account setup and connections to the Client's own software - EU (Germany, Frankfurt)

Render Services Inc. - hosts connect.squeez.io (onboarding, customer uploads and connection approvals) and Squeez's account setup service - EU (Germany, Frankfurt)

Browserbase Inc. - remote browser sessions used for account setup inside the Platform - United States

Anthropic PBC (Claude) - AI assistance used by Squeez for account setup, support and automation - United States

Stripe Payments Europe Ltd - payments (Client billing data only) - EU and United States

Microsoft Ireland Operations Ltd (Microsoft 365) - Squeez email and support - United Kingdom