Data Processing Agreement

Parties and Roles

This Data Processing Agreement ("DPA") is between Auto Growth Limited, registered in England & Wales, Company No. 15991758, registered office 10a High St, Newport, TF10 7AN ("Auto Growth", the "Processor"), and each client that uses our services (the "Client", the "Controller").

This DPA forms part of our Terms of Service and applies whenever Auto Growth processes personal data on behalf of a Client in the course of providing its services. It is intended to meet the requirements of Article 28 of the UK GDPR, together with the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

For personal data of the Client's customers and leads processed through our services — including CRM/GoHighLevel, landing pages, forms, advertising audiences, and call, SMS and email automations — the Client is the data controller and Auto Growth is the data processor, acting only on the Client's documented instructions.

Subject Matter, Nature, Purpose and Duration

Subject matter: the processing of personal data of the Client's customers, leads and prospects in connection with the marketing services Auto Growth provides to the Client.

Nature and purpose: collecting enquiries through landing pages and forms; storing and organising contact records in the CRM; running advertising campaigns and audiences; sending calls, SMS and email automations; and related reporting and optimisation — all as instructed by the Client.

Duration: for the duration of the Client's subscription or service agreement with Auto Growth, plus any period needed to return or delete the data at the end of the services.

Types of Personal Data and Data Subjects

Data subjects: the Client's customers, leads, prospects and enquirers.

Types of personal data: names, phone numbers, email addresses, enquiry details and message content, booking and appointment information, advertising identifiers and audience data, and any other information the Client or its customers supply through the services.

The Client must not supply special category data (such as health data) unless explicitly agreed in writing.

Processor Obligations

Auto Growth will:

• Process personal data only on the Client's documented instructions, unless required by law
• Ensure that people authorised to process the data are bound by confidentiality
• Maintain appropriate technical and organisational security measures to protect the data
• Engage sub-processors only under the general authorisation in this DPA, with notice of intended changes so the Client can object
• Assist the Client, taking into account the nature of the processing, in responding to data subject requests (access, rectification, erasure, restriction, portability and objection) and with data protection impact assessments and prior consultations
• Notify the Client without undue delay after becoming aware of a personal data breach affecting the Client's data
• At the end of the services, delete or return the Client's personal data as the Client chooses, unless the law requires us to keep it
• Make available the information reasonably necessary to demonstrate compliance with this DPA and allow for audits, subject to reasonable notice and confidentiality

Auto Growth will not respond directly to a Client's customer. Any request we receive from a data subject is forwarded to the Client promptly (the same working day where possible). On the Client's written instruction we will provide reasonable assistance — for example, exporting the data we hold in the Client's systems (target 2 working days) and deleting data from the CRM and ad audiences — and confirm in writing.

Controller Obligations

The Client, as controller, is solely responsible for:

• Having a lawful basis for processing its customers' and leads' personal data
• Providing its own privacy policy and cookie notice on its websites and landing pages
• Obtaining and recording valid consent for marketing (SMS, email, calls) and for cookies and tracking pixels, in line with PECR
• Its own ICO registration and payment of the data protection fee
• Responding to subject access requests (SARs), erasure, rectification and objection requests from its own customers within statutory deadlines
• The accuracy of the data it supplies to us
• Ensuring the instructions it gives us are lawful

Sub-Processors

The Client gives general authorisation for Auto Growth to engage the following categories of sub-processors to deliver the services:

• GoHighLevel — CRM, automation and communication platform
• Google — advertising, analytics and business tools
• Meta — advertising platforms
• Stripe — payment processing
• Slack — internal communications
• Website hosting and cloud infrastructure providers

We will give notice of intended changes to this list, and the Client may object on reasonable data protection grounds. Each sub-processor is engaged under terms that protect personal data to a standard consistent with this DPA.

International Transfers

Some sub-processors are based outside the UK or process data overseas. Where personal data is transferred internationally, Auto Growth ensures appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK addendum to EU Standard Contractual Clauses, or transfers to countries covered by UK adequacy regulations.

Liability

The Client indemnifies Auto Growth against claims, fines or losses arising from the Client's failure to meet its controller obligations or from instructions it gives us. Auto Growth's liability under this DPA is limited as set out in the Terms of Service.

Any templates or placeholder privacy text we supply are provided as a convenience only and do not constitute legal advice.

Governing Law

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Contact Us

If you have questions about this Data Processing Agreement, please contact us: