Data processing agreement

This agreement forms part of the NunyaPro terms of service between Courage Sewonyadzi, trading as Nunyalink Systems (sole trader) (the “processor”) and the business using NunyaPro (the “controller”). It meets the requirements of Article 28 of the UK GDPR.

1. What we process

Who: the controller's clients, team members and contacts (such as suppliers).

What: names, contact details, appointment and purchase history, notes, and where the controller records them, health information relevant to a service (such as allergies and patch-test results), which is special category data.

Why: only to provide NunyaPro to the controller, for as long as the agreement lasts.

2. Our commitments

We process the data only on the controller's documented instructions, which are given through how the controller uses NunyaPro.

Everyone at Nunyalink Systems with access to the data is bound by confidentiality.

We keep the data secure, including encryption in transit and at rest, separation of each business's data, role-based access within each business, and limited, logged access by us for support only.

We help the controller respond to people exercising their data rights and with security, breach and impact-assessment obligations.

We tell the controller without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting their data.

When the agreement ends, the controller can export their data for 30 days; we then delete it unless the law requires us to keep it.

We make available the information needed to show we meet these obligations, and allow for reasonable audits.

3. Sub-processors

The controller authorises us to use the sub-processors below. We have written contracts with each giving the same level of protection, and we stay responsible for them. We'll give at least 30 days' notice before adding or replacing one, and the controller may object.

Provider	What for	Where
Supabase	Database, file storage and sign-in	United Kingdom (London)
Vercel	Web hosting	United States / EU edge network
Stripe	Card payments, deposits and plan billing	United States / Ireland
Resend	Sending emails to clients	United States
Twilio	Sending text messages to clients	United States

4. International transfers

Where a sub-processor handles data outside the UK, the transfer is covered by UK adequacy regulations (including the UK–US data bridge) or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

5. The controller's responsibilities

The controller is responsible for having a lawful basis for the data, telling their clients how it's used, getting consent where needed (for example for marketing messages or for recording health information), and keeping their team's access appropriate.

Questions about this agreement: support@nunyapro.co.uk.