Data Processing Agreement

You are the controller of the personal data you send us, and a business under the CCPA. We — JJC Creative LLC, trading as Wellth — are the processor, and a service provider under the CCPA.

Client Data means personal data about your customers that you send us or instruct us to collect. Account data about your own business and staff is not Client Data; we are the controller of that, and the Privacy Policy governs it.

Terms such as personal data, processing, data subject, supervisory authority and personal data breach carry the meanings given in applicable data protection law.

The details required by Article 28(3) are set out in Annex A. In summary: we process contact identifiers and appointment records belonging to your customers, for the duration of your subscription, in order to match bookings to advertising clicks and deliver conversions to the advertising platforms you select.

We process Client Data only on your documented instructions. Your configuration of the service — the destinations you connect, the events you enable, the data you upload — is your instruction, together with this agreement and the Terms of Service.

We will tell you if we believe an instruction breaches data protection law, and may decline to follow it. We may process Client Data where the law requires us to, and where lawful we will tell you first.

You warrant that your instructions are lawful, that you have a valid basis for the processing, and that you have given your customers the notices and obtained the consents the law requires — including for disclosure to the advertising platforms you select.

We do not, and are contractually prohibited from:

• selling or sharing Client Data, as those terms are defined in the CCPA;
• retaining, using or disclosing it for any purpose other than performing the service, or outside the direct business relationship between us;
• combining it with personal data from another source, except where the CCPA permits a service provider to do so;
• using it to train, fine-tune or evaluate machine learning models;
• using it for our own advertising, marketing or product analytics.

We will tell you if we determine we can no longer meet these obligations. You may then take reasonable steps to stop and remediate unauthorised use.

The service is not designed to process special category data under Article 9, sensitive personal information under the CCPA, or data about criminal convictions. You must not send it. This includes health information, which matters here because service names at a spa or clinic can reveal a condition — the service includes a control that strips service names before dispatch, enabled by default for clinical business types.

We are not a HIPAA business associate and do not offer a business associate agreement. If you are a covered entity, do not send us protected health information.

Access to Client Data is limited to personnel who need it to operate, support or secure the service. They are bound by confidentiality obligations that survive their engagement, and their access is removed when it is no longer needed.

We implement the technical and organisational measures set out in Annex B, having regard to the state of the art, the cost of implementation, and the risk to individuals. We may update them, and will not reduce overall security during the term.

You give general authorisation for us to engage the sub-processors listed in Annex C. We impose data protection terms on each that are no less protective than this agreement, and we remain fully liable to you for their performance.

We will give you at least 30 days’ notice before adding or replacing a sub-processor that handles Client Data. If you reasonably object on data protection grounds, tell us within that period and we will work with you to find an alternative; if we cannot, you may terminate the affected part of the service and receive a pro-rata refund of any prepaid fees for it.

Meta and Google act as independent controllers of the conversion data you direct us to send them. They are not our sub-processors for that purpose, and their processing is governed by your own agreements with them.

We will make available the information reasonably necessary to demonstrate compliance with Article 28, and will respond to a reasonable security questionnaire once in any 12-month period.

You may also inspect our processing once in any 12-month period, or after a personal data breach affecting your Client Data. Such an inspection requires 30 days’ written notice, must happen during business hours, must not unreasonably disrupt the service, is conducted at your cost, and is subject to confidentiality. Where an auditor is a competitor of ours, we may reasonably object and propose an independent alternative.

These limits are deliberate and stated honestly. We are a small company. An unlimited audit right is one we could not honour if several customers exercised it, and a right granted on paper that could not survive being used is worth less to you than a bounded one we will actually meet.

Taking into account the nature of the processing, we will help you respond to requests from individuals exercising their rights — access, correction, deletion, restriction, portability and objection — by appropriate technical and organisational measures.

If an individual contacts us directly about Client Data, we will not respond substantively except to direct them to you, and we will forward the request without undue delay. We cannot verify their identity or know what they were told when they booked; only you can.

We will delete or correct a specific individual’s Client Data on your instruction within 30 days. We cannot retrieve data already delivered to an advertising platform — that platform holds it as an independent controller, and the request must go to them.

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting your Client Data. The notice will describe what happened, the categories and approximate volume of data involved, the likely consequences, and what we are doing about it — to the extent known, with updates as we learn more.

Notifying a supervisory authority and the individuals affected is your decision and your obligation as controller. We will provide the information you need to make it. Our notification is not an admission of fault.

You may export your data at any time during the term. On termination, we delete Client Data within 30 days, except where the law requires us to retain it — in which case we isolate it, stop processing it for any other purpose, and delete it when the requirement ends.

Operational delivery logs, which record event identifiers and delivery outcomes rather than personal data, are retained for 24 months for security and dispute purposes.

Backups are deleted on their ordinary cycle, which may take up to a further 30 days. Data in a backup is not processed for any purpose while it remains there.

We and all our sub-processors operate in the United States. Where you transfer Client Data from the United Kingdom, the European Economic Area or Switzerland, the transfer relies on the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914) — Module Two, controller to processor — which are incorporated into this agreement by reference, together with the UK International Data Transfer Addendum where the UK GDPR applies.

For those clauses: Annex A of this agreement supplies the processing details, Annex B the technical and organisational measures, and Annex C the sub-processor list. The optional docking clause applies. For Clause 17 the governing law is Irish law, and for Clause 18 the forum is the courts of Ireland. Where the UK Addendum applies, the governing law is the law of England and Wales.

We have no reason to believe the laws applicable to us prevent us meeting these obligations. We will tell you if that changes, and we will challenge any government request for Client Data that appears unlawful and tell you about it where the law allows.

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with your data protection impact assessments and with any prior consultation with a supervisory authority that relates to our processing.

This agreement takes effect when you start using the service and continues while we process Client Data. Where it conflicts with the Terms of Service on the handling of Client Data, this agreement prevails; the Standard Contractual Clauses prevail over both.

Liability under this agreement is subject to the limitations in section 12 of the Terms of Service, except where applicable data protection law does not permit it.

For a countersigned copy, or for the Standard Contractual Clauses as a separate executed document, write to privacy@trywellth.co.

A.1Subject matter and duration

Matching appointment records to advertising clicks and delivering conversions to the advertising platforms you select, for the duration of your subscription plus the deletion period in section 12.

A.2Nature and purpose

Collection, storage, normalisation, hashing, matching, transmission to your selected advertising platforms, aggregation for reporting, and deletion. The purpose is advertising conversion measurement.

A.3Categories of data subject

Your customers — people who booked or attended an appointment with your business.

A.4Categories of personal data

• First and last name
• Email address
• Telephone number
• Where your export contains them: postal town, state or region, postal code, country, date of birth and gender
• A customer reference derived from those identifiers and your account, stable for one person at your business and different for the same person at another
• Appointment details: date and time, monetary value, status, whether it was a first visit
• Service booked, unless you enable the control that strips it
• Advertising click identifiers captured by the website tag on your site (gclid, wbraid, gbraid, fbclid, ttclid)

A.5Special categories

None. Sending them is prohibited by section 5.

A.6Frequency

Continuous where a booking platform connection is active; otherwise each time you upload data.

A.7Recipients

The sub-processors in Annex C, and the advertising platforms you select.

These describe what the service does today. They are specific because a list of generic assurances cannot be verified, and an unverifiable assurance is not a measure.

• Pseudonymisation before transmission. Email addresses and phone numbers are normalised and replaced with a SHA-256 hash before a conversion leaves our systems. Destinations and intermediaries receive the hash, not the value.
• Credential isolation. Advertising platform credentials are held in an encrypted secret store separate from the application database, and are never transmitted to a browser.
• No password storage. The service holds no passwords. Authentication is by one-time code, stored only as a SHA-256 hash, valid for ten minutes and for a single use; or by an identity provider that asserts a verified address.
• Session binding. Sessions carry a fingerprint of a per-account value, so rotating that value terminates every existing session.
• Tenant isolation. Each account’s conversions are delivered to a tracking container belonging only to that account, and every payload is signed with a per-account secret.
• Encryption in transit. All traffic is served over TLS.
• Access control. Administrative access is restricted to named operators by an explicit allow-list held in server configuration, not in the application database.
• Input handling. Uploaded files are treated as untrusted data and are never executed as instructions by any automated system that processes them.
• Data minimisation controls. Service names can be stripped from every conversion before dispatch, and this is enabled by default for clinical business types.
• Logging. Delivery attempts are logged with event identifiers and outcomes rather than personal data.

We hold no third-party security certification at present and do not claim one. If you require one as a condition of purchase, tell us before you subscribe.

To be notified when this list changes, write to privacy@trywellth.co.