Data Processing Agreement

This Data Processing Agreement (“DPA”) is entered into between Squish (“Processor”) and the customer identified in the account (“Controller”, “you”).

For personal data you upload, transmit, or otherwise process through the Services — your website content, your mailboxes, your own customers’ details — you are the controller and Squish is the processor. You decide why and how that data is processed; we act on your instructions.

For the account data we hold to run our own business — your billing details, your support history, the identity of the person who signed up — Squish is the controller. That processing is governed by the Privacy Policy, not by this DPA.

This DPA applies for as long as Squish processes personal data on your behalf, and survives termination for as long as we retain any of that data.

Where this DPA and the Terms of Service conflict on the processing of personal data, this DPA governs. Where this DPA and the Standard Contractual Clauses conflict, the Clauses govern.

Squish processes personal data only on your documented instructions, including for international transfers, unless required otherwise by law we are subject to. Where the law requires processing without your instruction, we will tell you before processing unless that law forbids it.

Your instructions are: the Terms of Service, this DPA, your configuration of the Services, and any further written instruction you give us. Using the Services as documented is an instruction — you do not have to itemise ordinary operation.

If we believe an instruction infringes the GDPR or other applicable data-protection law, we will tell you and may pause that processing rather than carry it out.

We do not sell personal data, and we do not use your data to train AI models — ours or anyone else’s. Where a Service sends content to an AI sub-processor to produce a result for you, that is processing on your instruction and for your benefit only.

Squish ensures that every person authorised to process personal data is bound by an obligation of confidentiality, whether contractual or statutory, and that access is limited to those who need it to deliver the Services or to comply with law.

Squish implements appropriate technical and organisational measures to protect personal data, having regard to the state of the art, cost of implementation, and the nature and risk of the processing. The measures in force are described in Annex II and on the Trust page, which is kept current.

Measures may change as the platform evolves. We will not reduce the overall level of security of the Services during your subscription.

Taking into account the nature of the processing, Squish assists you by appropriate technical and organisational measures — insofar as possible — in fulfilling your obligation to respond to requests to exercise rights under Chapter III of the GDPR (access, rectification, erasure, restriction, portability, objection).

In practice: the Services let you access, export, correct and delete customer data yourself. Where a request cannot be satisfied through the product, email privacy@squish.co or open a tracked request and we will help.

If a data subject contacts us directly about data we process on your behalf, we will not respond to the substance ourselves. We will forward the request to you promptly, because it is yours to answer.

Squish assists you in ensuring compliance with the obligations in Articles 32 to 36 of the GDPR — security of processing, breach notification, data protection impact assessments, and prior consultation — taking into account the nature of the processing and the information available to us.

Squish notifies you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting personal data processed on your behalf.

The notification will describe, to the extent known at the time: the nature of the breach and the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point for further information. Where the full picture is not available at once, we will provide it in phases as it becomes available rather than delaying the first notification.

You grant Squish general authorisation to engage sub-processors, subject to this section.

The current list of sub-processors — vendor, purpose, region, and their own compliance programme — is maintained on the Trust page and forms Annex III to this DPA. It is deliberately kept in one place rather than duplicated here, so that it cannot drift out of step with the list you can actually see.

Squish imposes on each sub-processor, by written contract, data-protection obligations no less protective than those in this DPA. Squish remains fully liable to you for a sub-processor’s performance.

We will give you at least 30 days’ notice before adding or replacing a sub-processor, by email to the account’s administrative contact. If you reasonably object on data-protection grounds within that period, we will work with you in good faith to find a solution; if none is available, you may terminate the affected Service without penalty and receive a pro-rata refund of prepaid fees.

Squish is established in the United States. Where you are established in the EEA, the United Kingdom, or Switzerland, personal data you send us is transferred out of your jurisdiction.

For those transfers, the parties adopt the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914, which are incorporated into this DPA by reference with the following selections:

• Module Two (controller to processor) applies.
• Clause 7 (docking clause) — does not apply.
• Clause 9 — Option 2, general written authorisation, with the 30-day notice period in §9 above.
• Clause 11 — the optional independent dispute-resolution paragraph does not apply.
• Clause 17 — governed by the law of Ireland.
• Clause 18(b) — the courts of Ireland.
• Annex I, Annex II and Annex III are the annexes below.

For UK transfers, the International Data Transfer Addendum issued by the Information Commissioner under section 119A of the Data Protection Act 2018 applies to the Clauses, with the UK as the governing law and the courts of England and Wales. For Swiss transfers, the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner as the supervisory authority, and “data subject” extended to legal entities while Swiss law so provides.

At the end of the provision of Services, Squish deletes or returns all personal data processed on your behalf, at your choice, and deletes existing copies unless law requires storage.

Operationally: you may export your data at any time during the subscription. After termination, account data is deleted within 30 days, except billing records, which are retained for 7 years as US tax and accounting law requires. Operational logs age out on the published windows in the Trust page retention table, which are enforced automatically rather than by hand.

Backups are the exception worth stating plainly: data deleted from live systems may persist in encrypted backups until those backups age out on their own schedule. It is not restored to live systems, and it expires without intervention.

Squish makes available to you the information necessary to demonstrate compliance with Article 28, and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate.

In the first instance we will satisfy this by providing our security documentation, completing a security questionnaire (CAIQ-Lite, SIG-Lite, or your own format), and answering reasonable written questions. Where that is genuinely insufficient for your compliance obligations, you may request an audit on 30 days’ written notice, no more than once in any 12-month period unless a regulator requires otherwise or there has been a personal data breach. Audits are conducted during business hours, subject to confidentiality, and in a manner that does not disrupt the Services or the data of other customers.

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service.

Nothing in this DPA limits either party’s liability to a data subject under the Standard Contractual Clauses, or any liability that cannot be limited under applicable law.