Data Processing Agreement

Data Processing Agreement (DPA)

Effective Date: 30 April 2025

This Data Processing Agreement forms part of the Terms of Service between The Garage Site (a trading name of Bulldogs Digital Ltd) (the “Processor”) and any garage, workshop, or other business entity using The Garage Site’s services (the “Controller”).

By placing an order or using our services, the Controller agrees to the terms of this Data Processing Agreement.

1. Background This DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the review collection services provided by The Garage Site.

2. Definitions

  • “Data Protection Laws” means the UK GDPR and the Data Protection Act 2018.

  • “Personal Data” means any data that can identify a data subject.

  • “Services” means the customer feedback tools provided by The Garage Site, including QR code forms and email transmission to the Controller.

3. Scope and Purpose The Processor shall process Personal Data solely to:

  • Receive customer feedback submitted via a web form,

  • Transmit feedback by email to the Controller,

  • Temporarily store submissions for operational delivery and backup,

  • Delete submissions after a maximum of 6 months.

4. Nature of the Data The Personal Data processed may include:

  • Customer name

  • Contact details (email, phone number)

  • Star rating and written feedback

  • IP address (indirectly, via logs)

No special category data is intentionally collected.

5. Processor Obligations The Processor shall:

  • Process data only on documented instructions from the Controller,

  • Ensure appropriate technical and organisational measures are in place to protect Personal Data,

  • Not engage sub-processors without informing the Controller (current sub-processor: Google for email delivery via SMTP),

  • Assist the Controller with data subject access requests,

  • Notify the Controller without undue delay in case of a data breach,

  • Delete data after 6 months, or sooner on request.

6. Controller Obligations The Controller shall:

  • Ensure it has a lawful basis to collect customer data,

  • Provide appropriate privacy information to data subjects,

  • Respond to data subject requests in compliance with Data Protection Laws.

7. Subprocessing The Controller consents to the use of the following sub-processor:

  • Google Workspace (SMTP delivery) — located in the EEA or UK. The Processor will notify the Controller of any intended changes concerning additional sub-processors.

8. International Transfers No international transfers of data are currently made. Data is stored and processed on servers located in the United Kingdom.

9. Termination Upon termination of the Services, the Processor shall delete all retained Personal Data unless retention is required by law.

10. Governing Law This DPA is governed by the laws of England and Wales.

If you have any questions about this DPA or your data, please contact: [email protected]