Legal

Data Processing Addendum

How personal data is handled between the practice and Peter Creates UK.

Draft document. This page is not yet a legally reviewed document and must be completed and checked before publication.

Roles

For patient enquiry data generated by campaigns, the dental practice is the controller and Peter Creates UK acts as processor. For our own business contacts and applications, Peter Creates UK is the controller.

Subject matter and duration

Processing lasts for the duration of the engagement and any agreed wind-down period. Retention period: to be confirmed by the business owner.

Categories of data

Name, email address, telephone number, town or postcode, treatment interest and free-text enquiry information supplied by the enquirer. Practices must not send clinical records or patient-identifiable clinical information through advertising systems.

Processing activities

Campaign setup, lead form configuration, transfer of enquiry information to the practice, basic tracking, reporting and support.

Sub-processors

Meta Platforms (advertising and lead forms), to be confirmed by the business owner (email), to be confirmed by the business owner (payments) and to be confirmed by the business owner (analytics). Practices are notified in writing before a new sub-processor is introduced.

Security

Access is limited to those who need it, accounts use strong authentication, and enquiry data is transferred only through the agreed route. Suspected personal data breaches are reported to the practice without undue delay.

Data subject rights

We assist the practice in responding to access, correction, erasure and objection requests. Requests received directly are forwarded to the practice.

Deletion

On termination, enquiry data held by us is deleted or returned at the practice's written request, subject to legal retention obligations.