Data Processing Agreement
Last updated 19 October 2026
This Data Processing Agreement ("DPA") governs how Strkk Ltd, as provider of Perksworth, processes personal data on behalf of a business in connection with the Service. It forms part of the Terms of Service. Here, "controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the UK GDPR. Where we process a business’s customers’ personal data to provide the Service, the business is the controller and Strkk Ltd is the processor.
1. Roles and scope
You are the controller of your customers’ personal data; Perksworth acts as a processor for that data when providing the Service. Each party will comply with its obligations under applicable data protection law.
The subject matter is the provision of the Service; the duration is the term of the Terms; the nature and purpose is hosting, processing payments and operating storefronts and memberships; the types of data are contact, account, transaction and usage data, profile and form details (which may include health information and information about children), and e-signature records including the signer’s internet address; and the data subjects are your customers, the people they look after, and your staff.
Some businesses, such as clinics, use Perksworth to keep health information about their customers (for example allergies or a GP’s name). We hold it only on that business’s behalf and only that business can see it. The business is responsible for having a lawful reason to collect it.
2. Our obligations as processor
We process personal data only on your documented instructions (including as set out in the Terms and configured through the Service), unless required by law, in which case we will inform you where permitted.
We ensure persons authorised to process personal data are bound by confidentiality, implement appropriate technical and organisational security measures, and assist you (taking into account the nature of processing) with data-subject requests and with your obligations on security, breach notification and data protection impact assessments.
3. Sub-processors
You authorise us to engage sub-processors (such as payment, hosting, email and monitoring providers) to process personal data. We impose data protection terms on each sub-processor no less protective than this DPA, and we remain responsible for their performance.
Our current list of sub-processors is published at perksworth.com/legal/sub-processors. We will give you reasonable notice of intended changes so you may object on reasonable data-protection grounds.
4. International transfers
Where processing involves transferring personal data outside the UK, we put in place an appropriate transfer mechanism, such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
5. Personal data breaches
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide reasonable information to help you meet your notification obligations.
6. Return and deletion
On termination of the Service, we will, at your choice, delete or return the personal data we process on your behalf, and delete existing copies unless we are required by law to retain them.
7. Audits
We will make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, subject to reasonable confidentiality and security safeguards.