Data Processing Agreement

JAR Automation
Last updated: August 2026

This Data Processing Agreement ("DPA") forms part of the agreement between JAR Automation ("Processor", "we", "us") and the client ("Controller", "you") for the provision of automated customer follow-up services.

This DPA sets out how we handle your customers' personal data when delivering our service.

1. Definitions

• Personal Data: any information relating to an identified or identifiable person, as defined by UK GDPR.
• Controller: you, the JAR client. You determine why and how your customers' personal data is processed.
• Processor: JAR Automation. We process your customers' personal data on your behalf, solely to deliver the services you have subscribed to.
• Sub-processor: any third party we use to help deliver the service (listed in section 7).

2. What data we process

In the course of delivering your automations, we process the following categories of personal data belonging to your customers:

• Full name
• Email address
• Phone number (where provided)
• Appointment dates and times
• Service type
• Communication history (messages sent and delivery status)
• Review request status

We do not process any special category data (health, ethnicity, political opinions, etc.) and you must not submit any such data to the platform.

3. Why we process it

We process your customers' personal data solely to:

• Send automated messages on your behalf (review requests, rebooking reminders, win-back messages, booking confirmations, appointment reminders)
• Maintain your customer database
• Generate performance reports for your account
• Generate AI-powered business analysis for JAR Results clients (processed by Anthropic's API, not stored by Anthropic)
• Monitor automation delivery and troubleshoot issues

We do not use your customers' data for our own marketing, analytics, profiling, or any purpose other than delivering your subscribed service.

4. Lawful basis

You (the Controller) are responsible for ensuring you have a lawful basis to process your customers' personal data and to share it with us for the purposes described above. This will typically be legitimate interest (maintaining a customer relationship and providing follow-up communication related to a service they have received).

We (the Processor) process the data solely on your documented instructions, which are defined by the automations configured for your account.

5. How we store it

Your customers' personal data is stored on infrastructure hosted by Supabase (https://supabase.com). Supabase provides database hosting with:

• Encryption at rest (AES-256)
• Encryption in transit (TLS 1.2+)
• Data hosted in the EU/UK region
• Role-based access controls

Access to your data within our systems is restricted to authorised JAR personnel only.

6. Security measures

We implement the following technical and organisational measures to protect your customers' data:

• All data encrypted at rest and in transit
• Access restricted by role-based permissions
• Portal authentication via Supabase Auth (email + password, with option for additional security)
• Regular monitoring of automation delivery and system health
• No customer data stored on local devices or personal machines
• Sub-processors vetted for adequate security practices

7. Sub-processors

We use the following sub-processors to deliver the service:

Scroll to see more →

We will notify you before adding any new sub-processor and give you 14 days to object. If you object and we cannot provide the service without the sub-processor, either party may terminate the agreement.

For sub-processors based outside the UK, data transfers are covered by appropriate safeguards (Standard Contractual Clauses or UK adequacy decisions).

8. Data retention

We retain your customers' personal data for as long as your JAR subscription is active.

On cancellation of your subscription:

• We will export your full customer database and provide it to you in CSV format
• All customer data will be permanently deleted from our systems within 30 days of cancellation
• Automated backups containing your data will be purged within 90 days

We do not retain any customer data after this period unless required by law.

9. Your rights as Controller

You may at any time:

• Request a copy of all personal data we process on your behalf
• Request correction or deletion of specific records
• Request that we stop processing specific data
• Audit our compliance with this DPA (with reasonable notice)

We will respond to any such request within 14 days.

10. Data subject requests

If one of your customers contacts us directly to exercise their rights under UK GDPR (access, deletion, correction, etc.), we will:

• Notify you within 48 hours
• Not respond to the customer directly unless you instruct us to
• Assist you in fulfilling the request

You remain responsible for responding to data subject requests as the Controller.

11. Data breaches

In the event of a personal data breach affecting your customers' data, we will:

• Notify you without undue delay and in any case within 72 hours of becoming aware of the breach
• Provide full details of the breach, including the categories and approximate number of data subjects affected, the likely consequences, and the measures taken to address it
• Cooperate with you in notifying the ICO and affected individuals if required

12. Termination

This DPA terminates automatically when your JAR subscription ends. On termination, the data retention provisions in section 8 apply.

13. Governing law

This DPA is governed by the laws of England and Wales and is subject to the exclusive jurisdiction of the courts of England and Wales.

Joe Robinson, trading as JAR Automation

14. Contact

For questions about this DPA, email info@jarautomation.co.uk.