Data processing agreement

This agreement is between the business in India, Canada, the United Kingdom or Australia that signs up to HowdySEO (“you”) and HowdySEO, operated by Nagappan Arun Karthik, trading as DesignQube, Justice Ramaswamy Street, No.51/1, Kamaraj Avenue Second Street, Adyar, Chennai, Tamil Nadu, 600020, India (“we”, “us”). It applies to the services under our Terms, and you accept it with them. If your business is a dental or medical practice, you also sign the health terms below before we touch any patient information.

1. What we process, and why

• Your customers’ names, phone numbers and email addresses, for review requests; reviews and reviewers’ names; calls with their source, time and duration, and any call recordings; and the data in your accounts that our work reads. From your website: when a visitor who came from one of your Google ads taps your tracking number, the ad click’s id, the number and the time, so we can match the tap to the call; and in the UK and India, each visitor’s Accept or Reject on your cookie banner, with a random id, the banner’s version and the time, kept 24 months as your record of what they chose.
• We use it only to do the work the Terms describe, on your instructions, and for nothing of our own. We never use it for another client’s work.

2. What we do with it

• Keep it confidential, and bind everyone who handles it to confidentiality.
• Protect it with safeguards fit for what it is.
• Use a provider only under a written contract with the same terms as this one. Our providers are those our Privacy notice names; we tell you 30 days before adding one, and you can object.
• Tell your privacy officer of any loss, theft, unauthorised access, use or disclosure, or suspected breach, without undue delay and within 48 hours of finding it, and in Ontario at the first reasonable opportunity.
• Help you answer a person’s request to see or correct their information, or to complain, passing any request we receive to you within 5 weekdays.
• Help you with breach notices and impact assessments.
• Let you, or someone you name, check that we keep these terms.
• When your last location leaves, give you your data through the export, then delete it within 30 days, our providers’ copies included, and keep none.

3. Your country

• United Kingdom: we act as your processor under Article 28 of the UK GDPR. Health information is special category data; you hold the condition for it and any consent it needs. Data goes to the United States under the UK Addendum to the EU standard contractual clauses, which forms part of this agreement. Our people work from India, which has no UK adequacy finding, so data reached from India is transferred under the same Addendum, and we give you our assessment of that transfer’s risk on request. It finds the transfer adds no significant risk for contact details, reviews and call times. Call recordings and patient information are never reached from India: machines process them outside India, and anyone who must hear or read them works outside India.
• India: this is the contract under which you, as data fiduciary, engage us as your data processor (Digital Personal Data Protection Act 2023, s 8(2)). We keep the security safeguards the DPDP Rules ask of it: encryption, access control, and logs of access kept one year. Our notice of a breach under section 2 lets you tell each person affected and the Data Protection Board without delay, and give the Board its report within 72 hours. Data goes to the United States, while the Government of India does not restrict transfers there.
• Outside India: your contract is with Nagappan Arun Karthik, trading as DesignQube, in Chennai, India, so India’s Digital Personal Data Protection Act binds our handling of your data only to stay responsible for it and keep reasonable security safeguards against a breach (s 17(1)(d), with s 8(1) and (5)).
• Canada: you stay responsible for the information, and this agreement is how you get comparable protection from us (PIPEDA). For a business in Quebec, it is the written contract Quebec’s private-sector Act asks for, and you complete your assessment before information leaves Quebec.
• Australia: this agreement is the reasonable step that keeps us to the Australian Privacy Principles when you disclose information to us overseas, covering its handling, storage and destruction, complaints, and notice to you of a suspected breach.

4. Health terms

For a dental or medical practice, signed by its owner before we touch patient information:

• We use patient information only to record calls to your tracking numbers after the recording announcement, to draft replies to Google reviews for your approval, and to report on calls. We send no review requests to your patients.
• We collect, use and disclose it only for those purposes, use the least it needs, and follow any wish a patient has expressed to you.
• In Alberta, this is the information manager agreement under the Health Information Act, signed before you give us any health information, with the further terms needed for information handled outside Alberta.
• In Ontario, we act as your agent under PHIPA.
• In the United Kingdom, if you hold NHS patient data, we hold none of it.
• Either of us may end these terms if the other breaks them and does not put it right within 30 days of written notice.

5. Signature

Signed for your practice by its owner, who types his full name, on the date shown at signing. That signature binds both parties; we do not countersign.