Data Processing Addendum

Version 2026-10-22 · in force from 22 October 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between KB.PUB (operated by Sergei Vronskii, sole trader, United Kingdom; "we") and the business that uses the Clinic Website service ("you"). It applies to personal data we process on your behalf, and is intended to meet Article 28 of the UK GDPR (and, where it applies to you, the EU GDPR).

1. Roles

For personal data of the visitors of your site — their messages to the assistant, the names and contact details they leave, and the booking requests created from them ("Visitor Data") — you are the controller and we are your processor.

2. What we process

• Purpose: to run your site and its assistant: answer visitors' questions from the information in your account, create booking requests, notify you of them, show them in your account and prepare reports for you.
• Data subjects: visitors of your site.
• Data: messages, names, phone numbers, e-mail addresses, preferred appointment times and similar details a visitor chooses to give. The Service is not designed for health information (see section 7 of the Terms), and the chat window asks visitors not to share health details.
• Duration: while you use the Service, then as set out in section 7 below.

3. Our obligations

We will:

• process Visitor Data only on your documented instructions, which are the Terms, this DPA and your settings in the Service, unless the law requires otherwise (in which case we will tell you, unless the law forbids it);
• make sure that anyone who processes Visitor Data for us is bound by confidentiality;
• keep appropriate technical and organisational security measures: access limited by role and by business account, encrypted connections, backups and up-to-date software;
• not use Visitor Data for our own purposes, and not sell it;
• help you, as far as we reasonably can, to answer requests from visitors who exercise their data protection rights, and to meet your obligations on security, breach notification and data protection impact assessments;
• tell you without undue delay, and where possible within 48 hours, after we become aware of a personal data breach affecting Visitor Data;
• make available to you the information needed to show compliance with this DPA and allow reasonable audits, normally by answering your written questions.

4. Sub-processors

You give us general authorisation to use the following sub-processors:

We will tell you by e-mail at least 30 days before adding or replacing a sub-processor. If you object on reasonable data protection grounds, we will discuss it with you; if we cannot resolve the objection, you may cancel the Service and receive a refund of the unused part of your current period. We impose data protection obligations on our sub-processors that are no less protective than this DPA and remain responsible for them.

5. International transfers

Our servers are in Canada, which the UK recognises as providing adequate protection for data transferred to organisations covered by Canada's federal privacy law. Where a sub-processor processes Visitor Data in a country without such recognition, we rely on appropriate safeguards, such as the UK International Data Transfer Addendum to the EU standard contractual clauses or the UK Extension to the EU–US Data Privacy Framework.

6. Your obligations

You confirm that you have a lawful basis for the processing, that your own privacy notice tells visitors about it, and that you will not instruct us to process data unlawfully or to collect information the Service is not designed for.

7. Return and deletion

When the Service ends, we delete Visitor Data within 30 days, unless the law requires us to keep it. Before that, you can ask us for an export. During the Service, conversations and booking requests are kept for 12 months and then deleted or anonymised, unless you delete them earlier.

8. Liability and order of precedence

The limitations of liability in the Terms apply to this DPA. If this DPA and the Terms conflict on the processing of Visitor Data, this DPA prevails.

9. Contact

Data protection questions and breach notifications: privacy@kb.pub.