Data processing terms.

In one sentence: for the personal details on the websites and accounts we look after, your business is in charge (the "controller") and Penguina acts only for you (the "processor"), so we use those details only to do the work you've asked for, and hand them back and delete our copies when you leave.

Who decides what happens to the details?

Data protection laws in many places, including the UK and EU, describe two roles:

• The controller decides why and how personal details are used. For your website, your enquiries and your customers, that's your business.
• The processor handles personal details on the controller's behalf, following its instructions. When we look after your website, that's Penguina.

These terms form part of your agreement with us, alongside our terms of service. They apply for as long as we look after anything for you, and until we've finished deleting our copies after your handover. For details about you as our client, such as your billing details, Penguina is the controller, and our privacy policy applies instead.

Which details do you handle, and why?

We handle these details only to provide the services in your plan and any add-ons you've agreed to by email or WhatsApp.

What will you do with them?

1. Follow your instructions. We use your customers' details only as these terms and the instructions you send us by email or WhatsApp allow. If we think an instruction would break the law, we'll tell you before acting on it.
2. Keep them confidential. Everyone at Penguina who can see them is bound to keep them confidential, and only people who need access for your work get it.
3. Keep them safe. We use the protections described in security and privacy, including a firewall, security fixes applied quickly, regular backups that we check work, and the fewest logins possible.
4. Help you answer people. If one of your customers asks to see, correct or delete their details, we'll help you respond. If they contact us directly, we'll pass the request to you rather than answer it ourselves.
5. Tell you about problems. If we find that your customers' details have been lost, exposed or accessed by someone who shouldn't have them, we'll tell you without undue delay, explain what we know, and help you with anything you need to report.
6. Show our work. If you need to check that we're keeping to these terms, we'll give you the information you reasonably need, and answer your questions.

What will you never do with them?

• Sell them, or share them with anyone for their own purposes.
• Use them for our own marketing, or contact your customers on our own behalf.
• Contact anyone who has opted out. Review requests and invites only go to people you're allowed to contact, and we respect opt-outs.
• Gate reviews. Review requests go to every customer, happy or not. We never filter who gets asked.
• Put sensitive details into AI tools. Never passwords, payment details or patients' health information. Our approach is set out in how we use AI.
• Keep them after you leave, except where the law requires it.

Do other companies help you?

Yes. Like any website business, we rely on a small number of service providers, for example for hosting, backups and email. Where one of them handles your customers' details, we:

• Only use providers that commit to protecting the details at least as well as these terms require.
• Give them only what they need for their part of the job.
• Stay responsible to you for their work.
• Tell you before we add or replace a provider that handles your customers' details, so you can raise a concern. Because every plan is month to month, you can also leave at any time.

Ask us and we'll send you the list of these providers, with what each one does and where it stores details.

Some providers may store details in other countries. Where the law requires extra protection when details move between countries, we use it.

What is my business responsible for?

• Having the right to collect the details, and a clear privacy notice on your own website that tells people what you collect and why.
• Asking only for what you need. We'll help you keep forms short. On health websites, we keep clinical information off the website wherever we can and send patients to your own booking or practice software for anything medical.
• Giving lawful instructions, and telling us if a customer has opted out or asked for their details to be deleted.
• Your own legal advice. We don't give legal advice, and we don't claim to make any business "HIPAA compliant". If your business has special legal duties, such as a healthcare practice, please speak to a lawyer or compliance adviser, and talk to us before sharing any health information with us.

What happens to the details when I leave?

When you leave, we hand everything back, free, including a recent full backup of your website with the details it holds. We then remove our access and delete the copies we hold, except anything the law requires us to keep, and confirm it by email. If a copy can't be deleted straight away, for example one inside an older backup, we'll tell you when it will be, and keep it protected until then.

Can these terms change?

Only with notice. We'll tell you by email before any change applies, and update the date at the top of this page. If you need a signed version of these terms for your own records, email hello@penguina.website and we'll send you one.