Data Processing Addendum

This addendum forms part of the Service Terms between Peter Puchniarz trading as Peter Creates UK and the dental practice named in the accepted proposal, and applies whenever we process personal data on the practice's behalf.

1. Roles

For patient enquiry data generated by campaigns, the dental practice is the controller and Peter Creates UK acts as processor. For our own business contacts, applications and invoicing records, Peter Creates UK is the controller and our Privacy Policy applies.

2. Subject matter and duration

Processing lasts for the duration of the engagement plus any agreed wind-down period. Retention of enquiry records held by us: 24 months from our last contact with you, unless a longer period is required for accounting or legal reasons.

3. Categories of data and data subjects

Data subjects are prospective patients who respond to a campaign, and practice staff who administer it. Data includes name, email address, telephone number, town or postcode, treatment interest and free-text enquiry information supplied by the enquirer, plus campaign engagement identifiers created by the advertising platform.

No special category or health record data is requested. Practices must not send clinical records, treatment notes or patient-identifiable clinical information through advertising systems, and we will delete any such data we receive in error.

4. Processing activities

• Campaign and lead form configuration inside the practice's own advertising account.
• Transfer of enquiry information to the practice through the agreed route.
• Basic conversion tracking and reporting.
• Support, troubleshooting and quality checks on the enquiry flow.

5. Our obligations as processor

• Process personal data only on the practice's documented instructions.
• Ensure anyone with access is bound by confidentiality.
• Apply appropriate technical and organisational security measures.
• Not engage a new sub-processor without prior written notice and the opportunity to object.
• Assist the practice with data subject requests, impact assessments and regulator enquiries.
• Delete or return personal data at the end of the engagement, subject to legal retention duties.
• Make available the information reasonably needed to demonstrate compliance.

6. Practice obligations as controller

• Provide a lawful basis and clear privacy information to enquirers, including in its own privacy notice.
• Approve the wording of lead forms, consent statements and follow-up messaging.
• Handle enquiry data securely once transferred, and honour opt-outs and erasure requests.
• Not instruct us to process data in a way that would breach data protection law.

7. Sub-processors

Meta Platforms Ireland Ltd (advertising and lead forms), Resend (transactional email delivery), application and database hosting used to store enquiry records, Stripe (payments) and privacy-friendly website analytics, loaded only after consent. Practices are notified in writing before a new sub-processor is introduced.

8. International transfers

Where a sub-processor processes data outside the UK, transfers rely on UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, with appropriate supplementary safeguards.

9. Security

Access is limited to those who need it, accounts use strong authentication, transfers use encrypted connections, database access is restricted by row-level rules, and enquiry data is transferred only through the agreed route.

10. Personal data breaches

We notify the practice without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting its data, with the information available to us and our remediation steps. Notifying the ICO or affected individuals remains the controller's decision.

11. Data subject rights

We assist the practice in responding to access, correction, erasure, restriction and objection requests. Requests received directly by us are forwarded to the practice and not answered independently.

12. Audit

On reasonable written notice, and no more than once a year unless required by a regulator, we will answer a written security and processing questionnaire and provide supporting documentation.

13. Deletion and return

On termination, enquiry data held by us is deleted or returned at the practice's written request within 30 days, subject to legal retention obligations. Data held inside the practice's own advertising account remains under the practice's control.

14. Related documents and contact

See our Privacy Policy, Service Terms and Cookie Policy. ICO registration: our ICO registration reference is available on written request from the data protection contact below. Data protection contact: petercreatesuk@gmail.com.

Peter Creates UK provides advertising and marketing services only. We do not provide dental, medical, clinical, financial or legal advice. Dental practices remain responsible for clinical information, patient suitability, treatment delivery, pricing, finance information and professional obligations. Advertising performance is not guaranteed.