Data Processing Agreement

Last updated: 6th November 2026

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions (the "Terms") between Grizzlyware Ltd, trading as Muddy Booking ("we", "us", "our"), and each operator that uses Muddy Booking ("you", "your"). It applies whenever we process Personal Data on your behalf in providing Muddy Booking, and it sets out the terms required by Article 28 of the UK General Data Protection Regulation ("UK GDPR").

You accept this DPA by accepting the Terms. No separate signature is needed. If you want a countersigned copy for your records, please contact contact@grizzlyware.com.

1. Definitions

In this DPA:

  • "Data Protection Laws" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended or replaced from time to time.
  • "Personal Data", "Controller", "Processor", "Data Subject", "Processing" and "Personal Data Breach" have the meanings given in the Data Protection Laws.
  • "Customer Personal Data" means Personal Data about your customers and other people that we process on your behalf in providing Muddy Booking, such as their names, contact details, bookings, payments, vouchers, messages and visit history.
  • "Sub-processor" means a third party that we engage to process Customer Personal Data.

2. Roles of the parties

For Customer Personal Data, you are the Controller and we are your Processor. You decide which customers you accept, what you ask them for and how you use their information.

This DPA does not apply to Personal Data that we process as a Controller in our own right, such as your account, billing and support details, and visitors to our marketing website. That processing is described in our Privacy Policy.

3. Your responsibilities

You are responsible for:

  • having a lawful basis for the processing you ask us to carry out, and for telling your customers how you use their information, for example in your own privacy notice;
  • obtaining any consent required before you send your customers marketing messages, including marketing messages sent by email, SMS or WhatsApp through Muddy Booking;
  • making sure your instructions to us comply with Data Protection Laws; and
  • the accuracy and legality of the Customer Personal Data that you, or your customers, give us.

4. Our obligations

4.1 Instructions

We will process Customer Personal Data only on your documented instructions, unless the law requires us to do otherwise. In that case we will tell you about the legal requirement before processing, unless the law forbids us from doing so. Your instructions are set out in the Terms, this DPA and the settings you choose in Muddy Booking.

We will tell you promptly if we believe an instruction breaches Data Protection Laws.

4.2 Confidentiality

We will make sure that everyone we authorise to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory duty of confidentiality, and accesses it only as needed to provide and support Muddy Booking.

4.3 Security

We will put in place appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the UK GDPR. These measures are described in Schedule 2. We may update them from time to time, provided the overall level of protection is not reduced.

4.4 Personal Data Breaches

If we become aware of a Personal Data Breach affecting Customer Personal Data, we will notify you without undue delay, and in any case within 48 hours. We will give you the information reasonably available to us that you need to meet your own obligations, including, where known, the nature of the breach, the categories and approximate number of people and records concerned, its likely consequences, and the measures taken or proposed to deal with it. Where we do not have all of this information at first, we will provide it in stages.

4.5 Requests from your customers

You can view and correct your customers' information in Muddy Booking. If you need to export or delete a customer's information, for example to respond to a request from that customer, contact us at contact@grizzlyware.com and we will do it for you. We will help you respond to requests from your customers exercising their rights under Data Protection Laws. If we receive such a request directly, we will tell the person to contact you, and we will pass the request to you where we can identify you.

4.6 Other assistance

We will give you reasonable assistance with your obligations relating to security, breach notification, data protection impact assessments and prior consultation with the Information Commissioner's Office, taking into account the nature of the processing and the information available to us.

5. Sub-processors

You give us general authorisation to engage Sub-processors. Our current Sub-processors are listed in Schedule 3.

We will tell you about any intended addition or replacement of a Sub-processor by updating the list in Schedule 3 at least 7 days before the change takes effect. If you would like to be emailed when the list changes, please ask us at contact@grizzlyware.com. You may object on reasonable data protection grounds within that period. If we cannot reasonably resolve your objection, you may close your account, without penalty, before the change takes effect.

Where we engage a Sub-processor, we will put in place a written contract that imposes data protection obligations on it which are no less protective than those in this DPA. We remain responsible to you for our Sub-processors.

6. International transfers

We will not transfer Customer Personal Data outside the United Kingdom, or allow a Sub-processor to do so, unless the transfer complies with Data Protection Laws. This means the destination must be covered by UK adequacy regulations (for example, the European Economic Area, or Canada for organisations subject to Canada's federal private-sector privacy law), or appropriate safeguards must be in place, such as the ICO's International Data Transfer Agreement or Addendum, or, for transfers to the United States, the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it.

7. Audits and information

We will make available to you the information reasonably needed to demonstrate our compliance with Article 28 of the UK GDPR, normally through written answers to your reasonable questions and copies of relevant policies or Sub-processor certifications. Where that is not enough, or where a supervisory authority requires it, we will allow and contribute to audits by you or an independent auditor you appoint, on at least 30 days' written notice, no more than once in any 12-month period (unless following a Personal Data Breach), and subject to reasonable confidentiality obligations. You will pay the reasonable costs of any audit unless it shows that we have materially breached this DPA.

8. Return and deletion

While your account is active, you can ask us at any time for a copy of your customers' information, or to delete it.

When your account becomes dormant, as described in the Terms, you can reactivate it or ask us for a copy of your data. If it stays dormant for 12 months, we will email you, and if nobody logs in within 30 days of that email, we will delete Customer Personal Data from our live systems. Deleted data will expire from our backups in line with our normal backup rotation, which is no more than 90 days. We may keep Customer Personal Data where the law requires us to, in which case we will keep it confidential and process it only for that purpose.

9. Liability

Each party's liability under or in connection with this DPA is subject to the limitations of liability in the Terms. Nothing in this DPA limits either party's liability to Data Subjects or to a supervisory authority where the law does not allow it to be limited.

10. General

This DPA lasts for as long as we process Customer Personal Data on your behalf. If there is any conflict between this DPA and the Terms, this DPA takes precedence in relation to Customer Personal Data. We may update this DPA from time to time, for example to reflect changes in Data Protection Laws or in our Sub-processors, but we will not make changes that materially reduce the protection given to Customer Personal Data without your agreement, unless required by law. This DPA is governed by the laws of England and Wales.

Schedule 1: Details of processing

  • Subject matter: providing Muddy Booking to you under the Terms.
  • Duration: for as long as your account is active, and then until Customer Personal Data is deleted under section 8.
  • Nature and purpose: storing and displaying customer records; taking and managing bookings, memberships, vouchers and shop orders; taking payments through your connected Stripe account; sending booking confirmations, reminders and other messages by email, SMS and WhatsApp; giving access codes for smart locks; publishing your public booking website; and providing support, security, backups and error monitoring.
  • Categories of Data Subjects: your customers, people who make or are named in bookings, voucher recipients, and your staff who use Muddy Booking.
  • Categories of Personal Data: names, email addresses, phone numbers, postal addresses, dog details you choose to collect, booking and visit history, payment and invoice records (but not full card details, which Stripe holds), vouchers and memberships, messages and notification history, IP addresses and browser details.
  • Special category data: we do not expect to process it. You must not use Muddy Booking to collect it.

Schedule 2: Technical and organisational security measures

  • Encryption: data is encrypted in transit using TLS. Data at rest, including backups, is encrypted where supported by the underlying infrastructure provider.
  • Access control: staff access to production systems is limited to authorised personnel, uses individual accounts and multi-factor authentication where available, and is removed when no longer needed. Operators control which of their staff can access Muddy Booking.
  • Separation: each operator can only access its own customers' data.
  • Network security: firewalls restrict access to services, and administrative interfaces are not publicly exposed.
  • Patching: operating systems and dependencies are kept up to date, and security updates are applied promptly.
  • Backups and resilience: regular backups are taken and stored separately from the primary systems.
  • Monitoring: systems are monitored for availability, errors and suspicious activity. Logs are kept for as long as needed for security and troubleshooting, and access to them is restricted.
  • Analytics: session recordings mask all text and form inputs, so they do not capture Customer Personal Data shown on screen.
  • Personnel: staff are bound by confidentiality obligations.
  • Incident response: we have a process for detecting, investigating and responding to security incidents, including notifying you under section 4.4.

Schedule 3: Sub-processors

Sub-processor Purpose Location of processing
DigitalOcean, LLC Hosting, databases and search United Kingdom
Cloudflare, Inc. DNS, content delivery, security and bot protection, file storage, email delivery and AI services Global network; see section 6
Amazon Web Services Database backups; backup of public files United Kingdom, copied to European Union (Germany) (database backups); Canada (backup of public files only)
Resend, Inc. Marketing email delivery, and backup delivery of service emails if Cloudflare is unavailable United States
The SMS Works Ltd SMS delivery United Kingdom
Meta Platforms, Inc. WhatsApp message delivery United States; European Union
Mapbox, Inc. Maps and address search, including on your booking website United States
Google LLC Fonts (Google Fonts), including on your booking website United States
PostHog Inc. Product analytics and session recordings (text masked) European Union (Germany)
Functional Software, Inc. (Sentry) Error monitoring European Union (Germany)
Anthropic, PBC AI assistance with support, development and maintenance United States
OpenAI, L.L.C. / OpenAI Ireland Ltd AI assistance with support, development and maintenance United States

Payments are processed by Stripe through the Stripe account that you connect to Muddy Booking. Stripe acts as a separate controller under its agreement with you, not as our Sub-processor.

Contact

If you have any questions about this DPA, please contact us at contact@grizzlyware.com.