Legal

Data Processing Agreement

Forming part of the Terms of Service between Where Beagles Dare! Ltd and its customers.

Last updated: 28 May 2026 · Where Beagles Dare! Ltd

This Data Processing Agreement (“DPA”) applies where Where Beagles Dare! Ltd (“WBD”, “we”, “us”) processes personal data on behalf of a customer (“you”, “the customer”) in providing Vidual (“the Service”). It reflects the requirements of Article 28 of the UK GDPR.

1. Introduction and roles

This DPA applies to the personal data that WBD processes on the customer’s behalf through the Service — for example, the customer’s clients’ details, messages and files. In respect of that personal data, the customer is the controller and WBD is the processor.

This DPA forms part of, and is governed by, the Terms of Service. It takes effect when the customer uses the Service to process personal data. A countersigned copy is available on request to hello@vidualapp.com.

2. Definitions

The following terms have the meanings given here:

• Controller — the party that determines the purposes and means of processing personal data.
• Processor — the party that processes personal data on behalf of the controller.
• Personal data — any information relating to an identified or identifiable living individual that is processed under this DPA.
• Processing — any operation performed on personal data, such as collection, storage, use, disclosure or deletion.
• Data subject — the individual to whom personal data relates.
• Sub-processor — a third party engaged by WBD to process personal data in connection with the Service.
• UK GDPR — the UK General Data Protection Regulation as it forms part of the law of England and Wales.
• Data Protection Act 2018 — the United Kingdom’s data protection legislation supplementing the UK GDPR.
• Applicable data protection law — the UK GDPR, the Data Protection Act 2018, and any other data protection or privacy laws that apply to the processing under this DPA.

3. Scope and roles of processing

WBD processes personal data only to provide the Service, and only on the customer’s documented instructions. Those instructions are set out in the Terms of Service, this DPA, and the customer’s use of the Service’s features. WBD will not process the personal data for any other purpose.

Where WBD is required by law to process personal data otherwise than on the customer’s instructions, WBD will inform the customer of that legal requirement before processing, unless the law prohibits such notification on important grounds of public interest.

4. WBD’s obligations as processor

WBD will:

• (a) process the personal data only on the customer’s documented instructions, including with regard to international transfers, unless required to do otherwise by law as set out in section 3;
• (b) ensure that persons authorised to process the personal data are subject to an appropriate duty of confidentiality;
• (c) implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex 2;
• (d) respect the conditions for engaging sub-processors set out in section 6;
• (e) taking into account the nature of the processing, assist the customer by appropriate technical and organisational measures, insofar as possible, in responding to requests from data subjects exercising their rights under applicable data protection law;
• (f) assist the customer in ensuring compliance with its obligations relating to the security of processing, personal data breach notification, data protection impact assessments, and prior consultation with the supervisory authority, taking into account the nature of processing and the information available to WBD;
• (g) at the customer’s choice, delete or return all the personal data to the customer after the end of the provision of the Service, and delete existing copies unless storage is required by law — and the customer may direct deletion of the personal data at any time during the term;
• (h) make available to the customer the information necessary to demonstrate compliance with the obligations in Article 28 of the UK GDPR, and allow for and contribute to audits, including inspections, conducted by the customer or an auditor it mandates. Audits are subject to reasonable advance notice, appropriate confidentiality obligations, and are at the customer’s cost beyond a standard information request.

5. Personal data breach

WBD will notify the customer without undue delay after becoming aware of a personal data breach affecting the customer’s personal data. The notification will include the detail then available to WBD and will be supplemented as further information becomes known. WBD will cooperate with the customer and take reasonable steps to assist in the customer’s own notifications to its supervisory authority and to affected data subjects.

6. Sub-processors

The customer gives WBD general authorisation to engage the sub-processors listed at vidual.app/subprocessors.html. WBD imposes data-protection obligations on each sub-processor that are equivalent to those set out in this DPA, by way of a written contract.

WBD will give the customer at least 30 days’ notice of any intended addition to, or replacement of, its sub-processors, via the sub-processor page and/or by email. The customer may object on reasonable data-protection grounds within that notice period. WBD and the customer will work in good faith to resolve the objection; if it cannot be resolved, the customer may terminate the affected part of the Service.

7. International transfers

Where personal data is transferred outside the United Kingdom, WBD ensures an appropriate safeguard is in place under the UK GDPR. Depending on the recipient, this is the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, a UK adequacy decision, or the UK extension to the EU–US Data Privacy Framework where the recipient is certified.

8. Liability

Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

9. Term and termination

This DPA takes effect as described in section 1 and remains in force for as long as WBD processes personal data on the customer’s behalf. It is coterminous with the Terms of Service. On termination, section 4(g) applies in respect of the deletion or return of personal data.

10. Governing law

This DPA is governed by the laws of England and Wales, and is subject to the jurisdiction provisions of the Terms of Service.

Annex 1 — Details of processing

Item	Detail
Subject matter	Provision of the Service to the customer.
Duration	The term of the agreement between the customer and WBD.
Nature and purpose	Providing project-management and client-communication software for bespoke commissions.
Types of personal data	Client names, email addresses, phone numbers, postal addresses, the content of messages and files, payment records, and build/provenance notes (including Owner’s Card records).
Categories of data subjects	The customer’s clients, and the customer’s own team members, partners and suppliers.

Annex 2 — Technical and organisational measures

WBD maintains the following measures:

• Encryption of data in transit using HTTPS/TLS.
• Encryption of data at rest, including AES-256-GCM encryption of OAuth tokens.
• Passwordless authentication using passkeys and magic links; passwords are never stored.
• Least-privilege, restricted access controls for systems holding personal data.
• Encrypted backups.
• Regular security review of infrastructure and access.
• Due diligence on sub-processors before engagement, with equivalent data-protection obligations imposed by contract.

Annex 3 — Sub-processors

The current list of sub-processors engaged by WBD is maintained at vidual.app/subprocessors.html, together with their purpose, location, and transfer safeguard. Changes are notified in accordance with section 6.