Data Processing Agreement (DPA)

This Data Processing Agreement ("Agreement") forms part of the Terms of Service between FindAService ("FindAService", "we", "us") and any registered service provider ("Provider", "you").

This Agreement applies only to the extent that the Provider processes personal data on behalf of FindAService as a data processor under the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Roles of the Parties

For the purposes of GDPR:

• FindAService acts as a Data Controller in relation to personal data processed through the platform.
• Providers act as Independent Data Controllers when delivering services directly to clients.
• Providers shall only be considered Data Processors where they process personal data strictly on behalf of FindAService and in accordance with our documented instructions.
• Nothing in this Agreement creates a joint controller relationship unless explicitly agreed.

2. Scope of Processing

Where applicable, the Provider may process the following categories of personal data on behalf of FindAService:

• Client contact details (name, phone, email)
• Booking and service request information
• Messages exchanged through the platform

Processing is limited to:

• facilitating service delivery through the platform;
• responding to client requests;
• communicating via FindAService systems.

Providers must not use this data for independent marketing or purposes outside the platform unless they have a separate lawful basis under GDPR.

3. Instructions

The Provider agrees to process personal data only:

• in accordance with this Agreement;
• in compliance with GDPR;
• based on documented instructions from FindAService (as reflected in platform functionality and Terms of Service).

4. Confidentiality

The Provider shall ensure that any person authorised to process personal data:

• is subject to confidentiality obligations;
• receives appropriate data protection training.

5. Security Measures

The Provider must implement appropriate technical and organisational measures, including:

• secure storage of personal data;
• protection against unauthorised access;
• use of secure communication channels;
• minimisation of data collection and retention.

6. Sub-processing

The Provider shall not engage sub-processors to process personal data obtained via FindAService without ensuring:

• equivalent data protection obligations;
• compliance with GDPR.

7. Data Subject Rights

The Provider shall:

• promptly notify FindAService of any request received from a data subject relating to their personal data;
• not respond directly unless legally required or authorised.

8. Data Breach Notification

The Provider must notify FindAService without undue delay (and no later than 48 hours) after becoming aware of a personal data breach involving data obtained through the platform.

9. Data Retention & Deletion

Upon completion of the service or termination of the relationship, the Provider shall:

• delete or return personal data obtained via the platform;
• retain data only where required by applicable law.

10. International Transfers

The Provider shall not transfer personal data outside the European Economic Area (EEA) without appropriate safeguards in place under GDPR.

11. Liability

Each party remains responsible for its own compliance with GDPR.

Providers acknowledge that when acting as independent data controllers, they bear full responsibility for their own data processing activities.

12. Governing Law

This Agreement is governed by the laws of Ireland and subject to the jurisdiction of the Irish courts.