Data Processing Agreement

Effective date: 24 September 2026
Last updated: 24 September 2026

This agreement governs the personal data that Webmiqo processes on your behalf. It forms part of the Terms of Service and takes effect automatically when you accept them. No signature is required; if your organisation needs a countersigned copy, write to hello@webmiqo.com.

In this agreement, you are the controller and Webmiqo ("Webmiqo") is the processor. "GDPR" means Regulation (EU) 2016/679 and, where it applies to you, the UK GDPR.

1. Scope

Webmiqo processes personal data on your behalf only to provide the service described in the Terms of Service. Where Webmiqo processes personal data about you as a customer — your account, your billing, your support requests — it acts as a controller, and the Privacy Policy applies instead.

2. What is processed

Subject matter: the provision of the Webmiqo website platform.

Duration: for as long as your account exists, plus the deletion periods in section 9.

Nature and purpose: hosting, storing, generating, displaying and publishing your website and the data it receives, keeping your agenda, sending the appointment e-mails you switch on, answering the questions you ask the assistant, and making the agenda changes and sending the messages you confirm through it.

Categories of data subjects:
- visitors to the websites you publish, who submit an enquiry;
- individuals identifiable in the media you upload;
- individuals named in your website content, such as staff members;
- your clients, whose details and appointments you record in your agenda.

Categories of personal data:
- contact details submitted through your contact form: name, email address, phone number, message;
- a keyed fingerprint derived from a submitter's IP address, used only to prevent duplicate and automated submissions;
- images and files you upload;
- any personal data you choose to include in your website content;
- client details you record in your agenda: a name, and optionally an email address, a phone number and notes;
- appointments: date and time, service, status (for example cancelled or no-show) and notes, together with a record of changes to each appointment;
- appointment e-mails you switch on: the client's name and e-mail address, the appointment's date, time and service, your business name and your reply address, and a record of whether each message was sent;
- messages you send through the assistant: the recipient's name and e-mail address, the message you confirmed, your business name and your reply address; the content is not stored by Webmiqo after sending;
- questions you ask the assistant, typed or spoken, which may contain the names of your clients; only the question is sent to the AI provider — for a spoken question, a short recording that is turned into text and not stored by Webmiqo — never the records it looks up.

Special category data: the service is not designed for special category data as defined in Article 9 GDPR. Do not put it into Webmiqo, including in client and appointment notes in your agenda.

3. Our obligations

Webmiqo will:

1. process personal data only on your documented instructions, which are given through the Terms of Service, this agreement and your use of the platform, including for transfers to a third country, unless required otherwise by law — in which case we will inform you before processing, unless the law forbids it;
2. tell you if, in our opinion, an instruction infringes data protection law;
3. ensure that everyone authorised to process the data is bound by confidentiality;
4. implement appropriate technical and organisational measures under Article 32 GDPR, described in section 6;
5. respect the conditions in section 4 for engaging sub-processors;
6. assist you, by appropriate technical and organisational measures and insofar as possible, to respond to requests from data subjects exercising their rights;
7. assist you with your obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to us;
8. delete or return personal data at the end of the service, as set out in section 9;
9. make available the information needed to demonstrate compliance with Article 28 GDPR, and allow for and contribute to audits under section 10.

4. Sub-processors

You give Webmiqo general written authorisation to engage sub-processors. The categories in use are published at Sub-processors, and we will give you the name and processing location of the provider in each category on request.

Before a new sub-processor starts processing personal data on your behalf, we will notify you directly, naming the provider and what it will do. You have thirty days from that notice to object on reasonable data protection grounds. If you object and we cannot offer a workable alternative, you may terminate the affected part of the service and receive a refund of any prepaid, unused fees.

Each sub-processor is bound by written terms that impose obligations no less protective than those in this agreement. Webmiqo remains fully liable to you for its sub-processors' performance.

5. International transfers

Personal data processed under this agreement is hosted in the United Kingdom. Transfers from the European Economic Area to the United Kingdom rely on the European Commission's adequacy decisions for the UK. Where a sub-processor processes personal data outside the EEA and the UK without an adequacy decision, the transfer relies on the European Commission's standard contractual clauses, together with the supplementary measures set out in that sub-processor's contract. The clauses are incorporated into this agreement by reference to the extent they apply.

6. Security

Webmiqo maintains technical and organisational measures appropriate to the risk, including:

• access control scoped per workspace, enforced at the database level, so that one customer cannot read another's data;
• encryption of data in transit;
• encrypted handling of sensitive tokens and identifiers;
• private storage for uploaded media, served only through short-lived authorised links;
• rate limiting and abuse protection on public endpoints;
• restricted and audited access to production systems;
• separation of development, test and production data;
• logging that records operations without recording customer content.

We may change these measures as the service develops, provided the level of protection is not reduced.

7. Personal data breaches

Webmiqo will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and in any event within seventy-two hours. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for further information. Where we cannot provide all of that at once, we will provide it in phases without undue delay.

Notifying your supervisory authority and the affected individuals remains your responsibility as controller. We will give you the information and assistance you reasonably need to do so.

8. Requests from data subjects

If a data subject contacts Webmiqo directly about personal data processed on your behalf, we will not respond substantively. We will refer them to you and forward the request without undue delay.

Where a request requires access to data inside your workspace, you can act on it yourself through the platform. Where you cannot, we will assist you.

9. Deletion and return

On termination of the service, or on your instruction, Webmiqo will delete the personal data it processes on your behalf.

• Deleting your account removes your workspace, its websites, drafts, media, enquiries and agenda.
• You can delete an individual client from your agenda at any time. Their name, contact details and notes, and the notes on their appointments, are erased straight away; the appointments remain as times without a name.
• If your subscription ends without your account being deleted, your data is retained so that you can return; access is closed until the subscription is active again. We will give you notice and a reasonable opportunity to retrieve or reactivate before deleting anything.
• Deleted data disappears from backups as those backups age out of their rotation.
• We may retain personal data where the law requires it, for as long as the law requires, and will continue to protect it under this agreement while we do.

Before deletion, you can export your data from the platform. If you need an export we do not offer, ask us at hello@webmiqo.com.

10. Audit

Webmiqo will make available to you the information necessary to demonstrate compliance with Article 28 GDPR. Where that is not enough, you may request an audit, no more than once per year unless a supervisory authority requires otherwise or a breach has occurred. Audits are scheduled with reasonable notice, conducted during business hours, subject to confidentiality, and carried out in a way that does not disrupt the service or compromise other customers' data. You bear your own audit costs.

11. Liability and precedence

Liability under this agreement is subject to the limitations in the Terms of Service, except where those limitations are not permitted by data protection law.

If this agreement conflicts with the Terms of Service on the processing of personal data on your behalf, this agreement prevails. Where standard contractual clauses apply, those clauses prevail over both.

12. Contact

Questions about this agreement: hello@webmiqo.com
Webmiqo