Data Processing Agreement

This Data Processing Agreement (DPA) is entered into between WELX (Maklain Partners Limited, a company registered in England and Wales under company number 17381124 and VAT registration number 527 6816 63, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, trading as WELX) and the Subscriber whose acceptance is recorded at signup. It forms part of the agreement between the parties alongside the Terms and Conditions.

This DPA is required by Article 28 of the UK General Data Protection Regulation (UK GDPR) where a processor processes personal data on behalf of a controller.

1. Definitions

In this DPA, the following terms have the meanings given in UK GDPR: controller, processor, data subject, personal data, processing, personal data breach, supervisory authority. Additionally:

Client Data Personal data relating to the Subscriber's clients that is stored in or processed through the WELX platform by or on behalf of the Subscriber.

Account Data Personal data relating to the Subscriber themselves, including name, email address, business details, and billing information, collected and held by WELX to provide and administer the subscription.

Platform The WELX platform software, including all related services and infrastructure.

2. The Roles of the Parties

2.1The Subscriber is the data controller for Client Data. The Subscriber determines the purposes and means of processing Client Data and is responsible for complying with all controller obligations under UK GDPR in relation to it.

2.2WELX is the data processor for Client Data. WELX processes Client Data only on the documented instructions of the Subscriber, as set out in this DPA and the Terms and Conditions, and for no other purpose.

2.3WELX is separately the data controller for Account Data. WELX's processing of Account Data for the purposes of administering the subscription, billing, and providing support is governed by WELX's Privacy Notice, not by this DPA.

2.4Nothing in this DPA makes WELX a joint controller of Client Data. WELX has no independent purpose for processing Client Data and acquires no right to use it beyond what is necessary to provide the platform.

3. The Subscriber's Obligations as Controller

3.1The Subscriber is responsible for ensuring there is a lawful basis under UK GDPR for processing each category of Client Data stored in the platform. Likely bases include contract (where the data is necessary to deliver their services) and consent.

3.2The Subscriber must provide a privacy notice to their clients explaining how their personal data is collected, used, stored, and shared, including the use of WELX as a software platform. WELX can provide a template sub-processor disclosure on request to assist with this.

3.3The Subscriber must ensure that any consent required for processing Client Data is obtained before that data is entered into the platform, and that records of consent are maintained outside the platform.

3.4The Subscriber must not instruct WELX to process Client Data in a way that would cause WELX to breach UK GDPR or any other applicable law.

4. Special-Category Data, Prohibition

The WELX platform must not be used to store, process, or transmit special-category personal data as defined in Article 9 UK GDPR. This includes health and medical information, injury notes, diagnosed conditions, medication, and any other data revealing a client's physical or mental health status. The platform is not configured or secured to handle such data. Breach of this prohibition by the Subscriber constitutes a material breach of this DPA and the Terms and Conditions, and entitles WELX to suspend or terminate the account with immediate effect.

4.1If the Subscriber requires a platform that can store health or medical data about clients, they must not use WELX for this purpose and should seek a platform that is specifically designed and configured for special-category data processing.

4.2If WELX becomes aware that special-category data has been stored in the platform in breach of this prohibition, WELX will notify the Subscriber and require immediate deletion. If the Subscriber does not comply within 48 hours, WELX may delete the data and suspend the account.

5. Scope of Processing

5.1Subject matter: the provision of the WELX platform, enabling the Subscriber to manage client bookings, scheduling, payments, and invoicing.

5.2Duration: for the term of the Subscriber's subscription, plus any post-termination period required to facilitate data export and deletion as set out in clause 10.

5.3Nature of processing: storage, retrieval, display, organisation, structuring, and transmission of Client Data within the platform for the purposes of the Subscriber's business.

5.4Purpose: to enable the Subscriber to deliver their their services to their clients using the platform.

5.5Categories of data subjects: the Subscriber's clients, individuals who have engaged the Subscriber for their services.

5.6Categories of personal data: name, contact details (email, phone), session booking history, payment and invoice history, and any other data the Subscriber chooses to record about their clients, subject to the prohibition in clause 4.

6. WELX's Obligations as Processor

6.1WELX will process Client Data only on the documented instructions of the Subscriber, as set out in this DPA. If WELX is required by law to process Client Data for any other purpose, it will inform the Subscriber before doing so unless the law prohibits this.

6.2WELX will ensure that all personnel with access to Client Data are subject to appropriate confidentiality obligations.

6.3WELX will implement and maintain appropriate technical and organisational security measures to protect Client Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, as required by Article 32 UK GDPR.

6.4WELX will not engage any sub-processor to process Client Data without the Subscriber's prior knowledge. Sub-processors currently used are listed in the Sub-processor Schedule (Document 3). WELX will give 30 days notice of any change to the sub-processor list, during which time the Subscriber may object on reasonable grounds.

6.5WELX will, taking into account the nature of the processing, assist the Subscriber in responding to data subject requests from clients exercising their rights under UK GDPR, including rights of access, rectification, erasure, restriction, and portability.

6.6WELX will assist the Subscriber in meeting obligations under Articles 32 to 36 UK GDPR in relation to security, breach notification, data protection impact assessments, and prior consultation, taking into account the nature of the processing and information available to WELX.

6.7WELX will not transfer Client Data outside the UK or EEA without ensuring that an appropriate transfer mechanism is in place, as described in the Sub-processor Schedule.

7. Security Measures

WELX applies the following technical and organisational measures to protect Client Data:

7.1HTTPS encryption for all data in transit between users and the platform.

7.2Encryption of data at rest in the database.

7.3Access controls ensuring that only authorised personnel can access production systems.

7.4Database credentials and API keys stored as secret environment variables, not exposed in code or logs.

7.5Passwordless authentication: a time-limited, single-use code (or sign-in link) sent to the Subscriber's registered email address. No password database is held, eliminating the risk of credential theft or brute-force attack.

7.6Regular security reviews of the platform and its dependencies.

8. Personal Data Breach

8.1WELX will notify the Subscriber without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting Client Data.

8.2The notification will include: the nature of the breach; the categories and approximate number of data subjects affected; the categories and approximate volume of Client Data records affected; the likely consequences; and the measures taken or proposed to address the breach.

8.3The Subscriber, as controller, is responsible for assessing whether the breach must be reported to the ICO (within 72 hours of becoming aware, under Article 33 UK GDPR) and whether affected clients must be notified. WELX will provide reasonable assistance in this process.

9. Audit and Information

9.1WELX will provide the Subscriber with all information reasonably necessary to demonstrate compliance with this DPA.

9.2WELX will allow for and contribute to audits conducted by the Subscriber or an auditor appointed by the Subscriber, on reasonable notice and at the Subscriber's cost. WELX may require the auditor to sign a confidentiality agreement before access is granted.

9.3The Subscriber agrees that the right to audit will be exercised no more than once per 12-month period unless there is a reasonable specific concern about compliance.

10. Term, Termination and Data Deletion

10.1This DPA continues for the duration of the Subscriber's subscription and terminates automatically on termination or expiry of the subscription.

10.2On termination of the subscription, Client Data will remain accessible for export for 30 days. The Subscriber is responsible for exporting any data they wish to retain before this period expires.

10.3After the 30-day export window, WELX will permanently delete all Client Data from the platform and its backup systems, except where retention is required by law. WELX will confirm deletion in writing on request.

10.4WELX will not retain Client Data after deletion for any commercial purpose. The anonymised benchmarking exception does not apply to Client Data.

11. Liability and Indemnity

11.1Each party's liability under this DPA is subject to the liability limits set out in the Terms and Conditions.

11.2The Subscriber indemnifies WELX against any claim, loss, or regulatory penalty arising from the Subscriber's failure to comply with its obligations as controller under this DPA or UK GDPR, including any claim brought by a data subject in relation to the Subscriber's processing of their data.

11.3WELX indemnifies the Subscriber against any claim, loss, or regulatory penalty arising directly from WELX's failure to comply with its obligations as processor under this DPA, where such failure is attributable solely to WELX and not to the Subscriber's instructions.

12. General

12.1This DPA is governed by English law. Any disputes are subject to the jurisdiction of the courts of England and Wales.

12.2In the event of any conflict between this DPA and the Terms and Conditions, this DPA takes precedence in relation to the processing of personal data.

12.3This DPA is between the Subscriber and Maklain Partners Limited (company number 17381124), trading as WELX, which is the processor of Client Data. We will notify Subscribers of any material change to this DPA or to the processing entity.