Data Processing Agreement

This Data Processing Agreement ("Agreement") forms part of the contract between:

• Larkspire Inc Ltd trading as Larkspire, operating the product Flyp("Processor", "we", "us"); and
• the merchant who uses Flyp ("Controller", "you", "your").

It governs processing of Merchant Customer Data under UK data protection law, including the UK GDPR and the Data Protection Act 2018. It is incorporated by reference into our Terms of use. Creating a Flyp account or accepting the Terms constitutes acceptance of this Agreement.

1. Definitions

• Personal Data — any information relating to an identifiable individual.
• Merchant Customer Data — Personal Data relating to your customers, leads, or end users that is submitted to or generated in Flyp on your behalf (for example names, contact details, messages, photos, and job details).
• Processing — any operation performed on Personal Data (collection, storage, use, disclosure, deletion, etc.).
• Sub-processor — a third party engaged by us to process Merchant Customer Data.

Account data about you as a merchant (your login, business profile we hold as controller) is covered by our Privacy Policy, not this Agreement.

2. Roles of the parties

• You act as the Data Controller of Merchant Customer Data.
• We act as the Data Processor of Merchant Customer Data.

We will process Merchant Customer Data only on your documented instructions (including configuration and use of Flyp) unless required to do otherwise by law.

3. Scope of processing

We process Merchant Customer Data to provide Flyp, including:

• Lead capture, QR/intake forms, and public chat threads
• Inbox messaging, notifications, and related communications
• Quotes, invoices, and job-related records you create in Flyp
• Storage of attachments you or your customers upload
• Security, abuse prevention, backup, and service reliability
• Support when you ask us to help with your account

4. Data subjects

Data subjects may include:

• Your customers, leads, and other end users who contact you via Flyp
• Individuals whose details appear in messages, photos, or job records

5. Types of personal data

Depending on how you use Flyp, we may process:

• Names, email addresses, phone numbers, and addresses
• Message content, photos, and other attachments
• Job, quote, and invoice details that identify individuals
• Technical data such as IP address and device metadata tied to a thread

We do not intentionally process special category data unless you choose to submit it. You must not use Flyp to process special category data unless you have a lawful basis and have agreed that with us in writing.

6. Duration

We process Merchant Customer Data for the life of your Flyp account and for any reasonable period afterward needed for backups, dispute handling, or legal retention, then delete or anonymise it as described below.

7. Processor obligations

We shall:

• Process Merchant Customer Data only on your documented instructions
• Ensure personnel authorised to process it are bound by confidentiality obligations
• Implement appropriate technical and organisational security measures
• Assist you, where reasonably required, with data subject requests, DPIAs, and breach notifications
• Notify you without undue delay of a personal data breach affecting Merchant Customer Data
• Delete or return Merchant Customer Data on termination of the service (unless law requires retention)
• Maintain records of processing where required

8. Security measures

We implement appropriate measures, including:

• Secure hosting and encrypted transit (HTTPS)
• Access control and authentication
• Isolation of merchant data by account
• Monitoring and operational security practices

No system is completely secure; we cannot guarantee absolute security.

9. Sub-processors

You authorise us to use the following sub-processors (and their own infrastructure providers as needed) to deliver Flyp:

• Vercel Inc. — Application hosting and edge delivery
• Supabase Inc. — Authentication, database, file storage, and related backend services
• Resend, Inc. — Transactional email delivery (notifications, auth emails)

We will ensure sub-processors are bound by data protection obligations providing equivalent protection. We may update this list; continued use of Flyp after an update constitutes acceptance of the revised list unless you object in writing and stop using the service.

10. International transfers

Where Merchant Customer Data is transferred outside the UK, we ensure appropriate safeguards are in place (for example UK adequacy regulations or the UK International Data Transfer Agreement / Addendum / standard contractual clauses, as applicable).

11. Data subject rights

You are responsible for responding to data subject requests relating to Merchant Customer Data. If we receive a request that appears to relate to your customers, we will notify you and provide reasonable assistance.

12. Personal data breach

In the event of a personal data breach affecting Merchant Customer Data, we will:

• Notify you without undue delay
• Provide relevant information about the breach
• Take reasonable steps to mitigate its impact

13. Audit rights

You may request reasonable information to verify our compliance with this Agreement. Audits must be reasonable in scope, subject to confidentiality, and not disrupt normal operations. We may satisfy audit requests with security summaries, certifications, or questionnaires where proportionate.

14. Liability

Each party is responsible for its own compliance with data protection laws. We are not liable for processing carried out in accordance with your instructions, or for data you provide inaccurately. Liability under this Agreement is subject to the limits in the Terms of use.

15. Termination

On termination or account deletion, we will delete or return Merchant Customer Data on request, unless retention is required by law or for legitimate residual purposes (for example backups that expire on a rolling schedule).

16. Governing law

This Agreement is governed by the laws of England and Wales.

17. Contact

Data protection matters: contact@larkspire.co.uk.