Data Processing Agreement (DPA)

1. Roles of the Parties

For the purposes of the UK GDPR and EU GDPR:

• Pillow acts as a Data Controller.
• Providers act as independent Data Controllers in relation to their clients, and as Data Processors when processing personal data via the Pillow platform.

2. Scope of Processing

Pillow may process the following categories of data:

• Provider identification and credentials.
• Public profile information.
• Availability and booking data.
• Client contact and booking details.
• Limited health-related information for matching purposes (with explicit consent).

Processing is limited to:

• Platform operation.
• Matching and booking.
• Payment facilitation.
• Platform improvement (in anonymised or pseudonymised form).

3. Provider Obligations

Providers agree to:

• Process personal data lawfully, fairly, and securely.
• Use personal data only for legitimate professional purposes.
• Implement appropriate technical and organisational security measures.
• Notify Pillow without undue delay of any data breach affecting platform data.

4. Confidentiality

Providers must ensure that any person authorised to process personal data is bound by confidentiality obligations.

5. Sub-processors

Pillow uses trusted third-party service providers (e.g. hosting, payment processors) to operate the platform. Pillow remains responsible for ensuring appropriate safeguards are in place.

6. Data Subject Rights

Providers must cooperate with Pillow in responding to data subject requests, including access, correction, or deletion requests, where platform data is involved.

7. Data Retention & Deletion

Upon termination of the Provider’s account, personal data will be deleted or anonymised unless retention is required by law.

8. Governing Law

This DPA is governed by the laws of England and Wales, in line with the Platform Agreement.

Contact Us

Contact: 📩 team@thepillowlife.com