Data Processing Addendum

When this addendum applies

This Data Processing Addendum (“DPA”) forms part of a software agreement when incorporated into an accepted order or agreement between Karrio Home Services LLP and the customer. It applies to personal data Karrio processes on that customer's behalf. Reading this page or submitting a sales enquiry does not by itself execute a customer DPA.

The customer determines the lawful purposes and instructions for that processing. Karrio acts as its processor to that extent. Our own sales, billing, security and relationship processing is described separately in the Privacy Policy. Applicable law determines the parties' roles in each case.

The processing schedule

The customer agreement must identify the product and deployment model, processing purpose and duration, data and person categories, approved locations and providers, security arrangements, and export/retention/deletion instructions. These details vary by service and must be agreed before the relevant processing begins.

Potential records include staff access information and the customer's operational records concerning guests, shoppers, patients, suppliers or other people, only where within the agreed product scope. Do not upload regulated or especially sensitive records until their permitted use and required safeguards have been confirmed.

Instructions and customer responsibilities

Karrio processes customer personal data to provide the agreed service and follow documented, lawful instructions, including authorised support, security and offboarding activities. The customer establishes the necessary notices, permissions or other lawful authority and gives accurate, authorised instructions.

Karrio will raise an instruction it reasonably considers inconsistent with applicable data-protection law. Processing required by law is handled in accordance with that law, including customer notice where permitted. A new purpose outside the agreed scope requires the appropriate agreement and legal basis.

Confidentiality and security

Personnel with access must be subject to confidentiality duties. Access and protective measures must be appropriate to the processing risks and recorded in the service's security schedule, including applicable access controls, transmission/storage protection, backup and recovery, and incident procedures.

This DPA does not represent that every product has the same architecture, certification or hosting location. Product-specific technical commitments must be documented and verified. The customer remains responsible for its users, devices, access choices and business continuity arrangements within its control.

Providers and processing locations

Any subprocessors used for customer processing must be identified in the applicable schedule or incorporated provider list and bound to suitable data-protection duties. The agreement must define how changes are notified, objections are handled and unresolved changes are addressed. Karrio remains responsible for its contracted processing obligations.

Processing outside the agreed locations or transfers requiring additional legal safeguards must meet the applicable agreement and law. A website provider list is not a substitute for the product-specific schedule. Request the relevant details through our privacy request form.

Requests and incidents

Karrio will provide reasonable assistance for applicable individual-rights requests and compliance duties relating to its processing, taking account of its role and the information available. A request concerning customer-controlled records is referred to the customer for instructions, unless applicable law requires another response.

On becoming aware of a personal-data breach affecting the contracted processing, Karrio will notify the customer without undue delay and provide available information and assistance as required by applicable law and the agreement. Incident contacts and any more specific contractual notification requirements belong in the processing schedule. Notifications should not be interpreted as an admission of liability.

Return, deletion and verification

At the end of the service, customer data is returned or deleted under the customer's lawful instructions and the agreed offboarding schedule, except where retention is legally required. The schedule must address export, active copies, backups, retention exceptions and restrictions on retained data.

Karrio will make available appropriate information to demonstrate its relevant obligations. Any audit or review arrangements must protect other customers' data, confidentiality and system security and be agreed proportionately. A request for information does not authorise unrestricted system access.

Relationship to other terms

This DPA governs conflicts about personal-data processing to the extent necessary, subject to mandatory law and any legally required transfer terms. Other commercial matters remain governed by the software agreement. Updates follow that agreement's change process and are not retroactive merely because this webpage changes.