Paddli Data Processing Agreement

Last updated: October 31, 2026

This Data Processing Agreement explains how Paddli handles your customers' personal data when you use Paddli to take and manage bookings for your field.

1. About this DPA

This Data Processing Agreement ("DPA") is between Paddli Ltd, a company registered in England and Wales with company number 17135432, whose registered office is at 20-22 Wenlock Road, London, N1 7GU ("Paddli", "we", "us", "our"), and the Host who has accepted the Paddli Host Agreement ("Host", "you", "your").

This DPA forms part of the Host Agreement. You accept it when you accept the Host Agreement, and it applies for as long as we process Host Customer Data for you.

If you need a signed copy of this DPA for your records, email [email protected].

2. Definitions

Words defined in the Host Agreement have the same meaning in this DPA. In addition:

Data Protection Laws means all laws relating to personal data that apply to the processing of Host Customer Data, including UK Data Protection Law, EU Data Protection Law, the Swiss Federal Act on Data Protection, US State Privacy Laws, and any other national or regional data protection or privacy law, each as amended or replaced from time to time.
UK Data Protection Law means the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.
EU Data Protection Law means Regulation (EU) 2016/679 ("EU GDPR") and the national laws implementing or supplementing it.
US State Privacy Laws means the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and its regulations, and every other comprehensive US state privacy law in force.
Host Customer Data means the personal data described in Schedule 1 that we process on your behalf when providing the Service to you.
Sub-processor means a third party we engage to process Host Customer Data on your behalf.
Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Host Customer Data.
EU SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
UK Addendum means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

The terms "controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the UK GDPR. Where US State Privacy Laws apply, "controller" includes "business", "processor" includes "service provider" and "contractor", and "personal data" includes "personal information".

3. Roles of the Parties

3.1 Where you are the controller

When your customers book your field, your customer records, bookings, messages and the other data described in Schedule 1 belong to your business. You are the controller of that data and Paddli processes it on your behalf as your processor. This includes customer records you import into Paddli from another booking system.

3.2 Where Paddli is the controller

Paddli is a separate, independent controller, and not your processor, for:

your own Host account, and the accounts of anyone you invite to help run your field;
a Customer's Paddli sign-in, and documents a Customer keeps in their own Paddli account (for example, vaccination certificates they reuse across bookings). When a Customer attaches one of those documents to a booking with you, we process it on your behalf for that booking;
platform fees, commissions, subscriptions, invoices and the financial records we keep for our own accounting and tax purposes;
meeting our own legal obligations, including tax reporting duties as a digital platform operator;
keeping the Service secure and preventing fraud and abuse; and
creating aggregated or de-identified information, as allowed by section 5.7.

Our Privacy Policy explains how we handle personal data where we are the controller.

4. Your Responsibilities

As controller of Host Customer Data, you must:

comply with the Data Protection Laws that apply to you;
have a lawful basis for collecting Host Customer Data and for asking us to process it, including for any customer records you import from another system;
give your customers any privacy information the law requires, including that you use Paddli to manage bookings;
make sure any marketing you send to your customers complies with the law, including any consent or opt-out requirements; and
not use the Service to collect special category data (such as health information about people) or data about criminal convictions, unless the law allows it and you have told us in writing first.

5. Our Obligations as Your Processor

5.1 Instructions

We process Host Customer Data only on your documented instructions, unless the law requires us to do otherwise. If the law requires us to process Host Customer Data in another way, we will tell you before we do so, unless the law prohibits us from telling you.

Your instructions are the Host Agreement, this DPA, and the choices you make when you set up and use the Service. Any additional instructions must be in writing and consistent with how the Service works.

We will tell you promptly if we believe an instruction breaks Data Protection Laws. We may pause carrying out that instruction until it is confirmed or changed.

5.2 Confidentiality

We make sure that everyone we authorise to access Host Customer Data is bound by a duty of confidentiality and only accesses it as needed to provide, support and secure the Service.

5.3 Security

We maintain appropriate technical and organisational measures to protect Host Customer Data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as required by Article 32 of the UK GDPR. Schedule 2 describes these measures.

We may update these measures over time, but we will not reduce the overall level of protection they provide.

5.4 Helping you with data subject requests

The Service lets you view, correct, export and delete your customer records. If you cannot respond to a data subject request using the Service, we will give you reasonable help to respond.

If one of your customers contacts us directly about Host Customer Data, we will direct them to you and tell you about the request without undue delay. We will not respond to the request ourselves unless you ask us to or the law requires it.

5.5 Helping you meet your other obligations

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with your obligations on security, breach notification, data protection impact assessments and prior consultation with a supervisory authority.

5.6 Records

We keep a record of the processing we carry out on your behalf, as required by Data Protection Laws.

5.7 Aggregated and de-identified data

We may create aggregated or de-identified information from Host Customer Data, for example booking volumes across the platform, so we can operate, measure and improve the Service. This information will not identify you, your customers or any other individual. We will take reasonable measures to keep it de-identified and will not try to re-identify it.

6. Sub-processors

You give us general authorisation to engage Sub-processors to process Host Customer Data.

Our current service providers are listed in the "Detailed Information on the Processing of Your Personal Data" section of our Privacy Policy. Each entry explains what the provider does and what data it receives. Providers that do not receive Host Customer Data are not Sub-processors under this DPA.

We will email your Host account email address at least 30 days before a new Sub-processor starts processing Host Customer Data. If you have reasonable data protection grounds to object, tell us within that period at [email protected] and we will work with you in good faith to resolve the objection. If we cannot resolve it, you may end the Host Agreement, and we will refund any prepaid subscription fees for the period after it ends.

If we need to replace a Sub-processor urgently to keep the Service secure or running, we may do so with shorter notice. We will tell you as soon as we reasonably can, and you keep the same right to object.

We put a written contract in place with each Sub-processor that gives Host Customer Data the same level of protection as this DPA. We remain responsible to you for our Sub-processors' performance of those obligations.

7. Personal Data Breaches

If we become aware of a Personal Data Breach, we will tell you without undue delay, and in any case within 48 hours.

We will give you the information you reasonably need to assess the breach and to meet any obligation to notify a supervisory authority or the affected individuals. This includes, as far as we know it:

what happened, and the categories and approximate number of individuals and records affected;
the likely consequences of the breach; and
the steps we have taken or propose to take to deal with it and reduce any harm.

Where we cannot give all of this information at once, we will provide it in stages as it becomes available. We will promptly take reasonable steps to contain and investigate the breach.

Telling you about a breach is not an admission of fault or liability.

8. International Transfers

8.1 Where Host Customer Data is stored

We store Host Customer Data in Amazon Web Services data centres in Ireland, in the European Union. Some Sub-processors process it in other countries, including the United States, as described in our Privacy Policy.

8.2 Transfers by Paddli

We only transfer Host Customer Data outside the UK, the European Economic Area or Switzerland where the transfer is protected under Data Protection Laws. We do this by relying on:

a decision that the destination country provides adequate protection, including the EU-US Data Privacy Framework, the UK Extension to it, and the Swiss-US Data Privacy Framework, where the recipient is certified; or
the EU SCCs, the UK Addendum, the UK International Data Transfer Agreement, or another transfer mechanism recognised by Data Protection Laws, with supplementary measures where needed.

8.3 Transfers from the EEA and Switzerland to Paddli

Paddli is based in the United Kingdom. The European Commission and Switzerland have both recognised the UK as providing adequate protection for personal data, so you can transfer Host Customer Data from the European Economic Area or Switzerland to Paddli without extra measures.

If that recognition ends or stops covering these transfers, the EU SCCs are incorporated into this DPA automatically and apply to transfers from you to Paddli, as follows:

Module Two (controller to processor) applies, or Module Three (processor to processor) where you are acting as a processor for someone else;
you are the data exporter and Paddli is the data importer;
the optional docking clause in Clause 7 does not apply;
under Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 6 of this DPA;
the optional wording in Clause 11 does not apply;
under Clause 13, the competent supervisory authority is the one identified under that clause for you;
under Clauses 17 and 18, the EU SCCs are governed by Irish law and disputes go to the courts of Ireland; and
Schedules 1 and 2 of this DPA complete Annexes I and II, and Annex III is the list of Sub-processors described in section 6.

For transfers from Switzerland, the same applies with references to the EU GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner acting as the competent supervisory authority where Swiss law applies.

8.4 Transfers from other countries

If the law where you are based restricts transfers of personal data to the UK or to our Sub-processors, tell us and we will work with you in good faith to put any additional protections that law requires in place.

9. US State Privacy Laws

Where US State Privacy Laws apply to Host Customer Data, Paddli acts as your service provider, contractor or processor, as those laws define the terms. We process Host Customer Data only for the limited and specified business purpose of providing the Service to you, as set out in the Host Agreement, this DPA and Schedule 1.

We will not:

sell or share Host Customer Data, as "sell" and "share" are defined in the CCPA;
keep, use or disclose Host Customer Data for any purpose other than the business purposes in this DPA, including any commercial purpose, unless US State Privacy Laws allow it;
keep, use or disclose Host Customer Data outside our direct business relationship with you; or
combine Host Customer Data with personal information we receive from, or on behalf of, anyone else, or collect from our own interactions with individuals, except as US State Privacy Laws allow.

We will comply with the US State Privacy Laws that apply to us and provide the same level of privacy protection they require. We will tell you if we decide we can no longer meet our obligations under them. You may take reasonable and appropriate steps to make sure we use Host Customer Data in line with your obligations, and to stop and fix any unauthorised use.

We understand and will comply with the restrictions in this section.

10. Other Data Protection Laws

Where other Data Protection Laws apply to Host Customer Data, for example in Canada, Australia or New Zealand, we will process it in a way that gives at least the level of protection required by this DPA. If those laws require additional contract terms, we will work with you in good faith to agree them.

11. Audits and Information

We will make available to you the information reasonably necessary to show that we comply with this DPA. We will answer your reasonable written questions about our data protection and security practices.

If that information is not enough to show our compliance, or a supervisory authority requires it, we will allow and contribute to audits, including inspections, carried out by you or an independent auditor you appoint, on these conditions:

you give us at least 30 days' written notice, unless a supervisory authority requires a shorter period or there has been a Personal Data Breach;
audits take place no more than once in any 12-month period, unless a supervisory authority requires it or there has been a Personal Data Breach;
audits take place during normal business hours, avoid unreasonable disruption to our business, and do not give access to other customers' data;
any auditor is bound by appropriate confidentiality obligations; and
you pay the costs of the audit, unless it shows that we have materially breached this DPA.

12. Return and Deletion of Data

You can export your customer list from the Service at any time. If you need other Host Customer Data in a commonly used, machine-readable format, ask us before the Host Agreement ends and we will provide it.

Within 90 days after the Host Agreement ends, we will delete Host Customer Data, unless the law requires us to keep it. Copies in our backups are deleted as those backups expire on their normal cycle. Until then they stay protected by this DPA and are not used for any other purpose.

Data where Paddli is the controller, as described in section 3.2, is kept as set out in our Privacy Policy.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Host Agreement, except where Data Protection Laws or the EU SCCs do not allow those limitations to apply.

14. Duration, Order of Precedence and Changes

This DPA applies for as long as we process Host Customer Data for you, including after the Host Agreement ends, until that data is deleted or returned.

If there is a conflict on a data protection matter, the EU SCCs (where they apply) take priority over this DPA, and this DPA takes priority over the Host Agreement.

We may update this DPA to reflect changes in Data Protection Laws, guidance from supervisory authorities, or changes to the Service. We will not make changes that materially reduce the protection for Host Customer Data unless the law requires them. We will tell you about material changes in the same way as material changes to the Host Agreement.

15. Governing Law

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it, except where the EU SCCs apply and require otherwise.

16. Contact

If you have any questions about this DPA or how we process Host Customer Data, contact us at:

By email: [email protected]

Schedule 1: Details of Processing

Subject matter and duration

Paddli provides booking software that you use to take and manage bookings for your field. We process Host Customer Data for as long as you use the Service, and afterwards until it is deleted or returned under section 12.

Nature and purpose of processing

We collect, store, organise, display, transmit and delete Host Customer Data so that we can provide the Service to you. This includes:

running your booking pages, booking widgets, custom domains and microsites;
taking, managing, changing and cancelling bookings, recurring bookings and subscriptions;
taking payments and processing refunds through your connected payment account;
sending booking confirmations, reminders and other messages by email, SMS and WhatsApp;
issuing gate and smart lock access codes for bookings;
importing customer records and upcoming bookings from your previous booking system;
providing support, and keeping the Service secure and working properly.

Categories of data subjects

Your customers and people who start or make a booking with you.
Customers you import from another system or add manually.
People you add to receive notifications about your field.

Types of personal data

Contact details, such as name, email address and phone number.
Booking details, such as fields, sessions, dates, times, extras, recurring bookings, subscriptions, cancellations and notes.
Dog details you ask customers for, such as names, breeds and number of dogs.
Documents customers attach to bookings, such as vaccination or insurance certificates.
Records of the field rules, terms and declarations customers accept at checkout.
Payment and transaction records, such as amounts, refunds, discount codes and payment references. Card numbers are handled by Stripe and never stored by Paddli.
Messages sent through the Service and their delivery status.
Gate and smart lock access codes issued for bookings.
Technical data, such as IP addresses and browser information, in logs.

Special category data

None intended. See section 4(e).

Frequency of transfer

Continuous, for as long as you use the Service.

Sub-processors

As described in section 6.

Schedule 2: Security Measures

Hosting: the Service runs on Amazon Web Services in Ireland. Our database and application servers sit on a private network that cannot be reached directly from the internet.
Encryption: data is encrypted in transit using TLS, and our database and file storage are encrypted at rest.
Resilience: our database runs across multiple data centres, with automated daily backups kept for a short rolling period.
Separation between Hosts: access controls in the Service make sure each Host can only see and change their own data.
Staff access: access to production systems is limited to the people who need it, uses individual accounts through central sign-in, and is logged.
Network protection: traffic passes through a web application firewall, and sign-up and sign-in forms are protected against automated abuse.
Payments: card details are entered directly into Stripe, which is certified to PCI-DSS Level 1. Paddli never stores card numbers.
Monitoring: we monitor the Service for errors, unusual activity and availability problems. Error reports mask text and inputs, and no screen recordings are taken on booking pages.
Data minimisation: we send Sub-processors only the data they need. For example, smart lock providers receive booking times and the field name, not customer details.
Supplier review: we review the security and data protection terms of each Sub-processor before we use it.
Incident response: we have a process for investigating, containing and reporting security incidents, including telling you about Personal Data Breaches under section 7.