PetOS Data Processing Addendum

1. Parties, scope and priority

This Addendum is between NORTH & LIGHT INNOVATIONS PORTAL (PetOS) and the Customer under the Product Terms or a signed agreement. It applies when PetOS processes personal data on the Customer’s behalf. The Customer is controller, or processor with authority to appoint PetOS as subprocessor. PetOS is processor or subprocessor as applicable. Independent controller activities described in the Privacy Notice are outside this Addendum.

This Addendum takes priority over conflicting contractual provisions about its processing subject matter. Applicable law takes priority over conflicting contract language. It does not, by itself, constitute executed EU Standard Contractual Clauses, a UK transfer addendum, appointment of a local representative or a finding of compliance in every jurisdiction.

2. Processing description and duration

Subject matter and purpose: hosting and operating pet-care business workspaces, authorized access, bookings, care operations, documents and photos, customer communications, commerce, reporting, support and security. Processing includes collection, organization, storage, retrieval, transmission, security inspection, export, restriction and deletion as instructed.

Data subjects: business owners, staff, contractors, suppliers, pet parents, household contacts, authorized pickup contacts and people incidentally identified in permitted records. Data categories: contact and identity details, account relationships, schedules, pet and care information linked to people, documents and images, messages, consents, transaction records and access/audit metadata.

Processing continues for the service term and as needed for lawful return, deletion or restricted retention. Special-category human data, government identity records and full payment-card data are not intended for ordinary uploads; any exceptional processing requires a separate supported arrangement and lawful instructions.

3. Customer instructions and responsibilities

The agreement, configured product workflows and written authorized support requests are documented instructions, including for necessary transfers subject to law. The Customer determines the purposes, data categories, authorized users and retention needs, provides required notices and obtains required consents or other lawful grounds. It must not instruct unlawful processing.

PetOS processes only on documented instructions unless law requires otherwise; where legally permitted, it will inform the Customer of that requirement. PetOS will inform the Customer if it believes an instruction infringes applicable data-protection law and may pause the affected processing while the issue is resolved. Additional services or instructions outside the agreed scope may require a separate agreement.

4. Confidentiality and security

PetOS ensures personnel authorized to process Customer personal data are subject to confidentiality duties and access appropriate to their responsibilities. It maintains technical and organizational measures proportionate to risk, including authenticated membership and permission checks, tenant scoping, private object storage, encryption in transit and provider-managed encryption at rest, file scanning, audit and operational logs, backups and incident handling.

The Customer is responsible for its authorized users, lawful access assignments, endpoint security, originals and export arrangements. Security measures may evolve without materially reducing overall protection. No certification, dedicated hardware, customer-managed encryption key, uninterrupted availability or complete-file backup service is promised unless separately agreed.

5. Subprocessors

The Customer generally authorizes the providers identified on the Service Providers page for the described services. PetOS will impose appropriate written data-processing and confidentiality obligations on subprocessors and remains responsible for their performance of subcontracted processing obligations under this Addendum.

PetOS will notify the Customer’s account contact at least 30 days before a new or replacement subprocessor starts processing Customer personal data, except where urgent protective or legal action requires earlier use with notice as soon as practicable. A Customer may object on reasonable data-protection grounds during the notice period. The parties will seek a practical solution; if none is possible, the Customer may terminate the affected service before the new processing begins and receive a refund of unused prepaid fees for that affected service.

6. International transfers

The primary application database and private uploads are in Doha, Qatar. Other provider processing may occur internationally as described in the Privacy Notice and Service Providers page. PetOS will not rely on this Addendum as blanket consent where a separate legal transfer mechanism is required.

Where applicable law requires approved transfer clauses, supplementary measures, localization or a separately signed instrument, the parties must put those arrangements in place before the restricted processing or transfer. Contact info@thepetos.app to establish the arrangement. A business must not upload information requiring unsupported localization or safeguards on the assumption that public signup establishes them.

7. Rights requests and regulatory assistance

Taking account of the nature of processing, PetOS will reasonably assist the Customer with access, correction, deletion, restriction, portability, objection and other legally applicable requests, using available tools and appropriate support. PetOS will forward a request concerning Customer-controlled data to the Customer without responding substantively unless authorized or legally required.

PetOS will provide reasonable information and assistance for the Customer’s security obligations, impact assessments and regulator consultations, taking account of available information and processing risk. Each party remains responsible for its own legal decisions and deadlines. Any agreed charges for unusual assistance must not prevent a legally required response.

8. Personal-data incidents

PetOS will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer personal data. The notice will describe the nature of the breach, affected categories and approximate scale where known, likely consequences, containment or remediation and a contact point. Information may be provided in phases as it becomes available.

PetOS will investigate, take reasonable containment and remediation steps and cooperate with the Customer. The Customer determines its notifications to individuals and regulators unless law places a direct duty on PetOS. Notification is not an admission of fault. Unsuccessful blocked attacks with no compromise are not automatically personal-data breaches.

9. Return, deletion and legal holds

On service termination or an authorized instruction, the Customer may choose lawful return or deletion of Customer personal data, subject to applicable legal retention. Available product exports cover supported datasets; contact info@thepetos.app to agree the scope, format and secure handling of other records and files. PetOS will confirm the handling plan and completion rather than assume a cancelled subscription is a deletion instruction.

PetOS will delete or return the personal data and remove remaining copies when no longer required, except data that must be retained by law. Copies in backups will be restricted from ordinary use and removed through the applicable rotation; if restored, the deletion instruction must be reapplied. Retained records remain protected and are used only for the retained purpose. Separate controller records follow the Privacy Notice. If a required deletion deadline or retention regime cannot be supported, the parties must resolve that before introducing the affected data.

10. Information and audits

PetOS will make available information reasonably necessary to demonstrate its compliance with this Addendum and allow and contribute to required audits, including inspections by the Customer or an independent auditor bound by confidentiality. Audits should use existing evidence first, reasonable notice and proportionate scope, while protecting other tenants, secrets and system security. Mandatory regulator access and urgent justified reviews are not restricted by routine scheduling.

No public security certification or independent audit report is represented as available merely because this Addendum exists. The parties will agree practical procedures and any reasonable costs in advance, without preventing mandatory rights.

11. Contact and contract terms

Customer instructions, privacy assistance, incidents and subprocessor objections: info@thepetos.app. Each Customer must keep its authorized business contact current. The Product Terms govern liability, law and disputes subject to mandatory rights and this Addendum’s priority on data-processing obligations.