Data processing terms.

Scope and roles

This Data Processing Addendum (“DPA”) forms part of the Webfreezee Service Terms between the customer and Systra AI Ltd. It applies when Systra AI Ltd processes personal data on the customer's behalf through a customer website, Portal, Customer Hub, Bookings, E-commerce, AI Chat or another selected Webfreezee module.

The customer is the controller and Systra AI Ltd is the processor for that customer data. Each party must comply with the UK GDPR, the Data Protection Act 2018 and other data-protection law that applies to it. If the parties have separately signed data-processing terms, those signed terms take priority for the processing they cover.

Processing details

The subject matter is the provision, hosting, support, security and maintenance of the selected Webfreezee services. Processing lasts for the service term and any limited period needed to return, secure or delete data afterwards.

The nature and purpose may include collecting website enquiries; hosting page and account content; managing customer/contact, booking and order records; sending operational messages; providing customer support; preventing abuse; and, when enabled, providing AI Chat and human handover.

Data subjects may include the customer's staff and authorised users, website visitors, enquirers, customers, account holders, shoppers and people who communicate with the customer. Data may include names, contact details, enquiry and message content, booking or order information, account details, service history, consent records and limited device, request or security data. Payment-card details are entered with Stripe and are not stored by Webfreezee.

Documented instructions

Systra AI Ltd will process customer data only on documented instructions from the customer, including the configuration and ordinary use of the service, unless UK law requires other processing. If the law permits, we will tell the customer before carrying out legally required processing. We will promptly tell the customer if, in our reasonable opinion, an instruction infringes applicable data-protection law.

We will ensure that people authorised to process customer data are bound by confidentiality and receive access only where needed for their role.

Customer responsibilities

The customer is responsible for having a lawful basis for the processing, giving required privacy information, collecting any required consent, keeping its instructions lawful, collecting only information it needs and responding to people who exercise their rights. The customer must not use the service to collect passwords, full payment-card details or special-category or criminal-offence data unless Webfreezee has agreed a suitable route in writing.

Security measures

Taking account of the nature of the data, implementation costs and risk, Systra AI Ltd maintains appropriate technical and organisational measures. These include encrypted network connections; provider-managed encryption at rest where supported; authenticated and role-scoped access; database row-level access controls; server-side secret management; input validation and abuse controls; logging and monitoring; managed backup and recovery arrangements; and proportionate review of software dependencies, incidents and access.

No system can be guaranteed absolutely secure. We may update the measures as technology and risk change, provided the overall level of protection is not materially reduced.

Subprocessors

The customer gives general written authorisation for Systra AI Ltd to use subprocessors needed to provide the service. Current core subprocessors include Cloudflare for website and edge infrastructure, Supabase for database, authentication and storage, and Resend for operational email. Stripe is used where subscriptions, connected payments or E-commerce are enabled. Groq is used for server-side language-model processing where AI Chat or another stated AI feature is enabled.

We will require each subprocessor to protect customer data to a standard consistent with this DPA. We will publish material changes to the subprocessor arrangements in these terms or otherwise give reasonable notice. A customer may object on reasonable data-protection grounds within 14 days of notice. We will consider the objection in good faith and, where reasonably possible, offer an alternative; if none is reasonably available, either party may end the affected service.

International transfers

Where customer data is transferred outside the UK, Systra AI Ltd will ensure that the transfer uses a lawful mechanism, such as a UK adequacy regulation, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any supplementary measures reasonably required.

People’s rights

Taking account of the nature of the processing, Systra AI Ltd will provide reasonable assistance so the customer can respond to requests for access, correction, deletion, restriction, portability or objection. If we receive a request relating to customer data, we will direct it to the customer unless the law requires us to respond.

Personal-data breaches

We will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data. The notice will include the information reasonably available about the nature of the incident, likely consequences, affected data and people, and measures taken or proposed. We will provide reasonable cooperation with the customer's investigation, mitigation and notification duties.

DPIAs and regulators

Taking account of the processing and information available to us, we will provide reasonable assistance with the customer's security obligations, data-protection impact assessments and prior consultation with the Information Commissioner's Office. Additional work outside the normal service may be charged at an agreed reasonable rate.

Return and deletion

During the service, the customer may request an export of customer records available through Webfreezee. When the affected service ends, we will, at the customer's choice, return or delete customer data within a reasonable period unless the law requires us to keep it. Data in protected backups will be deleted through the normal backup cycle and will not be restored except for disaster recovery or legal necessity.

Information and audits

We will make available information reasonably necessary to demonstrate compliance with this DPA. On reasonable written notice, no more than once a year unless a breach or regulator requires otherwise, the customer may request a proportionate audit. Audits must protect other customers' information and our security, avoid unnecessary disruption and use existing independent reports or written evidence where those are sufficient. The customer bears its audit costs unless the audit identifies a material breach by Systra AI Ltd.

Order of precedence and contact

If this DPA conflicts with the Service Terms on processing customer data, this DPA takes priority. The remaining Service Terms, including liability provisions, continue to apply.

Questions, instructions or requests under this DPA can be sent to hello@webfreezee.co.uk.