Data processing agreement

1. Parties and roles

HoundBase is a trading name of Muhammad Ibrahim Khan, operating as a sole trader. For customer workspace data containing personal information, the customer is the controller and Muhammad Ibrahim Khan trading as HoundBase is the processor unless the parties expressly agree otherwise. Each party remains responsible for its own obligations under applicable UK data-protection law.

2. Processing details

• Subject matter: hosted storage and operation of dog-care business records and related account, support and security functions.
• Duration: for the customer's use of HoundBase and any limited post-termination period required for export, deletion and backup expiry.
• Nature and purpose: hosting, organising, retrieving, displaying, securing, backing up, exporting and deleting customer records as needed to provide the service.
• Personal-data categories: names, contact information, account identifiers, emergency-contact information, notes that may identify or relate to people, support information and technical/security logs.
• Data subjects: customer users and staff, dog owners or clients, emergency contacts and other people whose information the customer lawfully enters into HoundBase.

3. Documented instructions

HoundBase will process customer personal data only on the customer's documented instructions, including instructions inherent in the customer's use of the service, unless UK law requires other processing. If legally permitted, HoundBase will tell the customer before carrying out processing required by law.

4. Confidentiality

HoundBase will ensure that people authorised to process customer personal data are subject to an appropriate duty of confidentiality and receive access only where needed for their role.

5. Security

HoundBase will maintain technical and organisational measures appropriate to the risk, including access controls, tenant separation, managed secrets, encrypted transport, provider security controls, recoverable backups, monitoring and incident handling. The current security summary is published on the security page.

6. Subprocessors

The customer gives general written authorisation for HoundBase to use the subprocessors listed on the subprocessor page. HoundBase will require subprocessors to protect personal data under written terms imposing the data-protection obligations required of a subprocessor. HoundBase remains responsible for its own processor obligations when engaging subprocessors.

For a material new subprocessor that will process customer personal data, HoundBase will update the subprocessor register and, where practicable, give the customer at least 14 days' advance notice using the customer's account contact details. The customer may object during that period on reasonable data-protection grounds. HoundBase will consider the objection in good faith and seek a practical resolution. If no reasonable resolution is available, either party may end the affected service before the new subprocessor is used for that customer's data.

7. Data-subject rights

Taking account of the nature of the processing, HoundBase will provide reasonable assistance so the customer can respond to requests from data subjects exercising their legal rights. If HoundBase receives a request relating to customer-controlled data, it will redirect the requester to the customer where appropriate unless prohibited by law.

8. Breach and compliance assistance

HoundBase will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data and will provide available information reasonably needed for the customer's assessment, notification and documentation duties.

HoundBase will also provide reasonable assistance with data-protection impact assessments and regulator consultation where the processing and information available to HoundBase make that assistance relevant.

9. Return, deletion and backups

At the end of the service, the customer may request return of its data through the available export route or instruct HoundBase to delete it. HoundBase will delete customer personal data from the live service within 30 days after the service ends unless UK law, an active dispute, security investigation or expressly agreed exception requires longer.

HoundBase-controlled backup exports are retained for no more than 30 days from creation. Where immediate removal from a protected backup is not technically practicable, the affected data will remain beyond normal use until the next backup deletion cycle and will not be restored to ordinary use. If a backup must be used for disaster recovery, previously deleted customer data will be removed again as part of the recovery process. Existing copies will otherwise be deleted unless UK law requires storage.

10. Audit information

HoundBase will make information reasonably necessary to demonstrate compliance with these processor obligations available to the customer. Any audit process must protect the security and confidentiality of HoundBase and other customers and should use existing documentation where suitable before requiring an intrusive inspection.

11. International transfers

HoundBase will not knowingly make a restricted transfer of customer personal data without an applicable UK transfer mechanism or adequacy basis where one is required.

12. Processor contact

The processor is Muhammad Ibrahim Khan trading as HoundBase. Privacy and processor enquiries can currently be sent to ibzy1199@gmail.com. A public service address will be added before paid customer activation.