Data Processing Agreement

This Data Processing Agreement ("DPA") is between Lagrichi Digital Solutions, operating from the United Kingdom ("Processor") and the business customer using Maweid ("Controller"). It applies when Controller processes personal data about its clients, staff, or visitors using Maweid, and Processor handles that data on Controller's instructions to provide the Service. Processor is a UK-established sole trader unless and until a successor limited company is named in an updated DPA.

Processor provides appointment booking, CRM, calendar, notifications, and related features. Processing continues for the term of the subscription or trial and until Controller data is deleted or returned according to this DPA and the Privacy Policy.

Categories of data subjects: Controller's clients, prospects, and staff users. Categories of data: names, contact details, appointment details, service choices, notes Controller enters, and technical logs. Operations: storage, organisation, retrieval, transmission (notifications), deletion, and backup.

Processor shall process personal data only on documented instructions from Controller, including through Controller's use of dashboard settings, enabled notifications, and public booking pages. Controller instructs Processor to process data as necessary to provide the Service and as described in the Privacy Policy and Terms. Controller is responsible for lawful basis, transparency to data subjects, and obtaining consents required for messaging.

Processor implements appropriate technical and organisational measures (access control, encryption in transit, server-side secrets, role-based access). Processor may use subprocessors listed at /legal/subprocessors and will notify Controller of material changes where practicable. Controller may object to a new subprocessor on reasonable grounds by contacting support within 30 days of notice.

Processor shall assist Controller, where reasonably possible, with requests from data subjects to exercise their rights under applicable law (access, rectification, erasure, etc.). Controller shall notify Processor without undue delay if it receives a request Processor must help fulfil. Processor shall notify Controller without undue delay after becoming aware of a personal data breach affecting Controller's data.

Processor may transfer data internationally as described in the Privacy Policy, using appropriate safeguards. On termination, Controller may export data via dashboard tools. Processor shall delete Controller's business data within 90 days of verified termination request, except where law requires retention.

If this DPA conflicts with the Terms on data protection, this DPA prevails for processing of Controller client data. Questions: support@lagrichidigital.com