1. Parties and Purpose

This Data Processing Agreement ("DPA") forms part of the agreement between Squeez Ltd, company number NI734070, registered office Ground Floor, Gallery Building, 65-69 Dublin Road, Belfast BT2 7HG ("Processor", "Squeez") and the Client ("Controller") under the Squeez Terms and Conditions (the "Agreement"). It applies whenever Squeez processes personal data on the Client's behalf in providing the Platform and Services. Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR.

2. Roles

The Client is the controller. It decides why and how its customers' personal data is processed, including who receives messages, and is responsible for having a lawful basis and any consent required under the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). Squeez is the processor. It processes personal data only on the Client's documented instructions, which are given by the Agreement, this DPA, the Client's configuration of the Platform, and any further written instructions. Squeez will tell the Client promptly if it believes an instruction breaches data protection law, and may pause the relevant processing until the Client confirms or corrects it.

3. Details of the Processing

Subject matter: providing the Squeez review management and customer messaging platform.

Duration: the term of the Agreement, plus the export and deletion periods in section 10.

Nature and purpose: storing contact details; sending review requests and follow-ups by WhatsApp, SMS and email; recording replies; generating and posting AI-assisted responses to reviews; displaying and publishing reviews (including on social media and website widgets) as configured by the Client; reporting.

Data subjects: the Client's customers and prospective customers; individuals who leave reviews for the Client; the Client's staff who use the Platform.

Categories of data: name, phone number, email address, message content and history, delivery and engagement data, review content, reviewer name and profile details, and any other data the Client chooses to upload.

Special category data: not intended. The Client must not upload special category data unless agreed in writing.

4. Confidentiality

Squeez ensures that everyone authorised to process the personal data is bound by a duty of confidentiality.

5. Security

Squeez implements appropriate technical and organisational measures, including encryption in transit, role-based access, multi-factor authentication on administrative accounts, least-privilege access, and processes for detecting and responding to incidents.

6. Sub-processors

The Client gives general authorisation for Squeez to use the sub-processors listed at the end of this DPA (the "Sub-processor List"). Squeez will give at least 14 days' notice by email before adding or replacing a sub-processor. The Client may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Client may terminate the affected Services without a termination fee. Squeez imposes data protection obligations on each sub-processor equivalent to those in this DPA and remains responsible to the Client for each sub-processor's performance.

7. International Transfers

Some sub-processors process data outside the UK, including in the United States. Squeez ensures each restricted transfer is covered by a valid UK mechanism, such as the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

8. Assistance

Squeez will, taking into account the nature of the processing, assist the Client with: responding to data subject requests; security; personal data breach notification; data protection impact assessments; and consultation with the Information Commissioner's Office. Requests Squeez receives directly from data subjects will be passed to the Client without undue delay. Squeez will not respond itself except on the Client's instruction.

9. Personal Data Breaches

Squeez will notify the Client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Client's personal data. The notice will include the information then available to help the Client meet its own obligations.

10. Return and Deletion

Personal data is kept while the Agreement is in force. The Client may delete contacts at any time within the Platform. After termination, the Client may export its data for 30 days. Squeez will then delete the Client's personal data within a further 30 days, unless law requires it to be kept.

11. Records, Information and Audits

Squeez will make available the information reasonably needed to demonstrate compliance with this DPA and will allow and contribute to audits by the Client or an auditor it appoints, on at least 30 days' written notice, no more than once a year (unless following a personal data breach), during business hours, and subject to confidentiality.

12. Liability

Each party is liable for its own breaches of this DPA and of data protection law. The limitations and exclusions of liability in the Agreement apply, except for the Client's indemnity in clause 10.8 of the Terms and Conditions.

13. Governing Law

This DPA is governed by the laws of Northern Ireland, and the courts of Northern Ireland have exclusive jurisdiction.

Sub-processor List

HighLevel Inc. (LeadConnector) - hosts the Platform: contacts, messages, reviews, workflows, AI review responses - United States

Twilio Inc. - phone numbers and SMS delivery - United States

Mailgun Technologies Inc. (Sinch) - email delivery - United States

Meta Platforms Ireland Ltd (WhatsApp) - WhatsApp message delivery - EU and United States

Google LLC - Google Business Profile reviews and review replies - United States

n8n GmbH - automation of onboarding and account setup - EU (Germany, Frankfurt)

Stripe Payments Europe Ltd - payments (Client billing data only) - EU and United States

Microsoft Ireland Operations Ltd (Microsoft 365) - Squeez email and support - United Kingdom