1. Introduction

• Purpose: This Data Processing Addendum (“DPA”) forms part of the LetPlant Terms of Service and outlines the rights and responsibilities of both LetPlant and its users concerning the processing of personal data. The DPA is intended to ensure compliance with applicable data protection laws, including GDPR.
• Scope: This DPA applies when LetPlant processes personal data on behalf of its users as part of providing the LetPlant services.

2. Definitions

• Data Controller: The user who determines the purposes and means of processing personal data.
• Data Processor: LetPlant, which processes personal data on behalf of the Data Controller.
• Personal Data: Any information related to an identifiable individual that LetPlant processes on behalf of the Data Controller.

3. Data Processing

• Nature of Processing: LetPlant processes personal data for the purposes of delivering its services, including but not limited to user interactions, plant scanning, pet safety checks, and app functionality.
• Types of Data: Personal data processed by LetPlant may include user account information, plant preferences, location data, and pet-related data provided by the user.
• Processing Activities: The processing activities may include collecting, storing, and analyzing data to provide personalized recommendations, pet safety checks, and other app features.

4. Obligations of LetPlant

• Processing Instructions: LetPlant will only process personal data in accordance with the Data Controller’s instructions, as detailed in the LetPlant Terms of Service.
• Data Security: LetPlant implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse. This includes encryption, access controls, and regular security audits.
• Confidentiality: LetPlant ensures that all personnel authorized to process personal data are subject to confidentiality obligations.

5. Obligations of the Data Controller

• Lawful Basis: The Data Controller is responsible for ensuring that they have a lawful basis for the processing of personal data.
• Data Subject Rights: The Data Controller must respect the rights of data subjects, including access, rectification, and erasure requests.
• Compliance: The Data Controller is responsible for complying with applicable data protection laws and for ensuring that LetPlant’s processing activities align with those laws.

6. Data Subject Rights

• Assistance: LetPlant will assist the Data Controller in responding to data subject requests, including requests for access, correction, or deletion of personal data.
• Notification: LetPlant will notify the Data Controller if it receives a data subject request directly and will provide necessary support to address the request.

7. Sub-Processors

• Authorization: The Data Controller authorizes LetPlant to engage sub-processors to assist in providing services, provided that LetPlant remains responsible for the actions of those sub-processors.
• List of Sub-Processors: LetPlant will maintain an up-to-date list of sub-processors, which will be made available to the Data Controller upon request.
• Obligations: LetPlant ensures that sub-processors are bound by similar data protection obligations as those in this DPA.

8. Data Breach Notification

• Obligation to Notify: LetPlant will notify the Data Controller without undue delay if it becomes aware of a personal data breach that may affect the Data Controller’s data.
• Content of Notification: The notification will include the nature of the breach, the categories and approximate number of data subjects affected, and the measures taken or proposed to address the breach.

9. Data Retention and Deletion

• Retention: LetPlant will retain personal data only for as long as necessary to fulfill the purposes outlined in this DPA or as required by law.
• Deletion: Upon termination of the LetPlant services or at the Data Controller’s request, LetPlant will delete or return all personal data in its possession, unless otherwise required by law.

10. Data Transfers

• Transfers: LetPlant may transfer personal data to third countries, provided that such transfers are made in compliance with applicable data protection laws.
• Safeguards: LetPlant will ensure that appropriate safeguards are in place for international data transfers, such as Standard Contractual Clauses or other mechanisms approved by data protection authorities.

11. Audits

• Right to Audit: The Data Controller has the right to audit LetPlant’s compliance with this DPA, either by itself or through an independent auditor, provided that such audits do not disrupt LetPlant’s business operations.
• Frequency and Scope: Audits will be conducted no more than once per year, unless there is a reasonable suspicion of non-compliance.

12. Liability

• Liability: The liability of each party under this DPA is subject to the limitations and exclusions set out in the LetPlant Terms of Service.
• Indemnification: The Data Controller agrees to indemnify LetPlant for any costs or damages arising from the Data Controller’s breach of this DPA.

13. Term and Termination

• Term: This DPA is effective for the duration of the LetPlant services provided to the Data Controller.
• Termination: Upon termination of the LetPlant services, this DPA will automatically terminate, and LetPlant will proceed with data deletion as outlined in Section 9.

14. Governing Law

• Law: This DPA is governed by and construed in accordance with the laws of  England and Wales.
• Dispute Resolution: Any disputes arising from or in connection with this DPA will be resolved through the dispute resolution procedures set out in the LetPlant Terms of Service.

15. Miscellaneous

• Amendments: LetPlant may amend this DPA from time to time, with notice to the Data Controller, to comply with legal requirements or improve service functionality.
• Entire Agreement: This DPA constitutes the entire agreement between the parties with respect to data processing and supersedes any prior agreements.
• Severability: If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions will remain in full force and effect.