LEGAL
Data processing agreement
Where you use PenguinPilot to store personal data about your own customers (in a site form, the CRM, or social inbox), we act as your data processor. This DPA forms part of our terms of service under UK GDPR Article 28.
Last updated: 1 March 2026
1. Roles
You are the data controller for personal data you store in the CRM, forms and social inbox. We are the processor, acting only on your documented instructions.
2. Scope of processing
Contact records, form submissions, booking details, messages and any files you upload, processed only to provide the service.
3. Sub-processors
We use the sub-processors listed at /legal/sub-processors. We'll notify you of material changes and give you the chance to object.
4. Security measures
Encryption in transit, access controls, regular backups and staff access limited to what's needed to support the service.
5. Data subject requests
If we receive a request from one of your customers, we'll forward it to you rather than respond directly, unless required to do otherwise by law.
6. Deletion and return
On termination, you can export your data for 30 days, after which we delete it in line with our retention schedule.
7. International transfers
Where a sub-processor is outside the UK, transfers are covered by the UK International Data Transfer Addendum.
8. Requesting a signed copy
Email privacy@penguinpilot.ai for a countersigned copy of this DPA for your records.