Data Processing Addendum

Effective November 8, 2026, version 2026-11-08.2

This Data Processing Addendum ("DPA") is part of the Terms of Service between you (the "Business") and [Company legal name] ("Ovelo"). It applies to personal data that Ovelo processes on the Business's behalf, mainly the private feedback, names and contact details that the Business's customers send through its Ovelo pages ("Customer Data"). It's designed to meet the requirements of data protection laws such as the EU and UK GDPR.

1. Roles

The Business is the controller of Customer Data and Ovelo is its processor. Ovelo processes Customer Data only to provide the Service, as described in the Terms and in the Business's settings, which together are the Business's documented instructions. If Ovelo believes an instruction breaks data protection law, it will tell the Business.

2. Details of processing

• Subject matter and purpose: collecting private feedback from the Business's customers and showing it to the Business in its feedback inbox.
• Duration: for as long as the Business has an account, until deletion under section 8.
• Types of data: feedback messages, and optionally a name, phone number or email, and the page language.
• Data subjects: the Business's customers and visitors who choose to send feedback.

3. Business responsibilities

The Business is responsible for having a lawful basis and giving any notices required to collect Customer Data, and for its own use of Customer Data, including any replies it sends.

4. Confidentiality

Ovelo ensures that anyone authorised to process Customer Data is bound by confidentiality. Ovelo's owners can see usage counts but are not given the content of feedback, except where needed to provide support the Business asked for, to investigate abuse, or to comply with the law.

5. Security

Ovelo keeps appropriate technical and organisational measures, including encryption in transit, separation of each Business's data, access controls, salted password hashing and abuse limits.

6. Sub-processors

The Business authorises Ovelo to use the sub-processors listed in the Privacy Policy (currently Cloudflare for hosting and storage). Ovelo will update that list before adding or replacing a sub-processor that handles Customer Data; the Business may object on reasonable data protection grounds, and if the objection can't be resolved, may close its account and receive a refund of any prepaid amount for the unused period. Ovelo remains responsible for its sub-processors.

7. Assistance and breaches

Ovelo will help the Business respond to data subject requests (the Business can also view and delete feedback itself) and with security, impact assessments and consultations as reasonably needed. Ovelo will notify the Business without undue delay, and where possible within 72 hours, after becoming aware of a personal data breach affecting Customer Data.

8. Deletion

When the Business deletes a page or its account, Ovelo deletes the related Customer Data straight away, and from backups within 30 days, unless the law requires it to be kept.

9. International transfers

Where Customer Data is transferred out of the EEA, UK or Switzerland to a country without an adequacy decision, the parties rely on the European Commission's Standard Contractual Clauses (Module 2, controller to processor) and the UK Addendum, which are incorporated by reference.

10. Audits

Ovelo will make available information reasonably needed to show compliance with this DPA and will respond to reasonable written questions. On-site audits may be arranged with reasonable notice, at the Business's cost, no more than once a year unless required by a regulator or after a breach.

11. Order of precedence

If this DPA conflicts with the Terms on data protection, this DPA wins.