House of DexterUse Dexter on the web

Data processing agreement

How we process personal data on behalf of HoD Business customers.

Last updated: 25 October 2026

This Data Processing Agreement ("DPA") forms part of the HoD Business terms between House of Dexter Private Limited ("House of Dexter", the "Processor") and the business using HoD Business (the "Customer", the controller or Data Fiduciary). It applies to personal data that House of Dexter processes for the Customer through HoD Business ("Customer Personal Data").

1. Roles and laws

The Customer is the controller (under the UK and EU GDPR) or Data Fiduciary (under India's Digital Personal Data Protection Act, 2023) of Customer Personal Data, and House of Dexter is its processor (or Data Processor). Each party will comply with the data protection laws that apply to it, including the Digital Personal Data Protection Act, 2023 and its rules, the UK GDPR and Data Protection Act 2018, the EU GDPR, the Australian Privacy Act 1988, and US state privacy laws, as applicable ("Data Protection Laws").

2. Details of the processing

  • Subject matter and duration: providing HoD Business, for as long as the HoD Business terms are in force and the export period after them.
  • Nature and purpose: hosting, storing, organising, displaying, transmitting and deleting data so the Customer can run its pet business, including check-ins, visits, records, memberships and client communication.
  • Data subjects: the Customer's clients (pet owners), their emergency contacts, and the Customer's staff and users.
  • Types of personal data: names, contact details, addresses, client and pet records, visit history, payment records the Customer enters, staff account details, and sign-in and usage data. Pet health records relate to animals; the Customer should not enter special category or sensitive personal data about people unless it is necessary and lawful.

3. House of Dexter's obligations

House of Dexter will:

  • process Customer Personal Data only on the Customer's documented instructions, which are the HoD Business terms, this DPA and the Customer's use of HoD Business, unless the law requires otherwise (in which case we'll tell the Customer first if the law allows);
  • make sure everyone authorised to process it is bound by confidentiality;
  • take appropriate technical and organisational security measures, described on our Security page;
  • help the Customer, taking into account the nature of the processing, to respond to requests from data subjects and to meet its obligations on security, breach notification, impact assessments and consultations with regulators;
  • tell the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer reasonably needs;
  • at the end of the service, delete or return Customer Personal Data as set out in the HoD Business terms, unless the law requires us to keep it;
  • make available the information reasonably needed to show compliance with this DPA, and allow audits as set out in section 6.

4. Sub-processors

The Customer authorises House of Dexter to use the sub-processors listed on our Service providers page. House of Dexter will have a written contract with each sub-processor that protects Customer Personal Data at least as well as this DPA, and remains responsible for their performance. We'll give at least 30 days' notice of a new sub-processor by updating that page and emailing account owners. If the Customer objects on reasonable data protection grounds and we can't resolve it, the Customer may cancel the affected service and receive a refund of prepaid fees for the remaining period.

5. International transfers

Customer Personal Data is stored in India, and some sub-processors process it in other countries, including the United States. Where Data Protection Laws restrict a transfer, the parties agree that the European Commission's Standard Contractual Clauses (Module 2, controller to processor, or Module 3 where the Customer is itself a processor), with the UK International Data Transfer Addendum where the UK GDPR applies, are incorporated by reference, with House of Dexter as data importer and the Customer as data exporter. For those clauses, the governing law and courts are those of Ireland (EU clauses) or England and Wales (UK Addendum), and the descriptions in section 2 and on our Security page complete their annexes.

6. Audits

On reasonable written request, no more than once a year (or after a breach), House of Dexter will answer the Customer's security questionnaire and provide relevant documents. If that isn't enough to show compliance, the Customer may carry out an audit, at its own cost, with at least 30 days' notice, during business hours and under confidentiality, in a way that doesn't affect other customers' data or security.

7. Liability and precedence

Each party's liability under this DPA is subject to the limits in the HoD Business terms, except where Data Protection Laws don't allow it. If this DPA conflicts with the HoD Business terms, this DPA wins for the processing of Customer Personal Data.

8. Contact

Data protection questions: support@houseofdexter.com, with "DPA" in the subject. A signed copy of this DPA is available on request.